[Pwnable.kr] BrainFuck

by yiz96 24. 2 月 2016 pwnable writeup 1

第二部分的第一题，150分（比第一部分总和还高……），F5整理一下代码还是很容易看懂的：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax@4
  int v4; // edx@4
  size_t i; // [esp+28h] [ebp-40Ch]@1
  int v6; // [esp+2Ch] [ebp-408h]@1
  int v7; // [esp+42Ch] [ebp-8h]@1

  v7 = *MK_FP(__GS__, 20);
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stdin, 0, 1, 0);
  p = (int)&amp;tape;
  puts("welcome to brainfuck testing system!!");
  puts("type some brainfuck instructions except [ ]");
  memset(&amp;v6, 0, 0x400u);
  fgets((char *)&amp;v6, 1024, stdin);
  for ( i = 0; i &lt; strlen((const char *)&amp;v6); ++i )
    do_brainfuck(*((_BYTE *)&amp;v6 + i));
  result = 0;
  v4 = *MK_FP(__GS__, 20) ^ v7;
  return result;
}

int __cdecl do_brainfuck(char a1)
{
  int result; // eax@1
  _BYTE *v2; // ebx@7

  result = a1;
  switch ( a1 )
  {
    case 43:
      result = p;
      ++*(_BYTE *)p;
      break;
    case 44:
      v2 = (_BYTE *)p;
      result = getchar();
      *v2 = result;
      break;
    case 45:
      result = p;
      --*(_BYTE *)p;
      break;
    case 46:
      result = putchar(*(char *)p);
      break;
    case 60:
      result = p-- - 1;
      break;
    case 62:
      result = p++ + 1;
      break;
    case 91:
      result = puts("[ and ] not supported.");
      break;
    default:
      return result;
  }
  return result;
}

int __cdecl main(int argc, const char **argv, const char **envp)

{

int result; // eax@4

int v4; // edx@4

size_t i; // [esp+28h] [ebp-40Ch]@1

int v6; // [esp+2Ch] [ebp-408h]@1

int v7; // [esp+42Ch] [ebp-8h]@1

v7 = *MK_FP(__GS__, 20);

setvbuf(stdout, 0, 2, 0);

setvbuf(stdin, 0, 1, 0);

p = (int)&tape;

puts("welcome to brainfuck testing system!!");

puts("type some brainfuck instructions except [ ]");

memset(&v6, 0, 0x400u);

fgets((char *)&v6, 1024, stdin);

for ( i = 0; i < strlen((const char *)&v6); ++i )

do_brainfuck(*((_BYTE *)&v6 + i));

result = 0;

v4 = *MK_FP(__GS__, 20) ^ v7;

return result;

}

int __cdecl do_brainfuck(char a1)

{

int result; // eax@1

_BYTE *v2; // ebx@7