libformatstr icon indicating copy to clipboard operation
libformatstr copied to clipboard

Bug relating to autosort in PayloadGenerator

Open dok852 opened this issue 8 years ago • 4 comments

There's a mistake in the autosorting logic inside PayloadGenerator, as a consequence payload generation will often fail, raising a ValueError: Unknown error. Missing bytes on line 166 or an IndexError: list index out of range on line 180 of core.py.

A proof of concept crash:

from libformatstr import *

f = FormatStr()
f[0xdddddd05] = 0xcccccccc
payload = f.payload(6)

This is as a result of the if statement on line 145 of core.py being the wrong way round. At the moment the default value of autosort is True, and the if statement is:

if autosort:
    self.addrs = list(mem.keys())  # addresses of each byte to set
else:
    self.addrs = list(sorted(mem.keys()))

Which means the keys aren't sorted by default, causing various problems. To rectify this the lines can simply be switched around like so:

if autosort:
    self.addrs = list(sorted(mem.keys()))  # addresses of each byte to set
else:
    self.addrs = list(mem.keys())

This only appears to be a problem in this git repository. The versions in pip don't have the autosort property so keys are always sorted and this problem doesn't exist.

dok852 avatar Oct 11 '17 22:10 dok852

Well, maybe there is an error. But I cannot reproduce your crash. I'm late because I don't get the notification...:( Sorry.

rip1s avatar Feb 09 '18 08:02 rip1s

Don't worry about it! Make sure you're testing the version in this repository, not the version in PyPI (because that appears to be a different version, without the autosort property). I've just cloned this repository again and reproduced the error. See the following screenshot.

poc

dok852 avatar Feb 09 '18 10:02 dok852

Well, actually this feature was committed by me....I wrote it because it is useful in some CTF challenges. In my machine your code work just fine, but I use my submitted version. 0

Later I will check the version in this repo.

rip1s avatar Feb 12 '18 01:02 rip1s

Did you test the code in this repository?

dok852 avatar Aug 16 '18 18:08 dok852