Corefile fault_addr on amd64

[zachriggle]

When doing ROP on amd64, the fault_addr of the generated corefile is zero.

This is a little bit confusing, because the fault address is not zero, it's whatever is on the top of the stack (e.g. faaagaaa).

This is extra confusing because i386 behaves how we would expect.

I suggest the following change which should make things function the way we'd expect.

try:
  if core.arch == 'amd64' and core.fault_addr == 0 and core.read(core.pc, 1) == '\xc3':
    core.fault_addr = core.unpack(core.sp)
except Exception:
  pass

[zachriggle]

The context / impetus for this is the challenges in ROP Emporium are provided in both architectures, and it should be possible to have a single exploit script that works for either.

Currently, this is the biggest hiccup, aside from limitations of pwnlib.rop.rop.ROP.setRegisters requiring super basic gadgets.

[bennofs]

What's the \xc3 magic constant there?

[zachriggle]

It is a ret instruction.

[zachriggle]

Fixed in #1031