Skip to content

Defcon 2018 Qualifier Challenge peaces

Zeev Glozman edited this page May 14, 2018 · 1 revision
	#!/usr/bin/env ngs

	r = collector {
		F build(result:Arr, items:Arr){
			#	echo("Result: $result")
			#	echo("Items: $items")

			if not(items) {
	#			echo(result)
				collect(result)
				return;
			}

			for i in 0..len(items){
				build(result + [items[i]], items[0..i]+items[(i+1)..null]);
			}
		}

		build([], [1,2,3,4,5,6,7,8])
	}

	parts = ["null"] + (1...8).map(F(x) read("fragment_${x}.dat"));

	startBuffer=read("./broken")[0..0x5ad]
	endBuffer=read("./broken")[0x8d4..null] 

	for option in r {
		status("option: $option")
		fragment = option.map(F(x) {parts[x]}).join("");
		write("./testBin", startBuffer + fragment + endBuffer);
		`chmod "+x" testBin`
		out = `ok:true ./testBin`
		if out echo(out)
	}