Skip to content

Commit 74cb99f

Browse files
fix(fmtstr): Fix 'IndexError' bug
`f.leaker.s(...)` crashes sometimes, especially when using DynELF. Happens when only "START[STRING]" is returned. This is due to the null byte truncating the rest of the pattern.
1 parent 1fc3062 commit 74cb99f

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

pwnlib/fmtstr.py

+6-2
Original file line numberDiff line numberDiff line change
@@ -972,12 +972,16 @@ def _leaker(self, addr):
972972
return b"\x7f"
973973

974974
fmtstr = fit({
975-
self.padlen: b"START%%%d$sEND" % (self.offset + 16//context.bytes),
975+
self.padlen: b"START%%%d$sEND" % (self.offset),
976976
16 + self.padlen: addr
977977
})
978978

979979
leak = self.execute_fmt(fmtstr)
980-
leak = re.findall(br"START(.*)END", leak, re.MULTILINE | re.DOTALL)[0]
980+
try:
981+
leak = re.findall(br"START(.*)END", leak, re.MULTILINE | re.DOTALL)[0]
982+
except IndexError:
983+
# FIXME: Let's hope not to find a collision :)
984+
leak = leak[leak.find(b'START') + 5:]
981985

982986
leak += b"\x00"
983987

0 commit comments

Comments
 (0)