<commit_before>---
layout: post
title: "ARMPWN challenge write-up"
date: 2016-06-13 12:21:05 +1100
comments: false
author: hugsy
tags: pwn arm gef gdb ida ropgadget pwntools
---

## Info ##

A few weeks ago, I came accross {% include icon-twitter.html username="@5aelo" %} repo called [armpwn](https://github.com/saelo/armpwn) for people wanting
to have a bit of ARM fun. I had recently spent some time adding new features and perfectionning old ones to
my exploit helper [`gdb-gef`](https://github.com/hugsy/gef.git) and I saw
there a perfect practice case. On top of that, I had nothing better to do
yesterday ☺

This is challenge was really fun, and made so much easier thanks to `gef` especially to
defeat real-life protections (NX/ASLR/PIC/Canary), and on a different architecture (Intel is so
'90). This is mostly why I'm doing this write-up, but feel curious and do it by
yourself. Fun time ahead guaranteed ☺

[5aelo](https://github.com/saelo/armpwn/blob/master/README.md#how-to-use-this-repository) suggests a few
approaches to tackle it, I decided to go "Total Pwn", meaning discovering
everything about the binary.

__Challenge__:<commit_msg>Update 2016-06-13-armpwn-challenge.md<commit_after>---
layout: post
title: "ARMPWN challenge write-up"
date: 2016-06-13 12:21:05 +1100
comments: false
author: hugsy
tags: exploit arm gef gdb ida ropgadget pwntools
---

## Info ##

A few weeks ago, I came accross {% include icon-twitter.html username="@5aelo" %} repo called [armpwn](https://github.com/saelo/armpwn) for people wanting
to have a bit of ARM fun. I had recently spent some time adding new features and perfectionning old ones to
my exploit helper [`gdb-gef`](https://github.com/hugsy/gef.git) and I saw
there a perfect practice case. On top of that, I had nothing better to do
yesterday ☺

This challenge was really fun, and made so much easier thanks to `gef` especially to
defeat real life protections (NX/ASLR/PIC/Canary), and on a different architecture (Intel is so
'90). This is mostly why I'm doing this write-up, but feel curious and do it by
yourself. Fun time ahead guaranteed ☺

[5aelo](https://github.com/saelo/armpwn/blob/master/README.md#how-to-use-this-repository) suggests a few
approaches to tackle it, I decided to go "Total Pwn", meaning discovering
everything about the binary.

__Challenge__:
{'fraction_non_alphanumeric': 0.0960960960960961, 'fraction_numerical': 0.02230802230802231, 'mean_word_length': 4.4485981308411215, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3730625', 'n_tokens_mistral': 786, 'n_tokens_neox': 734, 'n_words': 312}