guyinatuxedo/nightmare

In Gitbook simplecalc is given before speedrun1

harpsiford opened this issue · 0 comments

Hello everyone!
I noticed that speedrun1 (section 2.10) is given after simplecalc (2.9) in the wiki at github.io. I think this isn't intentional, because in the README the exercise order is different.

I think that it's better to give speedrun1 first, because its writeup gives a really good intro to ROP, while the writeup to simplecalc assumes that you already know what it is. To compare:
Speedrun1:

We have an overflow that we can overwrite the return address with and get code execution. The question now is what to do with it?
We will be making a ROP Chain (Return Oriented Programming) and using the buffer overflow to execute it. A ROP Chain is made up of ROP Gadgets, which are bits of code in the binary itself that end in a ret instruction (which will carry it over to the next gadget). We will essentially...

SimpleCalc:

Now for what to execute when we get the return address. Since the binary is statically linked and there is no PIE, we can just build a rop chain using the binary for gadgets and without an infoleak. The ROP Chain will essentially just make an execve syscall to /bin/sh. There are four registers...

I looked at the repo files, but wasn't sure how to fix this, so I didn't submit a pull request. What do you think?