pwn

理解pwntools最常用的几个函数

Posted by Kody Black on November 14, 2023

p64,u64,p32,u32

首先遇事先找文档:pwnlib.memleak

from pwn import *
a = 0x12345678
a64 = p64(a)
a32 = p32(a)
a64, a32
# (b'xV4\x12\x00\x00\x00\x00', b'xV4\x12')

# 首先,u和p是相反的,u是将字符串转换为整数,p是将整数转换为字符串
u32(a32) == a, u64(a64) == a
# (True, True)

# u32(x)等价于int.from_bytes(x, 'little')
int.from_bytes(a32, 'little') == a, int.from_bytes(a64, 'little') == a
# (True, True)

# p32(x)等价于int.to_bytes(x, 4, 'little'),意思是说将x转换为4字节的字符串
# 因此p32限制x的大小 0 <= x <= 4294967295 = 2**32 - 1
int.to_bytes(a, 4, 'little') == a32, int.to_bytes(a, 8, 'little') == a64
# (True, True)
# 需要注意b"0x12345678"和p32(0x12345678)是两回事
b32 = b"0x12345678"
b64 = b"0x0000000012345678"
b32 == a32, b64 == a64
# (False, False)

# 当我们接收到b"0x12345678"这样的字符时,就不能用u32()了,因为这是字符串,而不是整数
# 对于这种情况使用类型转换int(b, 16)即可
int(b32, 16) == a ,int(b64, 16) == a
# (True, True)