eddie xiao

About

Thu, 03 Sep 2026 00:00:00 +0000

A boutique vulnerability researcher and CTF player at heart.

Interests include mobile devices, weird machines, networking equipment

pwntools quickref

Thu, 01 Sep 2022 00:00:00 +0000

Holy Grail of ROP

Mon, 15 Aug 2022 00:00:00 +0000

The ROP God has tasked King Arthur with finding the function called "holy_grail". You must aid him on his quest! But be warned, the way is guarded by a text-based sorcerer whom loves old British comedy movies, and just to make things harder, you're going to have to find "holy_grail" 3 times! ...Or was it 5 times? Use your pwning knowledge to answer the sorcerer's questions and ROP your way to the holy grail and bring this holy relic home for the glory of England!

Gibson: format strings on s390x

Mon, 25 Jul 2022 00:00:00 +0000

"Can you really call it a "main"frame if I haven't used it before now?"

Author:crandyman

No remote connection, Manual Submission Only

tl;dr

Leaks with Format String> ROP With BOF OR Leaks with Format String> GOT Overwrite

Overview

This challenge was a hard pwn from US Cyber Open. The exploit was actually not that complicated but the fact that it used the s390 architecture made it challenging. The lack of decent documentation and tooling support made this challenge unfamiliar and getting the local environment to work was a pain.

16-Bit: XOR-only shellcoding

Fri, 10 Jun 2022 00:00:00 +0000

During the ICC competition we where given a shellcoding challenge to make a base64 encoded shellcode, ie the shellcode could only consist of the characters "a-zA-Z0-9+/=", during an 8 hour ctf we completed it in about 1.5 hours. How long will it take you to create base16 shellcode?

Provided: chal + libc.so.6

tl;dr: Xor the hell out of everything

Disclaimer: I did not solve this challenge during the CTF. After the CTF ended skimmed over these writeups and chatted with another solver. My approach was pretty similar to the second writeup.