-1

I'm trying to write a python script that brute forces an ELF program. I need to input very large numbers into this ELF program for it to work. My current script is:

for x in range(10000000000000,100000000000000000):
        print(x)

And then on the command line:

python script.py | ./program

I have identified 2 errors with this, the first is that it gives me a memory error because of the size of the numbers. The second is that the program keeps running after the input. I need it to input into the program, then end the program and input the next value.

The size of the numbers must remain, inputting low numbers will not crack the program.

pythondealer
  • 13
  • 6

2 Answers2

1

You first generate all these numbers, concatenate them into one large string (separated by newlines implicitly added by print) and eventually pipe this single huge string into your program.

You're running out of memory because the string you're generating does not fit into memory.

I guess you want to test each of these numbers separately, one by one. You can do this with python (use the subprocess module). But it's much simpler using bash:

for ((a=10000000000000; a <= 100000000000000000 ; a++)); do
    echo $a | ./program
done
pasbi
  • 2,037
  • 1
  • 20
  • 32
  • I'd argue it is equally simple ;-) – norok2 Jan 02 '20 at 18:05
  • well, there's no need to start python in this case. But as soon as the numbers grow bigger or the generation scheme becomes less trivial, the python solution will be superior. – pasbi Jan 02 '20 at 18:10
1

I would do this in Python 3 and would use the subprocess submodule:

import subprocess


for x in range(10000000000000, 100000000000000000):
    subprocess.run(f'echo {x} | ./program', shell=True)

or, being less reliant on the shell:

import os
import subprocess


cmd = os.path.join(os.path.realpath('.'), 'program')
for x in range(10000000000000, 100000000000000000):
    subprocess.run(cmd, input=f'{x}'.encode())

to be simply run as:

python3 script.py
norok2
  • 25,683
  • 4
  • 73
  • 99
  • More info here https://stackoverflow.com/questions/163542/python-how-do-i-pass-a-string-into-subprocess-popen-using-the-stdin-argument – norok2 Jan 02 '20 at 18:29