Pwnable.kr系列--collision(2)

输入为一个长为20的字符串，check_password函数的意思是把这20字节的字符串转为5个4字节的整型数求值，求和结果和hashcode值做比较，相同则读取flag

脚本如下

#! /usr/bin/env python

# -*- coding: utf-8 -*-

import subprocess

from pwn import *

hashcode = 0x21DD09EC

tmp1 = 0x01010101

tmp2 = hashcode - 4 * tmp1

payload = p32(tmp1) * 4 + p32(tmp2)

target = subprocess.Popen(args=["/home/col/col", payload])