[Get IP control offset] works for simple bof binaries. #eip #overflow #memorycorrupt #binary #radare2 #r2 #systemd #coredump #ragg2 #crash #debruijn

get_ip_control.sh

get_eip_control() {
	(ragg2 -P 1024 -r | $*) && echo "No eip control found" && return 1
    (coredumpctl dump > eip_control.core) 2>/dev/null
    local eip=$(r2 -qc "dr eip" eip_control.core | tail -n 1)
    echo "Offset to control EIP: $(r2 -qc "wopO $eip" --)"
    rm eip_control.core
}