Initial import
This commit is contained in:
yan
@@ -0,0 +1,52 @@
|
||||
CC=gcc
|
||||
CFLAGS=-O3 -static
|
||||
|
||||
all: CFLAGS=-O3 -static
|
||||
all: NOSTDLIBFLAGS=-m32 -fno-builtin -static -nostdlib -fomit-frame-pointer
|
||||
all: nostdlib basic sindex strncmp arguments ibranch sendmail cbahacks indexhell baby-re helloworld
|
||||
|
||||
arm: CC=arm-linux-gnueabi-gcc
|
||||
arm: basic sindex strncmp arguments ibranch sendmail cbahacks indexhell helloworld simple_copy
|
||||
|
||||
clean:
|
||||
rm -rf nostdlib basic sindex strncmp arguments sendmail server ibranch cbahacks indexhell cbahacks.c simple_copy
|
||||
|
||||
nostdlib: nostdlib.c
|
||||
$(CC) -m32 -fno-builtin -static -nostdlib -fomit-frame-pointer nostdlib.c -o nostdlib32
|
||||
$(CC) -m32 -fno-builtin -static -nostdlib -fomit-frame-pointer nostdlib.c -o nostdlib64
|
||||
|
||||
helloworld: helloworld.c
|
||||
$(CC) $(CFLAGS) $< -static -o $@
|
||||
|
||||
simple_copy: simple_copy.c
|
||||
$(CC) $(CFLAGS) simple_copy.c -static -o simple_copy
|
||||
basic: basic.c
|
||||
$(CC) $(CFLAGS) basic.c -static -o basic
|
||||
|
||||
sindex: sindex.c
|
||||
$(CC) $(CFLAGS) sindex.c -o sindex
|
||||
ibranch: ibranch.c
|
||||
$(CC) $(CFLAGS) ibranch.c -o ibranch
|
||||
|
||||
strncmp: strncmp.c
|
||||
$(CC) $(CFLAGS) strncmp.c -o strncmp
|
||||
|
||||
arguments: arguments.c
|
||||
$(CC) $(CFLAGS) arguments.c -o arguments
|
||||
|
||||
sendmail: sendmail.c
|
||||
gcc -static sendmail.c -o sendmail
|
||||
|
||||
server: server.c
|
||||
gcc -static server.c -o server
|
||||
|
||||
|
||||
cbahacks: cbahacks.py
|
||||
python cbahacks.py >cbahacks.c
|
||||
gcc -static cbahacks.c -o cbahacks
|
||||
|
||||
indexhell: indexhell.c
|
||||
gcc -static indexhell.c -o indexhell
|
||||
|
||||
baby-re: baby-re.c
|
||||
$(CC) $(CFLAGS) -o $@ $< -Wno-unused-result
|
||||
@@ -0,0 +1,32 @@
|
||||
/* Minimal toy example with input from argv
|
||||
*
|
||||
* The "special" character '+' marks symbolic bytes on the argyuments to the program.
|
||||
*
|
||||
* Compile with :
|
||||
* $ gcc toy005-arguments.c -o toy005-arguments
|
||||
*
|
||||
* Analize it with:
|
||||
* $ python system.py example/toy005-arguments ++++++++++
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
|
||||
int main(int argc, char* argv[], char* envp[]){
|
||||
int i;
|
||||
|
||||
printf("Got %d arguments.\n", argc);
|
||||
if(argc > 1){
|
||||
if (!strcmp(argv[1], "--dostuff")){
|
||||
printf ("Do stuff!\n");
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
printf ("Don't do anything!\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,627 @@
|
||||
/*
|
||||
* DEFCON CTF Quals 2016: baby-re
|
||||
*
|
||||
* Note: Challenge was ported to use read(2) instead of scanf(3)
|
||||
*
|
||||
* To run:
|
||||
* $ python main.py baby-re
|
||||
*
|
||||
* Look in the output directory for a .stdout file containing "The flag"
|
||||
*/
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
uint8_t CheckSolution(int32_t Var[]) {
|
||||
volatile int32_t C[169];
|
||||
asm __volatile__(".long 0x022802eb");
|
||||
C[0] = 37484;
|
||||
C[0] = C[0] ^ 1;
|
||||
C[1] = 172968;
|
||||
C[1] = C[1] >> 3;
|
||||
C[2] = 14992;
|
||||
C[2] = C[2] >> 3;
|
||||
C[3] = 46273;
|
||||
asm __volatile__(".long 0xd94f02eb");
|
||||
asm __volatile__(".long 0xb75102eb");
|
||||
C[4] = 50452;
|
||||
C[4] = C[4] ^ 221;
|
||||
C[5] = 43166;
|
||||
asm __volatile__(".long 0x88b202eb");
|
||||
C[6] = 118216;
|
||||
C[6] = C[6] >> 2;
|
||||
C[7] = 65552;
|
||||
C[7] = C[7] >> 2;
|
||||
C[8] = 57693;
|
||||
asm __volatile__(".long 0x30d902eb");
|
||||
asm __volatile__(".long 0xce2d02eb");
|
||||
C[9] = 7313;
|
||||
C[9] = C[9] << 1;
|
||||
asm __volatile__(".long 0xe25d02eb");
|
||||
C[10] = 21068;
|
||||
C[10] = C[10] ^ 46;
|
||||
C[11] = 39342;
|
||||
asm __volatile__(".long 0x208602eb");
|
||||
C[12] = 54757;
|
||||
asm __volatile__(".long 0x017b02eb");
|
||||
C[13] = 814976;
|
||||
C[13] = C[13] >> 4;
|
||||
C[14] = 76944;
|
||||
C[14] = C[14] >> 4;
|
||||
C[15] = 6019;
|
||||
asm __volatile__(".long 0xea8402eb");
|
||||
C[16] = 38962;
|
||||
asm __volatile__(".long 0x0df702eb");
|
||||
asm __volatile__(".long 0xfc6c02eb");
|
||||
C[17] = 7397;
|
||||
C[17] = C[17] << 1;
|
||||
asm __volatile__(".long 0x999e02eb");
|
||||
C[18] = 22536;
|
||||
C[18] = C[18] ^ 79;
|
||||
C[19] = 837;
|
||||
asm __volatile__(".long 0x9b1c02eb");
|
||||
C[20] = 73454;
|
||||
C[20] = C[20] >> 1;
|
||||
C[21] = 50592;
|
||||
asm __volatile__(".long 0xcc4602eb");
|
||||
C[22] = 11829;
|
||||
asm __volatile__(".long 0xb5cd02eb");
|
||||
C[23] = 20046;
|
||||
asm __volatile__(".long 0xffae02eb");
|
||||
C[24] = 37024;
|
||||
C[24] = C[24] >> 2;
|
||||
asm __volatile__(".long 0x92cf02eb");
|
||||
C[25] = 26614;
|
||||
C[25] = C[25] << 1;
|
||||
C[26] = 619680;
|
||||
C[26] = C[26] >> 4;
|
||||
C[27] = 105886;
|
||||
C[27] = C[27] >> 1;
|
||||
C[28] = 135056;
|
||||
C[28] = C[28] >> 3;
|
||||
C[29] = 26907;
|
||||
asm __volatile__(".long 0x231802eb");
|
||||
asm __volatile__(".long 0x5b0d02eb");
|
||||
C[30] = 22223;
|
||||
C[30] = C[30] << 1;
|
||||
asm __volatile__(".long 0xbd2902eb");
|
||||
C[31] = 18533;
|
||||
C[31] = C[31] ^ 204;
|
||||
C[32] = 65221;
|
||||
asm __volatile__(".long 0x519402eb");
|
||||
asm __volatile__(".long 0x18d802eb");
|
||||
C[33] = 47431;
|
||||
C[33] = C[33] ^ 240;
|
||||
C[34] = 17702;
|
||||
asm __volatile__(".long 0x7cca02eb");
|
||||
C[35] = 33910;
|
||||
asm __volatile__(".long 0x9b5902eb");
|
||||
asm __volatile__(".long 0xbc7902eb");
|
||||
C[36] = 21327;
|
||||
C[36] = C[36] << 1;
|
||||
asm __volatile__(".long 0xa7a602eb");
|
||||
C[37] = 5222;
|
||||
C[37] = C[37] ^ 157;
|
||||
C[38] = 11469;
|
||||
asm __volatile__(".long 0xd05b02eb");
|
||||
C[39] = 230988;
|
||||
C[39] = C[39] >> 2;
|
||||
asm __volatile__(".long 0xd22a02eb");
|
||||
C[40] = 23810;
|
||||
C[40] = C[40] ^ 83;
|
||||
C[41] = 52032;
|
||||
C[41] = C[41] >> 1;
|
||||
asm __volatile__(".long 0xa7e802eb");
|
||||
C[42] = 12585;
|
||||
C[42] = C[42] << 1;
|
||||
C[43] = 54317;
|
||||
asm __volatile__(".long 0x81d602eb");
|
||||
C[44] = 32337;
|
||||
asm __volatile__(".long 0x741302eb");
|
||||
C[45] = 42596;
|
||||
C[45] = C[45] >> 2;
|
||||
asm __volatile__(".long 0xa2d202eb");
|
||||
C[46] = 34701;
|
||||
C[46] = C[46] ^ 120;
|
||||
C[47] = 146736;
|
||||
C[47] = C[47] >> 4;
|
||||
asm __volatile__(".long 0xbecd02eb");
|
||||
C[48] = 22951;
|
||||
C[48] = C[48] ^ 224;
|
||||
C[49] = 34484;
|
||||
C[49] = C[49] >> 2;
|
||||
C[50] = 1268;
|
||||
C[50] = C[50] >> 1;
|
||||
asm __volatile__(".long 0x7eab02eb");
|
||||
C[51] = 5932;
|
||||
C[51] = C[51] << 1;
|
||||
C[52] = 14005;
|
||||
asm __volatile__(".long 0x7df902eb");
|
||||
C[53] = 16323;
|
||||
asm __volatile__(".long 0x7ef002eb");
|
||||
asm __volatile__(".long 0x82da02eb");
|
||||
C[54] = 43993;
|
||||
C[54] = C[54] ^ 101;
|
||||
asm __volatile__(".long 0xcadf02eb");
|
||||
C[55] = 17335;
|
||||
C[55] = C[55] << 1;
|
||||
C[56] = 54889;
|
||||
asm __volatile__(".long 0xbc0d02eb");
|
||||
C[57] = 12282;
|
||||
C[57] = C[57] >> 1;
|
||||
asm __volatile__(".long 0xcd0302eb");
|
||||
C[58] = 35394;
|
||||
C[58] = C[58] ^ 33;
|
||||
C[59] = 61977;
|
||||
asm __volatile__(".long 0x472b02eb");
|
||||
asm __volatile__(".long 0xcfe702eb");
|
||||
C[60] = 28053;
|
||||
C[60] = C[60] ^ 115;
|
||||
asm __volatile__(".long 0x8fba02eb");
|
||||
C[61] = 21593;
|
||||
C[61] = C[61] << 1;
|
||||
asm __volatile__(".long 0xfc7802eb");
|
||||
C[62] = 29838;
|
||||
C[62] = C[62] << 1;
|
||||
C[63] = 31156;
|
||||
C[63] = C[63] >> 1;
|
||||
asm __volatile__(".long 0x545902eb");
|
||||
C[64] = 25041;
|
||||
C[64] = C[64] << 1;
|
||||
C[65] = 163040;
|
||||
C[65] = C[65] >> 2;
|
||||
asm __volatile__(".long 0x225202eb");
|
||||
C[66] = 11007;
|
||||
C[66] = C[66] << 1;
|
||||
asm __volatile__(".long 0xcc8802eb");
|
||||
C[67] = 6804;
|
||||
C[67] = C[67] << 1;
|
||||
asm __volatile__(".long 0x99a902eb");
|
||||
C[68] = 5061;
|
||||
C[68] = C[68] ^ 151;
|
||||
C[69] = 214000;
|
||||
C[69] = C[69] >> 3;
|
||||
C[70] = 31708;
|
||||
asm __volatile__(".long 0x4f0702eb");
|
||||
asm __volatile__(".long 0x4ef102eb");
|
||||
C[71] = 39583;
|
||||
C[71] = C[71] ^ 44;
|
||||
asm __volatile__(".long 0xea1402eb");
|
||||
C[72] = 13694;
|
||||
C[72] = C[72] ^ 92;
|
||||
C[73] = 59055;
|
||||
asm __volatile__(".long 0x3cac02eb");
|
||||
C[74] = 65476;
|
||||
C[74] = C[74] >> 1;
|
||||
asm __volatile__(".long 0x20b302eb");
|
||||
C[75] = 29347;
|
||||
C[75] = C[75] ^ 62;
|
||||
asm __volatile__(".long 0xeea802eb");
|
||||
C[76] = 10450;
|
||||
C[76] = C[76] ^ 147;
|
||||
C[77] = 15650;
|
||||
asm __volatile__(".long 0xbc5e02eb");
|
||||
C[78] = 189996;
|
||||
C[78] = C[78] >> 2;
|
||||
C[79] = 57856;
|
||||
asm __volatile__(".long 0x481302eb");
|
||||
C[80] = 13477;
|
||||
asm __volatile__(".long 0x480702eb");
|
||||
C[81] = 20438;
|
||||
C[81] = C[81] >> 1;
|
||||
asm __volatile__(".long 0xf45902eb");
|
||||
C[82] = 4930;
|
||||
C[82] = C[82] ^ 234;
|
||||
asm __volatile__(".long 0xd26902eb");
|
||||
C[83] = 21229;
|
||||
C[83] = C[83] ^ 194;
|
||||
asm __volatile__(".long 0x5e2a02eb");
|
||||
C[84] = 29604;
|
||||
C[84] = C[84] ^ 3;
|
||||
asm __volatile__(".long 0xc9df02eb");
|
||||
C[85] = 55130;
|
||||
C[85] = C[85] ^ 147;
|
||||
C[86] = 24260;
|
||||
C[86] = C[86] >> 2;
|
||||
C[87] = 64188;
|
||||
C[87] = C[87] >> 2;
|
||||
C[88] = 36432;
|
||||
C[88] = C[88] >> 3;
|
||||
asm __volatile__(".long 0x1c7c02eb");
|
||||
C[89] = 1131;
|
||||
C[89] = C[89] << 1;
|
||||
C[90] = 18903;
|
||||
asm __volatile__(".long 0x885602eb");
|
||||
asm __volatile__(".long 0xeb6102eb");
|
||||
C[91] = 65297;
|
||||
C[91] = C[91] ^ 154;
|
||||
asm __volatile__(".long 0x817602eb");
|
||||
C[92] = 17295;
|
||||
C[92] = C[92] ^ 152;
|
||||
C[93] = 18820;
|
||||
C[93] = C[93] >> 1;
|
||||
asm __volatile__(".long 0xc1b102eb");
|
||||
C[94] = 11257;
|
||||
C[94] = C[94] << 1;
|
||||
C[95] = 209508;
|
||||
C[95] = C[95] >> 2;
|
||||
C[96] = 18470;
|
||||
C[96] = C[96] >> 1;
|
||||
C[97] = 53309;
|
||||
asm __volatile__(".long 0xeafa02eb");
|
||||
C[98] = 383272;
|
||||
C[98] = C[98] >> 3;
|
||||
C[99] = 59111;
|
||||
asm __volatile__(".long 0x0ba802eb");
|
||||
asm __volatile__(".long 0xf93a02eb");
|
||||
C[100] = 41430;
|
||||
C[100] = C[100] ^ 159;
|
||||
asm __volatile__(".long 0x2bfe02eb");
|
||||
C[101] = 12211;
|
||||
C[101] = C[101] << 1;
|
||||
C[102] = 41178;
|
||||
asm __volatile__(".long 0x033702eb");
|
||||
C[103] = 23447;
|
||||
asm __volatile__(".long 0x551b02eb");
|
||||
C[104] = 7220;
|
||||
C[104] = C[104] >> 2;
|
||||
asm __volatile__(".long 0xc9b302eb");
|
||||
C[105] = 4350;
|
||||
C[105] = C[105] ^ 217;
|
||||
asm __volatile__(".long 0x45d602eb");
|
||||
C[106] = 8450;
|
||||
C[106] = C[106] << 1;
|
||||
asm __volatile__(".long 0xce2802eb");
|
||||
C[107] = 33371;
|
||||
C[107] = C[107] ^ 62;
|
||||
C[108] = 187068;
|
||||
C[108] = C[108] >> 2;
|
||||
C[109] = 58551;
|
||||
asm __volatile__(".long 0xbb6e02eb");
|
||||
C[110] = 34118;
|
||||
asm __volatile__(".long 0x9a6002eb");
|
||||
asm __volatile__(".long 0x7c6602eb");
|
||||
C[111] = 44865;
|
||||
C[111] = C[111] ^ 57;
|
||||
C[112] = 11933;
|
||||
asm __volatile__(".long 0x58c902eb");
|
||||
C[113] = 82120;
|
||||
C[113] = C[113] >> 2;
|
||||
C[114] = 125592;
|
||||
C[114] = C[114] >> 3;
|
||||
asm __volatile__(".long 0x680702eb");
|
||||
C[115] = 36459;
|
||||
C[115] = C[115] ^ 158;
|
||||
C[116] = 18231;
|
||||
asm __volatile__(".long 0xeca202eb");
|
||||
asm __volatile__(".long 0x03f402eb");
|
||||
C[117] = 42924;
|
||||
C[117] = C[117] ^ 17;
|
||||
C[118] = 61056;
|
||||
asm __volatile__(".long 0xc01b02eb");
|
||||
C[119] = 45169;
|
||||
asm __volatile__(".long 0xc93902eb");
|
||||
asm __volatile__(".long 0xf4c102eb");
|
||||
C[120] = 20642;
|
||||
C[120] = C[120] << 1;
|
||||
asm __volatile__(".long 0x978e02eb");
|
||||
C[121] = 861;
|
||||
C[121] = C[121] << 1;
|
||||
asm __volatile__(".long 0x8f3d02eb");
|
||||
C[122] = 26574;
|
||||
C[122] = C[122] ^ 249;
|
||||
asm __volatile__(".long 0xaaaa02eb");
|
||||
C[123] = 47043;
|
||||
C[123] = C[123] ^ 15;
|
||||
C[124] = 42363;
|
||||
asm __volatile__(".long 0x2f0002eb");
|
||||
C[125] = 120264;
|
||||
C[125] = C[125] >> 3;
|
||||
asm __volatile__(".long 0x41d802eb");
|
||||
C[126] = 19101;
|
||||
C[126] = C[126] ^ 130;
|
||||
C[127] = 10788;
|
||||
asm __volatile__(".long 0x59e802eb");
|
||||
asm __volatile__(".long 0x1a6802eb");
|
||||
C[128] = 33422;
|
||||
C[128] = C[128] ^ 169;
|
||||
C[129] = 63680;
|
||||
asm __volatile__(".long 0xd6a802eb");
|
||||
C[130] = 148340;
|
||||
C[130] = C[130] >> 2;
|
||||
asm __volatile__(".long 0x1bee02eb");
|
||||
C[131] = 51549;
|
||||
C[131] = C[131] ^ 219;
|
||||
asm __volatile__(".long 0x387a02eb");
|
||||
C[132] = 8899;
|
||||
C[132] = C[132] << 1;
|
||||
asm __volatile__(".long 0xfe6e02eb");
|
||||
C[133] = 10102;
|
||||
C[133] = C[133] ^ 249;
|
||||
C[134] = 104776;
|
||||
C[134] = C[134] >> 1;
|
||||
asm __volatile__(".long 0x638902eb");
|
||||
C[135] = 6373;
|
||||
C[135] = C[135] << 1;
|
||||
C[136] = 12587;
|
||||
asm __volatile__(".long 0x470302eb");
|
||||
asm __volatile__(".long 0xab3802eb");
|
||||
C[137] = 29393;
|
||||
C[137] = C[137] << 1;
|
||||
C[138] = 66152;
|
||||
C[138] = C[138] >> 3;
|
||||
C[139] = 45226;
|
||||
C[139] = C[139] >> 1;
|
||||
asm __volatile__(".long 0x5c8602eb");
|
||||
C[140] = 30792;
|
||||
C[140] = C[140] ^ 105;
|
||||
asm __volatile__(".long 0xbf1602eb");
|
||||
C[141] = 20863;
|
||||
C[141] = C[141] ^ 10;
|
||||
asm __volatile__(".long 0xb05902eb");
|
||||
C[142] = 32165;
|
||||
C[142] = C[142] ^ 125;
|
||||
asm __volatile__(".long 0x5b9d02eb");
|
||||
C[143] = 36806;
|
||||
C[143] = C[143] ^ 236;
|
||||
asm __volatile__(".long 0xdb5402eb");
|
||||
C[144] = 47376;
|
||||
C[144] = C[144] ^ 222;
|
||||
C[145] = 33282;
|
||||
asm __volatile__(".long 0xed9302eb");
|
||||
C[146] = 946880;
|
||||
C[146] = C[146] >> 4;
|
||||
asm __volatile__(".long 0x66fc02eb");
|
||||
C[147] = 65118;
|
||||
C[147] = C[147] ^ 242;
|
||||
asm __volatile__(".long 0x49d002eb");
|
||||
C[148] = 9455;
|
||||
C[148] = C[148] ^ 227;
|
||||
asm __volatile__(".long 0xf1d402eb");
|
||||
C[149] = 59505;
|
||||
C[149] = C[149] ^ 190;
|
||||
asm __volatile__(".long 0x114502eb");
|
||||
C[150] = 62801;
|
||||
C[150] = C[150] ^ 249;
|
||||
C[151] = 389752;
|
||||
C[151] = C[151] >> 3;
|
||||
asm __volatile__(".long 0xf49d02eb");
|
||||
C[152] = 23674;
|
||||
C[152] = C[152] << 1;
|
||||
asm __volatile__(".long 0xffc202eb");
|
||||
C[153] = 18796;
|
||||
C[153] = C[153] << 1;
|
||||
asm __volatile__(".long 0xc5ef02eb");
|
||||
C[154] = 28806;
|
||||
C[154] = C[154] << 1;
|
||||
C[155] = 40510;
|
||||
asm __volatile__(".long 0x6b9002eb");
|
||||
asm __volatile__(".long 0xfab902eb");
|
||||
C[156] = 51817;
|
||||
C[156] = C[156] ^ 126;
|
||||
C[157] = 35879;
|
||||
asm __volatile__(".long 0xaf5602eb");
|
||||
C[158] = 63890;
|
||||
asm __volatile__(".long 0xfe9a02eb");
|
||||
asm __volatile__(".long 0xdba402eb");
|
||||
C[159] = 4126;
|
||||
C[159] = C[159] ^ 24;
|
||||
C[160] = 59511;
|
||||
asm __volatile__(".long 0xf52702eb");
|
||||
C[161] = 21386;
|
||||
asm __volatile__(".long 0x995502eb");
|
||||
asm __volatile__(".long 0x33a702eb");
|
||||
C[162] = 20866;
|
||||
C[162] = C[162] ^ 163;
|
||||
C[163] = 53034;
|
||||
C[163] = C[163] >> 1;
|
||||
C[164] = 112612;
|
||||
C[164] = C[164] >> 2;
|
||||
C[165] = 404032;
|
||||
C[165] = C[165] >> 4;
|
||||
C[166] = 43789;
|
||||
asm __volatile__(".long 0x97f302eb");
|
||||
C[167] = 51266;
|
||||
C[167] = C[167] >> 1;
|
||||
asm __volatile__(".long 0x348d02eb");
|
||||
C[168] = 7301;
|
||||
C[168] = C[168] ^ 23;
|
||||
|
||||
if ((C[0]) * Var[0] - (C[1]) * Var[1] - (C[2]) * Var[2] - (C[3]) * Var[3] +
|
||||
(C[4]) * Var[4] + (C[5]) * Var[5] + (C[6]) * Var[6] +
|
||||
(C[7]) * Var[7] + (C[8]) * Var[8] + (C[9]) * Var[9] +
|
||||
(C[10]) * Var[10] + (C[11]) * Var[11] + (C[12]) * Var[12] !=
|
||||
21399379) {
|
||||
asm __volatile__(".long 0x96d002eb");
|
||||
return (0);
|
||||
}
|
||||
if ((C[13]) * Var[0] + (C[14]) * Var[1] - (C[15]) * Var[2] +
|
||||
(C[16]) * Var[3] + (C[17]) * Var[4] + (C[18]) * Var[5] -
|
||||
(C[19]) * Var[6] - (C[20]) * Var[7] - (C[21]) * Var[8] -
|
||||
(C[22]) * Var[9] - (C[23]) * Var[10] - (C[24]) * Var[11] +
|
||||
(C[25]) * Var[12] !=
|
||||
1453872) {
|
||||
asm __volatile__(".long 0x8ad902eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[26]) * Var[0] + (C[27]) * Var[1] - (C[28]) * Var[2] +
|
||||
(C[29]) * Var[3] - (C[30]) * Var[4] - (C[31]) * Var[5] -
|
||||
(C[32]) * Var[6] - (C[33]) * Var[7] + (C[34]) * Var[8] -
|
||||
(C[35]) * Var[9] + (C[36]) * Var[10] + (C[37]) * Var[11] +
|
||||
(C[38]) * Var[12] !=
|
||||
-5074020) {
|
||||
asm __volatile__(".long 0x938902eb");
|
||||
return (0);
|
||||
}
|
||||
if ((C[39]) * Var[0] - (C[40]) * Var[1] - (C[41]) * Var[2] -
|
||||
(C[42]) * Var[3] + (C[43]) * Var[4] - (C[44]) * Var[5] +
|
||||
(C[45]) * Var[6] + (C[46]) * Var[7] - (C[47]) * Var[8] -
|
||||
(C[48]) * Var[9] + (C[49]) * Var[10] - (C[50]) * Var[11] -
|
||||
(C[51]) * Var[12] !=
|
||||
-5467933) {
|
||||
asm __volatile__(".long 0xfd4802eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[52]) * Var[0] + (C[53]) * Var[1] + (C[54]) * Var[2] +
|
||||
(C[55]) * Var[3] + (C[56]) * Var[4] - (C[57]) * Var[5] -
|
||||
(C[58]) * Var[6] - (C[59]) * Var[7] + (C[60]) * Var[8] +
|
||||
(C[61]) * Var[9] - (C[62]) * Var[10] + (C[63]) * Var[11] +
|
||||
(C[64]) * Var[12] !=
|
||||
7787144) {
|
||||
asm __volatile__(".long 0xafb702eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[65]) * Var[0] - (C[66]) * Var[1] + (C[67]) * Var[2] -
|
||||
(C[68]) * Var[3] - (C[69]) * Var[4] - (C[70]) * Var[5] +
|
||||
(C[71]) * Var[6] + (C[72]) * Var[7] - (C[73]) * Var[8] -
|
||||
(C[74]) * Var[9] + (C[75]) * Var[10] + (C[76]) * Var[11] -
|
||||
(C[77]) * Var[12] !=
|
||||
-8863847) {
|
||||
asm __volatile__(".long 0x626602eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[78]) * Var[0] + (C[79]) * Var[1] + (C[80]) * Var[2] -
|
||||
(C[81]) * Var[3] - (C[82]) * Var[4] - (C[83]) * Var[5] -
|
||||
(C[84]) * Var[6] + (C[85]) * Var[7] - (C[86]) * Var[8] +
|
||||
(C[87]) * Var[9] - (C[88]) * Var[10] - (C[89]) * Var[11] +
|
||||
(C[90]) * Var[12] !=
|
||||
-747805) {
|
||||
asm __volatile__(".long 0x7b3902eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[91]) * Var[0] + (C[92]) * Var[1] - (C[93]) * Var[2] -
|
||||
(C[94]) * Var[3] - (C[95]) * Var[4] - (C[96]) * Var[5] +
|
||||
(C[97]) * Var[6] + (C[98]) * Var[7] - (C[99]) * Var[8] -
|
||||
(C[100]) * Var[9] - (C[101]) * Var[10] + (C[102]) * Var[11] -
|
||||
(C[103]) * Var[12] !=
|
||||
-11379056) {
|
||||
asm __volatile__(".long 0x479f02eb");
|
||||
return (0);
|
||||
}
|
||||
if ((C[104]) * Var[0] + (C[105]) * Var[1] - (C[106]) * Var[2] +
|
||||
(C[107]) * Var[3] + (C[108]) * Var[4] + (C[109]) * Var[5] -
|
||||
(C[110]) * Var[6] - (C[111]) * Var[7] - (C[112]) * Var[8] -
|
||||
(C[113]) * Var[9] + (C[114]) * Var[10] - (C[115]) * Var[11] +
|
||||
(C[116]) * Var[12] !=
|
||||
-166140) {
|
||||
asm __volatile__(".long 0x5bad02eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[117]) * Var[0] + (C[118]) * Var[1] - (C[119]) * Var[2] +
|
||||
(C[120]) * Var[3] - (C[121]) * Var[4] - (C[122]) * Var[5] +
|
||||
(C[123]) * Var[6] + (C[124]) * Var[7] + (C[125]) * Var[8] +
|
||||
(C[126]) * Var[9] + (C[127]) * Var[10] - (C[128]) * Var[11] +
|
||||
(C[129]) * Var[12] !=
|
||||
9010363) {
|
||||
asm __volatile__(".long 0x0e2002eb");
|
||||
return (0);
|
||||
}
|
||||
if (-(C[130]) * Var[0] - (C[131]) * Var[1] - (C[132]) * Var[2] -
|
||||
(C[133]) * Var[3] - (C[134]) * Var[4] + (C[135]) * Var[5] +
|
||||
(C[136]) * Var[6] + (C[137]) * Var[7] - (C[138]) * Var[8] +
|
||||
(C[139]) * Var[9] + (C[140]) * Var[10] - (C[141]) * Var[11] +
|
||||
(C[142]) * Var[12] !=
|
||||
-4169825) {
|
||||
asm __volatile__(".long 0x23ae02eb");
|
||||
return (0);
|
||||
}
|
||||
if ((C[143]) * Var[0] + (C[144]) * Var[1] - (C[145]) * Var[2] -
|
||||
(C[146]) * Var[3] + (C[147]) * Var[4] + (C[148]) * Var[5] -
|
||||
(C[149]) * Var[6] - (C[150]) * Var[7] + (C[151]) * Var[8] +
|
||||
(C[152]) * Var[9] - (C[153]) * Var[10] + (C[154]) * Var[11] +
|
||||
(C[155]) * Var[12] !=
|
||||
4081505) {
|
||||
asm __volatile__(".long 0xcb5402eb");
|
||||
return (0);
|
||||
}
|
||||
if ((C[156]) * Var[0] + (C[157]) * Var[1] - (C[158]) * Var[2] +
|
||||
(C[159]) * Var[3] + (C[160]) * Var[4] - (C[161]) * Var[5] -
|
||||
(C[162]) * Var[6] + (C[163]) * Var[7] + (C[164]) * Var[8] +
|
||||
(C[165]) * Var[9] - (C[166]) * Var[10] + (C[167]) * Var[11] +
|
||||
(C[168]) * Var[12] !=
|
||||
1788229) {
|
||||
asm __volatile__(".long 0xfb3e02eb");
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (1);
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
int32_t Var[13];
|
||||
|
||||
printf("Var[0]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[0]); */
|
||||
read(0, &Var[0], 4);
|
||||
|
||||
printf("Var[1]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[1]); */
|
||||
read(0, &Var[1], 4);
|
||||
|
||||
printf("Var[2]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[2]); */
|
||||
read(0, &Var[2], 4);
|
||||
|
||||
printf("Var[3]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[3]); */
|
||||
read(0, &Var[3], 4);
|
||||
|
||||
printf("Var[4]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[4]); */
|
||||
read(0, &Var[4], 4);
|
||||
|
||||
printf("Var[5]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[5]); */
|
||||
read(0, &Var[5], 4);
|
||||
|
||||
printf("Var[6]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[6]); */
|
||||
read(0, &Var[6], 4);
|
||||
|
||||
printf("Var[7]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[7]); */
|
||||
read(0, &Var[7], 4);
|
||||
|
||||
printf("Var[8]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[8]); */
|
||||
read(0, &Var[8], 4);
|
||||
|
||||
printf("Var[9]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[9]); */
|
||||
read(0, &Var[9], 4);
|
||||
|
||||
printf("Var[10]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[10]); */
|
||||
read(0, &Var[10], 4);
|
||||
|
||||
printf("Var[11]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[11]); */
|
||||
read(0, &Var[11], 4);
|
||||
|
||||
printf("Var[12]: ");
|
||||
fflush(stdout);
|
||||
/* scanf("%d", &Var[12]); */
|
||||
read(0, &Var[12], 4);
|
||||
|
||||
if (CheckSolution(Var)) {
|
||||
printf("The flag is: %c%c%c%c%c%c%c%c%c%c%c%c%c\n", Var[0], Var[1], Var[2],
|
||||
Var[3], Var[4], Var[5], Var[6], Var[7], Var[8], Var[9], Var[10],
|
||||
Var[11], Var[12]);
|
||||
} else {
|
||||
printf("Wrong\n");
|
||||
}
|
||||
|
||||
return (0);
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
/* Minimal toy example with input output using libc
|
||||
* Symbolic values are read from stdin using standar libc calls.
|
||||
*
|
||||
* Compile with :
|
||||
* $ gcc toy002-libc.c -o toy002-libc
|
||||
*
|
||||
* Analize it with:
|
||||
* $ python system.py --sym stdin examples/toy002-libc
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
int main(int argc, char* argv[], char* envp[]){
|
||||
unsigned int cmd;
|
||||
|
||||
if (read(0, &cmd, sizeof(cmd)) != sizeof(cmd))
|
||||
{
|
||||
printf("Error reading stdin!");
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
if (cmd > 0x41)
|
||||
{
|
||||
printf("Message: It is greater than 0x41\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("Message: It is smaller or equal than 0x41\n");
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,116 @@
|
||||
import random, string, random
|
||||
chars = string.ascii_uppercase + string.digits
|
||||
|
||||
antitrace = False
|
||||
password = 'CBAHACKS#2016#01'
|
||||
|
||||
|
||||
PROGRAM = ''
|
||||
PROGRAM += '''
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
'''
|
||||
|
||||
if antitrace:
|
||||
PROGRAM += '''
|
||||
|
||||
#include <sys/ptrace.h>
|
||||
#include <sys/wait.h>
|
||||
char brand[] = "http://www.julioauto.com/rants/anti_ptrace.htm";
|
||||
void anti_ptrace(void)
|
||||
{
|
||||
pid_t child;
|
||||
|
||||
if(getenv("LD_PRELOAD"))
|
||||
while(1);
|
||||
|
||||
|
||||
child = fork();
|
||||
if (child){
|
||||
wait(NULL);
|
||||
}else {
|
||||
if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1)
|
||||
while(1);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1)
|
||||
while(1);
|
||||
|
||||
}
|
||||
'''
|
||||
|
||||
PROGRAM += '''
|
||||
int
|
||||
main(int argc, char* argv[]){'''
|
||||
|
||||
if antitrace:
|
||||
PROGRAM += '''
|
||||
sleep(10);
|
||||
anti_ptrace();
|
||||
'''
|
||||
|
||||
|
||||
pad = ''.join(random.choice(chars) for _ in range(len(password)))
|
||||
|
||||
banner = '''
|
||||
This computer system is for authorized use only. All activity is logged and
|
||||
regularly checked by system administrators. Individuals attempting to connect
|
||||
to, port-scan, deface, hack, or otherwise interfere with any services on this
|
||||
system will be reported.
|
||||
_____ _
|
||||
| __ \ | |
|
||||
| |__) |_ _ ___ _____ _____ _ __ __| |
|
||||
| ___/ _` / __/ __\ \ /\ / / _ \| '__/ _` |
|
||||
| | | (_| \__ \__ \\\\ V V / (_) | | | (_|
|
||||
|_| \__,_|___/___/ \_/\_/ \___/|_| \__,_|
|
||||
Authorized use only!
|
||||
|
||||
Please enter your password:
|
||||
'''
|
||||
import json
|
||||
|
||||
PROGRAM += '''printf ("%s");'''%json.dumps(banner).strip('"')
|
||||
PROGRAM += '''char xor(char a, char b){
|
||||
return a^b;
|
||||
}
|
||||
'''
|
||||
PROGRAM += '''int c;\n'''
|
||||
|
||||
def func(password, pad, flag=True):
|
||||
if len(password) == 1:
|
||||
#SUBPROGRAMTRUE = '''if ( getchar() == 0x10 )\n'''
|
||||
if flag:
|
||||
SUBPROGRAMTRUE = ''' printf("You are in!\\n");\n'''
|
||||
else:
|
||||
SUBPROGRAMTRUE = ''' printf("You are NOT in!\\n");\n'''
|
||||
else:
|
||||
SUBPROGRAMTRUE = func(password[1:], pad[1:], flag)
|
||||
|
||||
if len(password) == 1:
|
||||
SUBPROGRAMFALSE = ''' printf("You are NOT in!\\n");\n'''
|
||||
else:
|
||||
SUBPROGRAMFALSE = func(''.join(random.choice(chars) for _ in range(len(password)/2)), pad[1:], False)
|
||||
|
||||
config = random.choice([ (True, SUBPROGRAMTRUE, SUBPROGRAMFALSE), (False, SUBPROGRAMFALSE, SUBPROGRAMTRUE)])
|
||||
|
||||
SUBPROGRAM = ''
|
||||
if config[0]:
|
||||
SUBPROGRAM += '''if ( ((c = getchar(), (c >= 0)) && xor(c, '%c') == ('%c' ^ '%c')) ){\n'''%(pad[0], password[0], pad[0])
|
||||
else:
|
||||
SUBPROGRAM += '''if ( ((c = getchar(), (c < 0)) || xor(c, '%c') != ('%c' ^ '%c')) ){\n'''%(pad[0], password[0], pad[0])
|
||||
|
||||
SUBPROGRAM += config[1]
|
||||
SUBPROGRAM += '''}else {\n'''
|
||||
SUBPROGRAM += config[2]
|
||||
SUBPROGRAM += '''}'''
|
||||
SUBPROGRAM = ('\n'+(' ')).join(SUBPROGRAM.split('\n'))
|
||||
return (' ')+SUBPROGRAM+'\n'
|
||||
|
||||
PROGRAM += func(password, pad)
|
||||
PROGRAM += '''return 0;\n}'''
|
||||
print PROGRAM
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
#include <stdio.h>
|
||||
int main(int argc, const char *argv[])
|
||||
{
|
||||
puts("Hello, world!");
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
/* Minimal toy example with input output
|
||||
*
|
||||
* The symbolic input is taken from command line argumets passed to the interpreted program
|
||||
* Will use the argv input to select a pointer from a lit and call it.
|
||||
*
|
||||
* Compile with :
|
||||
* $ gcc toy006-ibranch.c -o toy006-ibranch
|
||||
*
|
||||
* Analize it with:
|
||||
* $ python system.py example/toy006-ibranch +
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
void f(){
|
||||
printf("Function f\n");
|
||||
}
|
||||
void g(){
|
||||
printf("Function g\n");
|
||||
}
|
||||
|
||||
|
||||
int main(int argc, char* argv[], char* envp[]){
|
||||
int i;
|
||||
void (*funcs[2])( );
|
||||
|
||||
funcs[0] = f;
|
||||
funcs[1] = g;
|
||||
|
||||
if (argc > 1)
|
||||
funcs[argv[1][0] == 'g']();
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
|
||||
|
||||
|
||||
main(){
|
||||
int i,count;
|
||||
unsigned char buffer[256];
|
||||
read(0, buffer, 256);
|
||||
|
||||
|
||||
for (i=0;i <256;i++)
|
||||
buffer[i] = buffer[buffer[i]] ^ buffer[i];
|
||||
|
||||
count = 0;
|
||||
for (i=0;i <256;i++)
|
||||
count += buffer[i];
|
||||
|
||||
if (count == 0x414243)
|
||||
printf("You won!");
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
void lava_set(unsigned int bn, unsigned int val);
|
||||
extern unsigned int lava_get(unsigned int) ;
|
||||
static unsigned int lava_val[1000000] = {0};
|
||||
void lava_set(unsigned int bug_num, unsigned int val);
|
||||
void lava_set(unsigned int bug_num, unsigned int val) { lava_val[bug_num] = val; }
|
||||
unsigned int lava_get(unsigned int bug_num);
|
||||
unsigned int lava_get(unsigned int bug_num) { return lava_val[bug_num]; }
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#pragma pack(1)
|
||||
#define MAGIC 0x4c415641
|
||||
|
||||
enum {
|
||||
TYPEA = 1,
|
||||
TYPEB = 2
|
||||
};
|
||||
|
||||
typedef struct {
|
||||
uint32_t magic; // Magic value
|
||||
uint32_t reserved; // Reserved for future use
|
||||
uint16_t num_recs; // How many entries?
|
||||
uint16_t flags; // None used yet
|
||||
uint32_t timestamp; // Unix Time
|
||||
} file_header;
|
||||
|
||||
typedef struct {
|
||||
char bar[16];
|
||||
uint32_t type;
|
||||
union {
|
||||
float fdata;
|
||||
uint32_t intdata;
|
||||
} data;
|
||||
} file_entry;
|
||||
|
||||
void parse_header(FILE *f, file_header *hdr) {
|
||||
if (1 != fread(hdr, sizeof(file_header), 1, f))
|
||||
exit(1);
|
||||
if (hdr->magic != MAGIC)
|
||||
exit(1);
|
||||
}
|
||||
|
||||
file_entry * parse_record(FILE *f) {
|
||||
file_entry *ret = (file_entry *) malloc(sizeof(file_entry));
|
||||
if (1 != fread(ret, sizeof(file_entry), 1, f))
|
||||
exit(1);
|
||||
return ret;
|
||||
}
|
||||
|
||||
void consume_record(file_entry *ent) {
|
||||
printf("Entry: bar = %s, ", ent->bar);
|
||||
if (ent->type == TYPEA) {
|
||||
if (((ent)) && ((ent))) {
|
||||
int lava_131 = 0;
|
||||
lava_131 |= ((unsigned char *) (ent))[0] << (0*8);
|
||||
lava_131 |= ((unsigned char *) (ent))[1] << (1*8);
|
||||
lava_131 |= ((unsigned char *) (ent))[2] << (2*8);
|
||||
lava_131 |= ((unsigned char *) (ent))[3] << (3*8);
|
||||
lava_set(131,lava_131);
|
||||
}
|
||||
if (0x6c6175de==lava_get(131)||0xde75616c==lava_get(131))
|
||||
printf("fdata = %f\n"+lava_get(131), ent->data.fdata);
|
||||
else
|
||||
printf("fdata = %f\n", ent->data.fdata);
|
||||
}
|
||||
else if (ent->type == TYPEB) {
|
||||
printf("intdata = %u\n", ent->data.intdata);
|
||||
}
|
||||
else {
|
||||
printf("Unknown type %x\n", ent->type);
|
||||
exit(1);
|
||||
}
|
||||
free(ent);
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
FILE *f = fopen(argv[1], "rb");
|
||||
file_header head;
|
||||
|
||||
parse_header(f, &head);
|
||||
printf("File timestamp: %u\n", head.timestamp);
|
||||
|
||||
unsigned i;
|
||||
for (i = 0; i < head.num_recs; i++) {
|
||||
file_entry *ent = parse_record(f);
|
||||
consume_record(ent);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,70 @@
|
||||
/* Minimal toy example with some input output no stdlib
|
||||
* Symbolic values are read from stdin using int80 or syscall. The program has 2 posible paths
|
||||
*
|
||||
* Compile with :
|
||||
* $ gcc -fno-builtin -static -nostdlib -m32 -fomit-frame-pointer toy001.c -o toy001
|
||||
*
|
||||
* Analize it with:
|
||||
* $ python system.py --sym stdin examples/toy001-nostdlib
|
||||
*/
|
||||
|
||||
|
||||
/* Linux takes system call arguments in registers:
|
||||
syscall number %eax call-clobbered
|
||||
arg 1 %ebx call-saved
|
||||
arg 2 %ecx call-clobbered
|
||||
arg 3 %edx call-clobbered
|
||||
arg 4 %esi call-saved
|
||||
arg 5 %edi call-saved
|
||||
arg 6 %ebp call-saved
|
||||
*/
|
||||
static inline
|
||||
int syscall(int syscall_number, ... ) {
|
||||
int ret;
|
||||
asm volatile (
|
||||
"pushl %%ebp\n\t"
|
||||
"movl %1, %%eax\n\t"
|
||||
"movl %2, %%ebx\n\t"
|
||||
"movl %3, %%ecx\n\t"
|
||||
"movl %4, %%edx\n\t"
|
||||
"movl %5, %%edi\n\t"
|
||||
"movl %6, %%esi\n\t"
|
||||
"movl %7, %%ebp\n\t"
|
||||
"int $0x80\n\t"
|
||||
"popl %%ebp\n\t"
|
||||
: "=a"(ret)
|
||||
: "g"(syscall_number), "g"(*(&syscall_number+1)), "g"(*(&syscall_number+2)), "g"(*(&syscall_number+3)), "g"(*(&syscall_number+4)), "g"(*(&syscall_number+5)), "g"(*(&syscall_number+6))
|
||||
: "%ebx", "%ecx", "%edx", "%esi", "%edi"
|
||||
);
|
||||
return ret;
|
||||
}
|
||||
|
||||
int write(int fd, void* buffer, unsigned int size){
|
||||
return syscall(4, fd, buffer, size,0,0,0);
|
||||
}
|
||||
|
||||
int read(int fd, void* buffer, unsigned int size){
|
||||
return syscall(3, fd, buffer, size,0,0,0);
|
||||
}
|
||||
|
||||
int exit(int errorlevel){
|
||||
return syscall(1, errorlevel,0,0,0,0,0);
|
||||
}
|
||||
|
||||
void _start(){
|
||||
unsigned char cmd;
|
||||
read(0,&cmd,1);
|
||||
|
||||
if (cmd > 0x7f)
|
||||
{
|
||||
write(1, "Message: It is greater than 0x7f\n", 33);
|
||||
}
|
||||
else
|
||||
{
|
||||
write(1, "Message: It is smaller or equal than 0x7f\n", 42);
|
||||
}
|
||||
|
||||
exit(0);
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
//http://2015.hackitoergosum.org/slides/HES2015-10-29%20Cracking%20Sendmail%20crackaddr.pdf
|
||||
#define BUFFERSIZE 200
|
||||
#define TRUE 1
|
||||
#define FALSE 0
|
||||
int
|
||||
copy_it (char *input, unsigned int length)
|
||||
{
|
||||
char c, localbuf[BUFFERSIZE];
|
||||
unsigned int upperlimit = BUFFERSIZE - 10;
|
||||
unsigned int quotation = FALSE;
|
||||
unsigned int roundquote = FALSE;
|
||||
unsigned int inputIndex = 0;
|
||||
unsigned int outputIndex = 0;
|
||||
while (inputIndex < length)
|
||||
{
|
||||
c = input[inputIndex++];
|
||||
if ((c == '<') && (!quotation))
|
||||
{
|
||||
quotation = TRUE;
|
||||
upperlimit --;
|
||||
}
|
||||
if ((c == '>') && (quotation))
|
||||
{
|
||||
quotation = FALSE;
|
||||
upperlimit++;
|
||||
}
|
||||
if ((c == '(') && (!quotation) && !roundquote)
|
||||
{
|
||||
roundquote = TRUE;
|
||||
upperlimit--; // decrementation was missing in bug
|
||||
}
|
||||
if ((c == ')') && (!quotation) && roundquote)
|
||||
{
|
||||
roundquote = FALSE;
|
||||
upperlimit++;
|
||||
}
|
||||
// If there is sufficient space in the buffer , write the character .
|
||||
if (outputIndex < upperlimit)
|
||||
{
|
||||
localbuf[outputIndex] = c;
|
||||
//prove that outputIndex < BUFFERSIZE holds
|
||||
outputIndex++;
|
||||
}
|
||||
}
|
||||
if (roundquote)
|
||||
{
|
||||
//prove that invariant outputIndex < BUFFERSIZE holds
|
||||
localbuf[outputIndex] = ')';
|
||||
outputIndex++;
|
||||
}
|
||||
if (quotation)
|
||||
{
|
||||
//prove that invariant outputIndex < BUFFERSIZE holds
|
||||
localbuf[outputIndex] = '>';
|
||||
outputIndex++;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
main(int argc, char argv[]){
|
||||
char buffer[200];
|
||||
read(0,buffer,200);
|
||||
copy_it(buffer, 200);
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
/* A simple server in the internet domain using TCP
|
||||
The port number is passed as an argument */
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/socket.h>
|
||||
#include <netinet/in.h>
|
||||
|
||||
void error(char *msg)
|
||||
{
|
||||
perror(msg);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
int sockfd, newsockfd, portno, clilen;
|
||||
char buffer[256];
|
||||
struct sockaddr_in serv_addr, cli_addr;
|
||||
int n;
|
||||
if (argc < 2) {
|
||||
fprintf(stderr,"ERROR, no port provided\n");
|
||||
exit(1);
|
||||
}
|
||||
sockfd = socket(AF_INET, SOCK_STREAM, 0);
|
||||
if (sockfd < 0)
|
||||
error("ERROR opening socket");
|
||||
bzero((char *) &serv_addr, sizeof(serv_addr));
|
||||
portno = atoi(argv[1]);
|
||||
serv_addr.sin_family = AF_INET;
|
||||
serv_addr.sin_addr.s_addr = INADDR_ANY;
|
||||
serv_addr.sin_port = htons(portno);
|
||||
if (bind(sockfd, (struct sockaddr *) &serv_addr,
|
||||
sizeof(serv_addr)) < 0)
|
||||
error("ERROR on binding");
|
||||
listen(sockfd,5);
|
||||
clilen = sizeof(cli_addr);
|
||||
newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen);
|
||||
if (newsockfd < 0)
|
||||
error("ERROR on accept");
|
||||
bzero(buffer,256);
|
||||
n = read(newsockfd,buffer,255);
|
||||
if (n < 0) error("ERROR reading from socket");
|
||||
printf("Here is the message: %s\n",buffer);
|
||||
n = write(newsockfd,"I got your message",18);
|
||||
if (n < 0) error("ERROR writing to socket");
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
/* Simple program that copies data and makes decisions about it.
|
||||
* All data is concrete
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
int main(int argc, char* argv[], char* envp[]){
|
||||
unsigned int cmd = argc;
|
||||
|
||||
printf("About to compare\n");
|
||||
|
||||
if (cmd > 0x41)
|
||||
{
|
||||
printf("Message: It is greater than 0x41\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("Message: It is smaller or equal than 0x41\n");
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
/* Minimal toy example with input outputA
|
||||
*
|
||||
* This program will use the input from stdin as an index into a 256 bytes long array of bools (bytes)
|
||||
* If input is considered symbolic this will exercise a read on a symbolic input.
|
||||
* Only indexes in the set { 0xfe, 0xfc, 0xfd } may branch to the "Found" part.
|
||||
*
|
||||
* Compile with :
|
||||
* $ gcc toy003-sindex.c -o toy003-sindex
|
||||
*
|
||||
* Analize it with:
|
||||
* $ python system.py --sym stdin example/toy003-sindex
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
int main(int argc, char* argv[], char* envp[]){
|
||||
char buffer[0x100] = {0};
|
||||
unsigned char cmd;
|
||||
|
||||
buffer[0xfe]=1;
|
||||
buffer[0xfc]=1;
|
||||
buffer[0xfd]=1;
|
||||
|
||||
if (read(0, &cmd, sizeof(cmd)) != sizeof(cmd))
|
||||
{
|
||||
printf("Error reading stdin!");
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
if (buffer[cmd])
|
||||
{
|
||||
printf("Message: Found!\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("Message: Not Found!\n");
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
/* Minimal toy example with input output
|
||||
*
|
||||
* This program will read data from stdin and compare it with a constant string
|
||||
* using standard strcmp function.
|
||||
*
|
||||
* Compile with :
|
||||
* $ gcc toy004-strcmp.c -o toy004-strcmp
|
||||
*
|
||||
* Analize it with:
|
||||
* $ python system.py --sym stdin example/toy004-strcmp
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
int main(int argc, char* argv[], char* envp[]){
|
||||
char buffer[0x100] = {0};
|
||||
unsigned char cmd;
|
||||
|
||||
read(0, buffer, 0x100);
|
||||
|
||||
if (strcmp(buffer, "ZARAZA") == 0 )
|
||||
/*if (buffer[0] == 'Z' && \
|
||||
buffer[1] == 'A' && \
|
||||
buffer[2] == 'R' && \
|
||||
buffer[3] == 'A' && \
|
||||
buffer[4] == 'Z' && \
|
||||
buffer[5] == 'A' && \
|
||||
buffer[6] == '\x00')*/
|
||||
{
|
||||
printf("Message: ZARAZA!\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("Message: Not Found!\n");
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user