// Server Respond Functon
static void server_respond(int to_server)
{
// Client "Attributes"
int client_pid = 0;
char str_client_pid[256];
int to_client = 0;
int input_str_size = 0;
int new_str_size = 0;
char *input_str = 0;
char *new_str = 0;
// Fork Off
int f = fork();
// Child
if ( f == 0 )
{
// Get Client PID (client pipe)
read(to_server, &client_pid, sizeof(int));
// Get Input String Size
read(to_server, &input_str_size, sizeof(int));
// Get Input String
input_str = (char *) malloc( input_str_size + 1 );
read(to_server, input_str, input_str_size);
// Modify Input String
new_str = (char *) strfry(input_str);
// Connect to Client Pipe
sprintf(str_client_pid, "%d", client_pid);
to_client = open( str_client_pid, O_WRONLY );
// Send size of string
new_str_size = strlen(new_str);
write(to_client, &new_str_size, sizeof(int));
// Send New String
write(to_client, new_str, new_str_size);
// Cleanup
close(to_client);
close(to_server);
free(new_str);
exit(0);
}
// Parent
else
{
// Close Pipe
close(to_server);
// Remove WKP
remove(WKP);
// Listen
server_listen();
}
}
void displayBoards(char board[][15], char solution[][15], int location[][3], int wordcount, char words[][17]){
int i,j;
printf("Solution: \n");
for (i=0;i<=14;i++){
for(j=0;j<=14;j++){
printf("%c",solution[i][j] );
if(isalpha(solution[i][j])) board[i][j]=' ';
}
printf("\n");
}
printf("\nCrossword puzzle:\n\n");
for (i=0;i<=14;i++){
for(j=0;j<=14;j++){
printf("%c",board[i][j] );
}
printf("\n");
}
printf("\nClues: \n");
for(i=0; i<wordcount; i++){
if(location[i][0]==-1) continue; //skips the unplacable words
if(location[i][2] == 1){
printf("Across ");
}
if(location[i][2] == 0){
printf("Down ");
}
strfry(words[i]);
printf("(%2d, %2d), %s", location[i][0], location[i][1], words[i]);
printf("\n");
}
}
int main()
{
char s[] = "asdf";
//char *s = "asdf"; //segment fault, const string
printf("%s\n", strfry(s));
return 0;
}
char* Anagram::init() {
memset(grams, 0, sizeof(gram)*GRAM_SIZE);
numGrams = 0;
strcpy(scrambled, dict.rand(7));
permute(scrambled, 0, 8);
strfry(scrambled);
return scrambled;
}
int main (void)
{
char chaine[256];
int n;
while (1) {
if ((n = read(STDIN_FILENO, chaine, 256)) <= 1)
break;
while (isspace(chaine[n - 1]))
n --;
chaine[n] = '\0';
strfry(chaine);
write(STDOUT_FILENO, chaine, n);
}
return EXIT_SUCCESS;
}
// Performs the encodage of the shellcode opcodes in ascii form with the Riley "caezar" Eller technique:
// Bypassing MSB Data Filters for Buffer Overflow Exploits on Intel Platforms.
// This is a incremental encoder with overflow.
//
// parameters:
// start: four initial bytes to build the decoded shellcode
// end: four decoded opcodes
// opCodeAscii: an array of four word to store the substrate values to apply to the start value.
// The substrate values are in ascii form.
//
// return: return 0 on failure or the number of word to substrate to the start value to get the the four
// final opcodes. The opCodeAscii array contains a variable number of substrate values determined by
// the return code.
//
int sub_encoder(const chunk start, const chunk end, EncodedOpcode opCodeAscii)
{
unsigned int sum, desired, overflow;
int a, i, j, k, m, z, flag;
unsigned char mem[CHR_SIZE+1];
memset(mem, 0, 70);
strncpy((char*)mem, CHR, CHR_SIZE);
strfry((char*)mem);
for(a = 1; a < 5; ++a)
{
overflow = flag = 0;
for(z = 0; z < 4; z++)
{
for(i = 0; i < CHR_SIZE; i++)
{
for(j = 0; j < CHR_SIZE; j++)
{
for(k = 0; k < CHR_SIZE; k++)
{
for(m = 0; m < CHR_SIZE; m++)
{
if(a < 2) j = CHR_SIZE + 1;
if(a < 3) k = CHR_SIZE + 1;
if(a < 4) m = CHR_SIZE + 1;
sum = end[z] + overflow + mem[i] + mem[j] + mem[k] + mem[m];
desired = (sum & 0x000000ff);
if(desired == start[z])
{
overflow = (sum & 0x0000ff00) >> 8;
if(i < CHR_SIZE) opCodeAscii[0][z] = mem[i];
if(j < CHR_SIZE) opCodeAscii[1][z] = mem[j];
if(k < CHR_SIZE) opCodeAscii[2][z] = mem[k];
if(m < CHR_SIZE) opCodeAscii[3][z] = mem[m];
i = j = k = m = CHR_SIZE + 2;
++flag;
}
}
}
}
}
}
if(flag == 4)
return a;
}
void
traite_connexion (int sock)
{
char buffer [256];
int longueur;
while (1) {
longueur = read (sock, buffer, 256);
if (longueur < 0) {
perror ("read");
exit (0);
}
if (longueur == 0)
break;
buffer [longueur] = '\0';
strfry (buffer);
write (sock, buffer, longueur);
}
close (sock);
}
static int
repondre (const char * nom_fifo, char * chaine)
{
FILE * reponse;
int fd;
char * anagramme;
if ((fd = open (nom_fifo, O_WRONLY)) >= 0) {
reponse = fdopen (fd, "w");
anagramme = strdup (chaine);
strfry (anagramme);
fprintf (reponse, "%s\n", anagramme);
fclose (reponse);
free (anagramme);
}
if ((strcasecmp (chaine, "FIN") == 0)
|| (strcasecmp (nom_fifo, "FIN") == 0))
return (1);
return (0);
}
int main(int argc, char* argv[])
{
unsigned int targ, last, t[4], l[4];
unsigned int try, single, carry=0;
int len, a, i, j, k, m, z, flag=0;
char word[3][4];
unsigned char mem[70];
if(argc < 2) {
printf("Usage: %s <EAX starting value> <EAX end value>\n", argv[0]);
exit(1);
}
srand(time(NULL));
bzero(mem, 70);
strcpy(mem, CHR);
len = strlen(mem);
strfry(mem); // randomize
last = strtoul(argv[1], NULL, 0);
targ = strtoul(argv[2], NULL, 0);
printf("calculating printable values to subtract from EAX..\n\n");
t[3] = (targ & 0xff000000)>>24; // spliting by bytes
t[2] = (targ & 0x00ff0000)>>16;
t[1] = (targ & 0x0000ff00)>>8;
t[0] = (targ & 0x000000ff);
l[3] = (last & 0xff000000)>>24;
l[2] = (last & 0x00ff0000)>>16;
l[1] = (last & 0x0000ff00)>>8;
l[0] = (last & 0x000000ff);
for(a=1; a < 5; a++) { // value count
carry = flag = 0;
for(z=0; z < 4; z++) { // byte count
for(i=0; i < len; i++) {
for(j=0; j < len; j++) {
for(k=0; k < len; k++) {
for(m=0; m < len; m++)
{
if(a < 2) j = len+1;
if(a < 3) k = len+1;
if(a < 4) m = len+1;
try = t[z] + carry+mem[i]+mem[j]+mem[k]+mem[m];
single = (try & 0x000000ff);
if(single == l[z])
{
carry = (try & 0x0000ff00)>>8;
if(i < len) word[0][z] = mem[i];
if(j < len) word[1][z] = mem[j];
if(k < len) word[2][z] = mem[k];
if(m < len) word[3][z] = mem[m];
i = j = k = m = len+2;
flag++;
}
}
}
}
}
}
if(flag == 4) { // if all 4 bytes found
printf("start: 0x%08x\n\n", last);
for(i=0; i < a; i++)
printf(" - 0x%08x\n", *((unsigned int *)word[i]));
printf("-------------------\n");
printf("end: 0x%08x\n", targ);
exit(0);
}
}
}
static int play(void *userData)
{
srand(time(NULL));
int scroll = 0;
int quit = 0;
int down;
int redraw = 0;
int mapNum = 0;
touchPosition touch;
gui = new Gui();
console = new Console();
try {
anagram = new Anagram();
} catch (const char* err) {
delete console;
delete gui;
return EXIT_FAILURE;
}
//copy bg tiles
decompress(map[mapNum], bgGetMapPtr(1));
reset();
scroll = printList(scroll);
console->flush();
keysSetRepeat(30, 6);
while(!quit) {
swiWaitForVBlank();
bgScrollf(1, -48, 48);
bgUpdate();
scanKeys();
if(redraw) {
scroll = printList(scroll);
console->flush();
}
redraw = 0;
down = keysDown() | (keysDownRepeat() & (KEY_UP|KEY_DOWN));
if(down & KEY_UP)
redraw = 1, scroll--;
else if(down & KEY_DOWN)
redraw = 1, scroll++;
else if(down & KEY_B)
redraw = 1, quit = 1;
else if(down & KEY_START)
redraw = 1, scroll = reset();
else if(down & KEY_X) {
redraw = 1;
strfry(choices);
if(strlen(choices) == strlen(solution))
strcpy(solution, choices);
}
else if(down & KEY_Y) {
mapNum = (mapNum+1)%NUM_MAPS;
decompress(map[mapNum], bgGetMapPtr(1));
}
if(down & KEY_TOUCH)
touchRead(&touch);
else
memset(&touch, 0, sizeof(touch));
if(gui->update(choices, guess, touch) == GuiRC_Submit) {
if(strlen(guess) > 2) {
anagram->attempt(guess);
addHistory(guess);
}
memset(guess, 0, sizeof(guess));
memset(choices, 0, sizeof(choices));
strcpy(choices, solution);
redraw = 1;
}
}
delete gui;
delete console;
delete anagram;
return EXIT_SUCCESS;
}
int main(int argc, char* argv[])
{
unsigned int targ=0, next=0, last=0xbfffffe0;
int i, j, k, len, norm, pad, opt;
int size=0, esc=0, ninja=0, bridge=-1;
char *head=0, *body, *mem, *code=0;
struct stat buff;
FILE *fh;
extern char *optarg;
extern int optind;
banner();
if(argc < 2) usage(argv[0]);
srand(time(NULL));
len = strlen(CHR);
while((opt = getopt(argc, argv, "Nt:s:b:c:w:e")) != EOF)
{
switch(opt)
{
case 't':
targ = strtoul(optarg, NULL, 0);
fprintf(stderr, "[t] Target address: %p\n", targ);
break;
case 'N':
ninja = 4;
fprintf(stderr, "[N] Ninja Magic Optimization: ON\n");
break;
case 's':
size = atoi(optarg);
if(size)
{
fprintf(stderr, "[s] Size changes target: ON ");
fprintf(stderr, "(adjust size: %d bytes)\n", size);
}
break;
case 'b':
bridge = atoi(optarg);
fprintf(stderr, "[b] Bridge size: %d words\n", bridge);
break;
case 'c':
code = optarg;
len = strlen(optarg);
fprintf(stderr, "[c] Using charset: %s (%d)\n", code, strlen(code));
break;
case 'w':
head = optarg;
fprintf(stderr, "[w] Write to Output File: %s \n", head);
break;
case 'e':
esc = 1;
fprintf(stderr, "[e] Escape the backslash: ON\n");
break;
}
}
if(size && !ninja)
{
fprintf(stderr, "[!] Size adjustment needs ninja magic.. enabling..\n");
fprintf(stderr, "[N] Ninja Magic Optimization: ON\n");
ninja = 4;
}
if(stat(argv[optind], &buff))
{
fprintf(stderr,"\nError: problem with source bytecode file: %s\n", argv[optind]);
exit(-1);
}
norm = buff.st_size;
pad = (norm%4)+4;
mem = (char *) malloc(((norm+pad)*7)+len+62)+21;
if(code)
strncpy(mem, code, len);
else
strncpy(mem, CHR, len);
mem[len] = 0;
code = mem + len + 2;
memset(code, 0x90, 8);
fh = fopen(argv[optind], "r");
fread(code+pad, norm, 1, fh);
fclose(fh);
if(head)
{
fh = fopen(head, "w");
if(!fh)
{
fprintf(stderr, "\nError: Couldn't open output file: %s\n", head);
exit(-1);
}
}
else
fh = stdout;
head = code + norm+pad+1;
body = head + 38;
if(targ)
{
last = targ + 20+ (norm+pad)*5;
fprintf(stderr,"[+] Ending address: %p\n", last);
if((bridge<0) && !(ninja)) bridge = norm/4;
}
else
targ = last;
fprintf(stderr, "[*] Dissembling bytecode from \'%s\'...\n", argv[optind]);
opt = strlen(mem);
head[0] = head[5] = head[10] = 37;
for(i=1; i < 5; i++)
{
strfry(mem);
for(j=0; j < opt; j++)
{
for(k=opt-1; k >= 0; k--)
{
if(!(mem[j] & mem[k] & 0xff))
{
head[i] = mem[j];
head[i+5] = mem[k];
k = -1; j = opt;
head[10]++;
}
}
}
}
if(head[10] != 41)
{
fprintf(stderr,"\nError: Cannot dissemble header with current charset.");
fprintf(stderr,"\ncharset: %s (%d)\n", mem, strlen(mem));
exit(-1);
}
opt = j = 0;
magic:
strfry(mem);
sprintf(head+10, "%sP\\", gen(last, next, mem));
bzero(body, (norm+pad)*5);
for(k=norm+pad-4; k >=ninja; k=k-4)
{
sscanf(code+k,"%4c",&next);
strfry(mem);
strcat(body, gen(next, last, mem));
strcat(body, "P");
last = next;
}
len = opt;
opt = strlen(head) + strlen(body);
if((opt != len) && (j<34) && ninja)
{
fprintf(stderr, "[&] Optimizing with ninja magic...\n");
last = targ + norm + opt;
if(size)
{
last = last+size-opt;
fprintf(stderr, "[&] Adjusting target address to %p..\n", targ+size-opt);
}
next = 0;
j++;
if(j > 12)
{
j = 56;
fprintf(stderr, "[!] Indecision is my enemy : selecting the best...\n");
if(opt < len) goto freedom;
}
goto magic;
}
freedom:
if(bridge>0) opt+=bridge;
fprintf(stderr, "\n[+] dissembled bytecode is %d bytes long.\n--\n", opt);
if(esc)
fprintf(fh, "%s\\%s", head, body);
else
fprintf(fh, "%s%s", head, body);
if(!ninja)
{
if(bridge<0)
bridge = norm+pad;
for(i=0; i < bridge; i++)
fprintf(fh, "P");
}
fprintf(fh,"\n");
if(fh != stdout) close(fh);
free(mem-21);
}
char* gen(unsigned int targ, unsigned int last, char *X)
{
unsigned int t[4], l[4];
unsigned int try, single, carry=0;
int a, i, j, k, m, z, flag=0;
char p[MAX_CHR],q[MAX_CHR],r[MAX_CHR],s[MAX_CHR], *pr=X-21;
int len = strlen(X);
for(a=0; a < len+2; a++)
p[a] = q[a] = r[a] = s[a] = a+1;
p[len] = q[len] = r[len] = s[len] = 0;
strfry(p);
strfry(q);
strfry(r);
strfry(s);
pr[0] = pr[5] = pr[10] = pr[15] = 45;
t[3] = (targ & 0xff000000)>>24;
t[2] = (targ & 0x00ff0000)>>16;
t[1] = (targ & 0x0000ff00)>>8;
t[0] = (targ & 0x000000ff);
l[3] = (last & 0xff000000)>>24;
l[2] = (last & 0x00ff0000)>>16;
l[1] = (last & 0x0000ff00)>>8;
l[0] = (last & 0x000000ff);
for(a=1; a < 5; a++) {
carry = flag = 0;
for(z=0; z < 4; z++) {
for(i=0; i < len; i++) {
for(j=0; j < len; j++) {
for(k=0; k < len; k++) {
for(m=0; m < len; m++)
{
if(a < 2) j = len+1;
if(a < 3) k = len+1;
if(a < 4) m = len+1;
try = t[z] + carry+X[p[i]-1]+X[q[j]-1]+X[r[k]-1]+X[s[m]-1];
single = (try & 0x000000ff);
if(single == l[z])
{
carry = (try & 0x0000ff00)>>8;
if(i < len) pr[1+z] = X[p[i]-1];
if(j < len) pr[6+z] = X[q[j]-1];
if(k < len) pr[11+z] = X[r[k]-1];
if(m < len) pr[16+z] = X[s[m]-1];
i = j = k = m = len+2;
flag++;
}
}
}
}
}
}
if(flag ==4)
{
pr[5*a] = 0;
a = 6;
}
}
if(flag !=4)
{
fprintf(stderr,"\nError: Cannot dissemble bytecode with current charset.");
fprintf(stderr,"\ncharset: %s (%d)\n", X, strlen(X));
exit(-1);
}
return pr;
}
int main(void) {
char s[] = "abcd";
printf("%s\n", strfry(s));
printf("%s\n", strfry(s));
}
int main(int argc, char* argv[])
{
unsigned int targ, last, t[4], l[4];
unsigned int try, single, carry=0;
int len, a, i, j, k, m, z, flag=0;
char word[3][4];
unsigned char mem[70];
if(argc < 2) {
printf("使用方法： %s ＜開始時のeaxの値＞ ＜終了時のeaxの値＞\n", argv[0]);
exit(1);
}
srand(time(NULL));
bzero(mem, 70);
strcpy(mem, CHR);
len = strlen(mem);
strfry(mem); // メモリ内容をランダムに並べ替える
last = strtoul(argv[1], NULL, 0);
targ = strtoul(argv[2], NULL, 0);
printf("eaxの減算により印字可能な値を計算します。\n\n");
t[3] = (targ & 0xff000000)>>24; // バイト毎に分割
t[2] = (targ & 0x00ff0000)>>16;
t[1] = (targ & 0x0000ff00)>>8;
t[0] = (targ & 0x000000ff);
l[3] = (last & 0xff000000)>>24;
l[2] = (last & 0x00ff0000)>>16;
l[1] = (last & 0x0000ff00)>>8;
l[0] = (last & 0x000000ff);
for(a=1; a < 5; a++) { // 値のカウント
carry = flag = 0;
for(z=0; z < 4; z++) { // バイトのカウント
for(i=0; i < len; i++) {
for(j=0; j < len; j++) {
for(k=0; k < len; k++) {
for(m=0; m < len; m++)
{
if(a < 2) j = len+1;
if(a < 3) k = len+1;
if(a < 4) m = len+1;
try = t[z] + carry+mem[i]+mem[j]+mem[k]+mem[m];
single = (try & 0x000000ff);
if(single == l[z])
{
carry = (try & 0x0000ff00)>>8;
if(i < len) word[0][z] = mem[i];
if(j < len) word[1][z] = mem[j];
if(k < len) word[2][z] = mem[k];
if(m < len) word[3][z] = mem[m];
i = j = k = m = len+2;
flag++;
}
}
}
}
}
}
if(flag == 4) { // 4バイトすべてが見つかった
printf("開始： 0x%08x\n\n", last);
for(i=0; i < a; i++)
printf(" - 0x%08x\n", *((unsigned int *)word[i]));
printf("-------------------\n");
printf("終了： 0x%08x\n", targ);
exit(0);
}
}
}
