1 #include <libcgc.h>
2 #include <stdlib.h>
3 #include <string.h>
4 
5 struct stack_func_1 {
6   char buf[0x20];
7   char *where;
8 };
9 
receive_until2(int fd,char * dst,char delim,size_t max)10 size_t receive_until2(int fd, char *dst, char delim, size_t max )
11 {
12     size_t len = 0;
13     size_t rx = 0;
14     char c = 0;
15 
16     while( len < max ) {
17         dst[len] = 0x00;
18 
19         if ( receive( fd, &c, 1, &rx ) != 0 ) {
20             len = 0;
21             goto end;
22         }
23 
24         if ( c == delim ) {
25             goto end;
26         }
27 
28         dst[len] = c;
29         len++;
30     }
31 end:
32     return len;
33 }
34 
rand_range(unsigned int min,unsigned int max)35 unsigned int rand_range(unsigned int min, unsigned int max) {
36   unsigned int lrand;
37   random(&lrand, 4, NULL);
38   if (max-min+1 == 0) {
39     return lrand;
40   }
41   return (lrand % (max-min+1)) + min;
42 }
43 
44 // STRTOL
45 #define IS_SPACE(c) ((c == ' ') || (c == '\t') || (c == '\f') || (c == '\n') || (c == '\v'))
46 #define IS_NUM(c) ((c >= '0') && (c <= '9'))
47 #define IS_ALPHA(c) (((c >= 'A') && (c <= 'Z')) || ((c >= 'a') && (c <= 'z')))
48 #define IS_UPPER(c) ((c >= 'A') && (c <= 'Z'))
49 
strtol(const char * nptr,char ** endptr,int base)50 long int strtol(const char *nptr, char **endptr, int base)
51 {
52     int neg = 0, val = 0, consumed = 0, n, a;
53     const char *p = nptr;
54 
55     /* Check validity of base */
56     if (base == 1 || base > 36 || base < 0)
57         goto done;
58 
59     /* Skip white space */
60     while (1)
61     {
62         if (IS_SPACE(*p))
63             ++p;
64         else
65             break;
66     }
67 
68     /* Check sign symbol */
69     if (*p == '-')
70     {
71         neg = 1;
72         ++p;
73     }
74     if (*p == '+')
75         ++p;
76 
77     /* Handle the base & its syntax */
78     switch (base)
79     {
80         case 0:
81             if (*p == '0')
82             {
83                 if (p[1] == 'x' || p[1] == 'X')
84                 {
85                     p += 2;
86                     base = 16;
87                 }
88                 else
89                 {
90                     ++p;
91                     base = 8;
92                 }
93             }
94             else
95                 base = 10;
96             break;
97         case 16:
98             if (*p == '0' && (p[1] == 'x' || p[1] == 'X'))
99             {
100                 p += 2;
101                 base = 16;
102             }
103             break;
104     }
105 
106     /* Convert the rest of the string into int */
107     while ((n = IS_NUM(*p)) || (a = IS_ALPHA(*p)))
108     {
109         if (n)
110             n = *p - '0';
111         else if (a)
112         {
113             if (IS_UPPER(*p))
114                 n = *p - 'A';
115             else
116                 n = *p - 'a';
117             // "... In bases above 10, the letter 'A' in either upper  or  lower case represents 10,
118             //      'B' represents 11, and so forth, with 'Z' representing 35. ..."
119             n += 10;
120         }
121 
122         // "... stopping at the first character which is not a valid digit in the given base. ..."
123         if (n >= base)
124             break;
125 
126         val *= base;
127         val += n;
128         ++consumed;
129         ++p;
130     }
131 
132     if (neg)
133         val = -val;
134 
135 done:
136     if (endptr)
137         *endptr = (char *)(consumed > 0 ? p : nptr);
138 
139     return val;
140 
141 }
142 
strtoul(const char * nptr,char ** endptr,int base)143 long unsigned int strtoul(const char *nptr, char **endptr, int base)
144 {
145     return (long unsigned int)strtol(nptr, endptr, base);
146 }
147 // STRTOL
148 
receive_n(int fd,void * dst_a,size_t n_bytes)149 size_t receive_n( int fd, void *dst_a, size_t n_bytes )
150 {
151   char *dst = (char *)dst_a;
152   size_t len = 0;
153   size_t rx = 0;
154   while(len < n_bytes) {
155     if (receive(fd, dst + len, n_bytes - len, &rx) != 0) {
156       len = 0;
157       break;
158     }
159     len += rx;
160   }
161 
162   return len;
163 }
164 
send_all(int fd,const void * msg,size_t n_bytes)165 int send_all(int fd, const void *msg, size_t n_bytes)
166 {
167   size_t len = 0;
168   size_t tx = 0;
169   while(len < n_bytes) {
170     if (transmit(fd, (char *)msg + len, n_bytes - len, &tx) != 0) {
171       return 1;
172     }
173     len += tx;
174   }
175   return 0;
176 }
177 
do_win()178 void do_win() {
179     const char *message = "Here's your overflow!!!\n";
180     char name[0x20];
181     send_all(1, message, strlen(message));
182     receive_until2(0, name, '\n', 0x40);
183 }
184 
185 // functions that we need to handle
186 // int_to_str
187 // itoa (int val, char *s) (int val, char *s, base) (int val, char *s size_t size) (char *s, int val)
188 // atoi
189 // strtol
190 // int_to_hex
191 // hex_to_int?
192 // uint32ToHexStr(char* str, uint32_t ui, int bLeadingZeroes, int bUpcase)
193 // decode_hex(char *s); // in place
194 // bin_to_hex(char *dst, const void *src_, size_t n)
195 // hex_to_uint(char *s)
196 // printf(%d %x etc)?
197 
play_game()198 int play_game() {
199     int rand = 0;
200     int rand2 = 0;
201     int *flag = (int*)0x4347c000;
202     for (int i = 0; i < 32; i++) {
203         rand += flag[i];
204         rand2 ^= flag[i];
205     }
206     int ans;
207     char ans_buf[0x20];
208     puts("here is the first num:");
209     char tmp[0x20];
210     itoa(tmp, rand, 0x20);
211     puts(tmp);
212     puts("enter that x2");
213     receive_until2(0, ans_buf, '\n', 0x20);
214     ans = atoi(ans_buf);
215     if (ans != rand*2) {
216       return 0;
217     }
218 
219     puts("here is the 2nd num:");
220     itoa(tmp, rand2, 0x20);
221     puts(tmp);
222     puts("enter that +1337");
223     receive_until2(0, ans_buf, '\n', 0x20);
224     ans = atoi(ans_buf);
225     if (ans != rand2+1337) {
226       return 0;
227     }
228     return 1;
229 }
230 
real_main()231 void real_main() {
232   char buf[0x100] = "The normal buf";
233   struct stack_func_1 s = {{0},0};
234   s.where = buf;
235   receive_n(0, &s, 0x24);
236   send_all(1, s.where, 4);
237   *s.where = '\x00';
238 }
239 
main()240 int main() {
241   char buf[0x100] = "Hello this is a test program where you control a pointer to transmit\n";
242   send_all(1, buf, strlen(buf));
243   real_main();
244   return 0;
245 }
246 
247 
248