1 #include <libcgc.h> 2 #include <stdlib.h> 3 #include <string.h> 4 5 /* Just leak 4 bytes from the flag page, performing a simple mutation on those bytes */ 6 main(int secret_page_i)7int __attribute((fastcall)) main(int secret_page_i) 8 { 9 10 char *token= NULL; 11 int *it; 12 char stack[4] = {0}; 13 int *secret_page = secret_page_i; 14 int sdata; 15 16 allocate(0x20, 0, &token); 17 18 printf("Give me a token: "); 19 receive(0, token, 0x20, NULL); 20 21 printf("Generating new token...\n"); 22 23 it = (int *)token; 24 25 sdata = secret_page[40]; 26 27 it[0] |= (sdata & 0x0100); 28 it[1] |= (sdata & 0x0001); 29 it[2] |= (sdata & 0x1000); 30 it[3] |= (sdata & 0x0010); 31 it[4] |= (sdata & 0x0200); 32 it[5] |= (sdata & 0x0002); 33 it[6] |= (sdata & 0x2000); 34 it[7] |= (sdata & 0x0020); 35 it[7] |= (sdata & 0x0400); 36 it[6] |= (sdata & 0x0004); 37 it[5] |= (sdata & 0x4000); 38 it[4] |= (sdata & 0x0040); 39 it[3] |= (sdata & 0x0800); 40 it[2] |= (sdata & 0x0008); 41 it[1] |= (sdata & 0x8000); 42 it[0] |= (sdata & 0x0080); 43 it[0] |= (sdata & 0x01000000); 44 it[1] |= (sdata & 0x00010000); 45 it[2] |= (sdata & 0x10000000); 46 it[3] |= (sdata & 0x00100000); 47 it[4] |= (sdata & 0x02000000); 48 it[5] |= (sdata & 0x00020000); 49 it[6] |= (sdata & 0x20000000); 50 it[7] |= (sdata & 0x00200000); 51 it[7] |= (sdata & 0x04000000); 52 it[6] |= (sdata & 0x00040000); 53 it[5] |= (sdata & 0x40000000); 54 it[4] |= (sdata & 0x00400000); 55 it[3] |= (sdata & 0x08000000); 56 it[2] |= (sdata & 0x00080000); 57 it[1] |= (sdata & 0x80000000); 58 it[0] |= (sdata & 0x00800000); 59 60 transmit(1, token, 0x20, NULL); 61 } 62