adding validated services? patching forcad_local.py
This commit is contained in:
@@ -0,0 +1,38 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
static void inner(const char *status, const char *content_type, const char *body)
|
||||
{
|
||||
const char *crlf = "\r\n";
|
||||
const char *h1 = "HTTP/1.1 ";
|
||||
const char *h_ct = "Content-Type: ";
|
||||
const char *h_cl = "Content-Length: ";
|
||||
char *buf = (char *)malloc(1024);
|
||||
size_t cap = 1024, off = 0;
|
||||
// helper
|
||||
#define APPEND_STR(S) do { const char *ss_ = (S); if (ss_) { size_t nn_ = strlen(ss_); if (off + nn_ > cap) nn_ = (cap > off) ? cap - off : 0; if (nn_) memcpy(buf + off, ss_, nn_); off += nn_; } } while (0)
|
||||
#define APPEND_N(S,N) do { const char *ss2_ = (S); size_t nn2_ = (N); if (ss2_) { if (off + nn2_ > cap) nn2_ = (cap > off) ? cap - off : 0; if (nn2_) memcpy(buf + off, ss2_, nn2_); off += nn2_; } } while (0)
|
||||
|
||||
char lenbuf[32];
|
||||
int blen = (int)strlen(body);
|
||||
snprintf(lenbuf, sizeof lenbuf, "%d", blen);
|
||||
APPEND_STR(h1); APPEND_STR(status); APPEND_STR(crlf);
|
||||
APPEND_STR(h_ct); APPEND_STR(content_type); APPEND_STR(crlf);
|
||||
APPEND_STR(h_cl); APPEND_STR(lenbuf); APPEND_STR(crlf);
|
||||
APPEND_STR(crlf);
|
||||
APPEND_STR(body);
|
||||
if (off < cap) buf[off] = 0; else buf[cap-1] = 0;
|
||||
puts(buf);
|
||||
free(buf);
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
const char *status = "400 Bad Request";
|
||||
const char *ctype = "application/json";
|
||||
const char *body = "{\"ok\":false}";
|
||||
inner(status, ctype, body);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
static void extract(const char *json) {
|
||||
char tone_sequences_json[8192] = "[]";
|
||||
const char *ts_pos = strstr(json, "\"toneSequences\":");
|
||||
if (ts_pos)
|
||||
{
|
||||
const char *p = strchr(ts_pos, '[');
|
||||
if (p)
|
||||
{
|
||||
int depth = 0;
|
||||
const char *q = p;
|
||||
while (*q && (q - p) < (int)sizeof(tone_sequences_json) - 2)
|
||||
{
|
||||
if (*q == '[') depth++;
|
||||
else if (*q == ']') { depth--; if (depth == 0) { q++; break; } }
|
||||
q++;
|
||||
}
|
||||
size_t len = (size_t)(q - p);
|
||||
if (len > 0 && len < sizeof(tone_sequences_json))
|
||||
{
|
||||
memcpy(tone_sequences_json, p, len);
|
||||
tone_sequences_json[len] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
printf("tone_sequences=%s\n", tone_sequences_json);
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
const char *input =
|
||||
"{\"name\":\"xxxsed\",\"description\":\"\",\"toneSequences\":[{\"id\":1758442926199.0464,\"baseNote\":60,\"intervalType\":\"unison\",\"chordType\":\"none\",\"tempo\":120,\"duration\":4,\"notes\":[60]}]}";
|
||||
extract(input);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
typedef unsigned Oid;
|
||||
typedef struct { int dummy; } PGconn;
|
||||
|
||||
static int myexecParams(PGconn *c, const char *cmd, int nParams,
|
||||
const Oid *paramTypes,
|
||||
const char *const *paramValues,
|
||||
const int *paramLengths,
|
||||
const int *paramFormats,
|
||||
int resultFormat)
|
||||
{
|
||||
(void)c; (void)paramTypes; (void)paramLengths; (void)paramFormats; (void)resultFormat;
|
||||
printf("CMD:%s\n", cmd);
|
||||
printf("N:%d\n", nParams);
|
||||
for (int i = 0; i < nParams; ++i) {
|
||||
const char *p = paramValues[i];
|
||||
printf("P[%d]=%s\n", i, p ? p : "(null)");
|
||||
}
|
||||
return 1234;
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
PGconn conn; // dummy
|
||||
char uid[16]; snprintf(uid, sizeof(uid), "%d", 42);
|
||||
char name[32] = "Hello";
|
||||
char descr[32] = "World";
|
||||
char json[64] = "[1,2,3]";
|
||||
const char *params[4] = { uid, name, descr, json };
|
||||
const char *query = "INSERT INTO t (a,b,c,d) VALUES ($1::int,$2,$3,$4::jsonb)";
|
||||
int r = myexecParams(&conn, query, 4, NULL, params, NULL, NULL, 0);
|
||||
printf("RET:%d\n", r);
|
||||
return 0;
|
||||
}
|
||||
|
||||
91
OmCTF-2025/sources/polyphonia/obfuscator_src/tests/run_varargs_parity.sh
Executable file
91
OmCTF-2025/sources/polyphonia/obfuscator_src/tests/run_varargs_parity.sh
Executable file
@@ -0,0 +1,91 @@
|
||||
#!/usr/bin/env bash
|
||||
# Be tolerant to individual failures; aggregate results at end.
|
||||
set -uo pipefail
|
||||
|
||||
ROOT_DIR=$(cd "$(dirname "$0")/.." && pwd)
|
||||
BUILD_DIR="$ROOT_DIR/build"
|
||||
PASS_SO="$BUILD_DIR/libVMObfuscatorPass.so"
|
||||
RUNTIME_O="$BUILD_DIR/vm_runtime.o"
|
||||
TEST_BUILD_DIR="$BUILD_DIR/tests"
|
||||
RUN_DIR="$BUILD_DIR/run"
|
||||
|
||||
mkdir -p "$TEST_BUILD_DIR" "$RUN_DIR"
|
||||
|
||||
if [[ ! -f "$PASS_SO" ]]; then
|
||||
echo "Pass plugin not found at $PASS_SO" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "$RUNTIME_O" ]]; then
|
||||
echo "Runtime object not found at $RUNTIME_O" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mask_ptrs() {
|
||||
# Mask long hex addresses to keep parity (avoid masking small constants like 0xBEEF)
|
||||
sed -E 's/0x[0-9a-fA-F]{6,}/0xPTR/g'
|
||||
}
|
||||
|
||||
ok=0
|
||||
fail=0
|
||||
|
||||
for c in "$ROOT_DIR/tests/varargs"/*.c; do
|
||||
name=$(basename "$c" .c)
|
||||
echo "== $name =="
|
||||
base_bin="$TEST_BUILD_DIR/${name}_base"
|
||||
obf_obj="$TEST_BUILD_DIR/${name}_obf.o"
|
||||
obf_bin="$TEST_BUILD_DIR/${name}_obf"
|
||||
|
||||
# Compile baseline
|
||||
clang -O2 "$c" -o "$base_bin"
|
||||
|
||||
# Compile to bitcode, run the pass with opt, then compile to object
|
||||
bc_tmp="$TEST_BUILD_DIR/${name}.bc"
|
||||
obf_bc="$TEST_BUILD_DIR/${name}_obf.bc"
|
||||
clang -O2 -I"$ROOT_DIR/include" -emit-llvm -c "$c" -o "$bc_tmp"
|
||||
opt-18 -load-pass-plugin="$PASS_SO" -passes=vm-obfuscate "$bc_tmp" -o "$obf_bc"
|
||||
clang -O2 -c "$obf_bc" -o "$obf_obj"
|
||||
clang -O2 "$obf_obj" "$RUNTIME_O" -lpthread -o "$obf_bin"
|
||||
|
||||
# Run each in its own run dir
|
||||
base_run_dir="$RUN_DIR/${name}_base"
|
||||
obf_run_dir="$RUN_DIR/${name}_obf"
|
||||
rm -rf "$base_run_dir" "$obf_run_dir"
|
||||
mkdir -p "$base_run_dir" "$obf_run_dir"
|
||||
|
||||
# Run baseline
|
||||
(cd "$base_run_dir" && "$base_bin" > stdout.txt 2> stderr.txt || true)
|
||||
# Run obfuscated
|
||||
(cd "$obf_run_dir" && "$obf_bin" > stdout.txt 2> stderr.txt || true)
|
||||
|
||||
# Compare stdout with masking
|
||||
if ! diff -u <(mask_ptrs < "$base_run_dir/stdout.txt") <(mask_ptrs < "$obf_run_dir/stdout.txt") >/dev/null; then
|
||||
echo " [FAIL] stdout differs"
|
||||
echo "--- baseline stdout"; cat "$base_run_dir/stdout.txt" | mask_ptrs
|
||||
echo "--- obfuscated stdout"; cat "$obf_run_dir/stdout.txt" | mask_ptrs
|
||||
((fail++))
|
||||
continue
|
||||
fi
|
||||
|
||||
# If a file output exists, compare it too
|
||||
if [[ -f "$base_run_dir/tests_out_file.txt" || -f "$obf_run_dir/tests_out_file.txt" ]]; then
|
||||
if [[ ! -f "$base_run_dir/tests_out_file.txt" || ! -f "$obf_run_dir/tests_out_file.txt" ]]; then
|
||||
echo " [FAIL] file output presence mismatch"
|
||||
((fail++))
|
||||
continue
|
||||
fi
|
||||
if ! diff -u <(mask_ptrs < "$base_run_dir/tests_out_file.txt") <(mask_ptrs < "$obf_run_dir/tests_out_file.txt") >/dev/null; then
|
||||
echo " [FAIL] file output differs"
|
||||
echo "--- baseline file"; cat "$base_run_dir/tests_out_file.txt" | mask_ptrs
|
||||
echo "--- obfuscated file"; cat "$obf_run_dir/tests_out_file.txt" | mask_ptrs
|
||||
((fail++))
|
||||
continue
|
||||
fi
|
||||
fi
|
||||
|
||||
echo " [OK] parity matched"
|
||||
((ok++))
|
||||
done
|
||||
|
||||
echo
|
||||
echo "Summary: $ok OK, $fail FAIL"
|
||||
exit $fail
|
||||
@@ -0,0 +1,18 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
int main(void) {
|
||||
// Build a format string at runtime in a local buffer
|
||||
char fmt[64];
|
||||
strcpy(fmt, "X:%.*s Y:%*d Z:%s W:%s END\n");
|
||||
|
||||
char s_local[32];
|
||||
for (int i = 0; i < (int)sizeof s_local; ++i) s_local[i] = (char)('0' + (i % 10));
|
||||
s_local[31] = '\0';
|
||||
|
||||
const char *g = "GLOB";
|
||||
int p = 5, w = 3;
|
||||
printf(fmt, p, "abcdefghijk", w, 9, g, s_local + 7);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
#include <stdio.h>
|
||||
|
||||
int main(void) {
|
||||
// Many arguments across a single printf to stress call shim
|
||||
// Avoid %p to keep outputs comparable across obfuscated/non-obfuscated runs.
|
||||
printf("M:%d %d %d %d %d %d %d %d %d %d %d %d | %s %s %s | %.*s %*d\n",
|
||||
1,2,3,4,5,6,7,8,9,10,11,12,
|
||||
"aa","bb","cc",
|
||||
3, "abcdefgh", 5, 777);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
static const char g_fmt[] = "start:%s mid:%*d end:%s done\n";
|
||||
static const char g_hello[] = "HELLO";
|
||||
|
||||
int main(void) {
|
||||
char local[32];
|
||||
for (int i = 0; i < (int)sizeof local; ++i) local[i] = (char)('A' + (i % 26));
|
||||
local[31] = '\0';
|
||||
|
||||
const char *s1 = g_hello;
|
||||
const char *s2 = local + 5; // pointer into local buffer
|
||||
int width = 7;
|
||||
|
||||
// printf with global-encrypted fmt and both global/local string args
|
||||
printf(g_fmt, s1, width, 42, s2);
|
||||
|
||||
// more mixed specifiers including width/precision stars with strings
|
||||
const char *s3 = "abcdefg";
|
||||
int prec = 3;
|
||||
int w2 = 6;
|
||||
printf("mix:%.*s|%*d|%s|%s|%%\n", prec, s3, w2, -12345, s1, s2);
|
||||
|
||||
// Check %s with NULL and empty string
|
||||
const char *nulls = NULL;
|
||||
const char *emptys = "";
|
||||
printf("null:%s empty:%s end\n", nulls, emptys);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
static const char g_tag[] = "XYZ";
|
||||
|
||||
int main(void) {
|
||||
char buf[256];
|
||||
char local[64];
|
||||
for (int i = 0; i < (int)sizeof local; ++i) local[i] = (char)('a' + (i % 26));
|
||||
local[63] = '\0';
|
||||
|
||||
// snprintf with dynamic width and precision, and local/global %s
|
||||
int w = 8, p = 4;
|
||||
int n = snprintf(buf, sizeof(buf), "A:%*d B:%.*s C:%s D:%s END", w, 321, p, "qwerty", g_tag, local + 2);
|
||||
printf("snlen=%d buf='%s'\n", n, buf);
|
||||
|
||||
// fprintf to a file
|
||||
FILE *f = fopen("tests_out_file.txt", "w");
|
||||
if (!f) {
|
||||
perror("fopen");
|
||||
return 1;
|
||||
}
|
||||
fprintf(f, "FILE:%s|%.*s|%d|%s\n", g_tag, 5, "ZYXWVUT", -77, local + 10);
|
||||
fclose(f);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user