Skip to content

Commit 12d59dc

Browse files
AlaRduTPAlaRduTP
authored
Merge branch '512558003' into lab3
2 parents 1c5e8c2 + ebc4210 commit 12d59dc

20 files changed

+402
-1
lines changed

‎.github/workflows/lab-autograding.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@ jobs:
4545
const files = await github.rest.pulls.listFiles({ owner, repo, pull_number: issue_number });
4646
const changedFiles = files.data.map((file) => file.filename);
4747
const allowedFileRegex = /^lab\d+\/main_test.js$/;
48-
if (!changedFiles.every((file) => allowedFileRegex.test(file))) {
48+
const specialChangedFiles = ["lab5/Answer.md", "lab5/antiasan.c", "lab6/Answer.md", "lab7/sol.py"];
49+
if (!changedFiles.every((file) => (allowedFileRegex.test(file) || specialChangedFiles.includes(file)))) {
4950
core.setFailed('The PR contains changes to files other than the allowed files.');
5051
}
5152
return labNumber;

‎lab5/Answer.md

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Answer
2+
3+
Name:
4+
ID:
5+
6+
## Test Valgrind and ASan
7+
### Result
8+
| | Valgrind | Asan |
9+
| -------------------- | -------- | ---- |
10+
| Heap out-of-bounds | | |
11+
| Stack out-of-bounds | | |
12+
| Global out-of-bounds | | |
13+
| Use-after-free | | |
14+
| Use-after-return | | |
15+
16+
### Heap out-of-bounds
17+
#### Source code
18+
```
19+
20+
```
21+
#### Valgrind Report
22+
```
23+
24+
```
25+
### ASan Report
26+
```
27+
28+
```
29+
30+
### Stack out-of-bounds
31+
#### Source code
32+
```
33+
34+
```
35+
#### Valgrind Report
36+
```
37+
38+
```
39+
### ASan Report
40+
```
41+
42+
```
43+
44+
### Global out-of-bounds
45+
#### Source code
46+
```
47+
48+
```
49+
#### Valgrind Report
50+
```
51+
52+
```
53+
### ASan Report
54+
```
55+
56+
```
57+
58+
### Use-after-free
59+
#### Source code
60+
```
61+
62+
```
63+
#### Valgrind Report
64+
```
65+
66+
```
67+
### ASan Report
68+
```
69+
70+
```
71+
72+
### Use-after-return
73+
#### Source code
74+
```
75+
76+
```
77+
#### Valgrind Report
78+
```
79+
80+
```
81+
### ASan Report
82+
```
83+
84+
```
85+
86+
## ASan Out-of-bound Write bypass Redzone
87+
### Source code
88+
```
89+
90+
```
91+
### Why
92+

‎lab5/Makefile

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
.PHONY: all
2+
all: uaf_asan
3+
4+
uaf_asan: uaf.c libantiasan.so
5+
gcc -fsanitize=address -Og -g -o $@ $< -lantiasan -L.
6+
7+
libantiasan.so: antiasan.c
8+
gcc -g -fPIC -c antiasan.c
9+
gcc -shared antiasan.o -o libantiasan.so
10+
11+
.PHINY: run
12+
run:
13+
LD_LIBRARY_PATH=. ./uaf_asan
14+
15+
.PHONY: clean
16+
clean:
17+
rm uaf_asan antiasan.o libantiasan.so

‎lab5/README.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Lab5
2+
3+
## Introduction
4+
5+
In this lab, you will write a function antoasan to bypass detection of ASan in `antiasan.c` and answer questions of slide in `Answer.md`.
6+
7+
## Preparation (Important!!!)
8+
9+
1. Sync fork your branch (e.g., `SQLab:311XXXXXX`)
10+
2. `git checkout -b lab5` (**NOT** your student ID !!!)
11+
12+
## Requirement
13+
14+
1. (50%) Test Valgrind and ASan to detect common memory corruption vulns, and then asnwer result, report of Valgrind/ASan and Vulnerable code in `Answer.md`.
15+
2. (40%) Write a vulnerable code to bypass redzone between 2 int [8] arrays and asnwer reason and code in `Answer.md`.
16+
17+
3. (30%) write a function antoasan to bypass detection of ASan in `antiasan.c`.
18+
You can run `validate.sh` in your local to test if you satisfy the requirements.
19+
20+
Please note that you must not alter files other than `antiasan.c` and `Answer.md`. You will get 0 points if
21+
22+
1. you modify other files to achieve requirements.
23+
2. you can't pass all CI on your PR.
24+
25+
## Submission
26+
27+
You need to open a pull request to your branch (e.g. 311XXXXXX, your student number) and contain the code that satisfies the abovementioned requirements.
28+
29+
Moreover, please submit the URL of your PR to E3. Your submission will only be accepted when you present at both places.

‎lab5/ans

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
LD_LIBRARY_PATH=. ./uaf_asan
2+
s[0x10] = H
3+
s[0x10] = H

‎lab5/antiasan.c

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
// TODO:
2+
void antiasan(unsigned long addr)
3+
{
4+
5+
}

‎lab5/antiasan.h

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#ifndef HIJACK_H
2+
#define HIJACK_H
3+
4+
void antiasan(unsigned long);
5+
6+
#endif

‎lab5/uaf.c

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <string.h>
4+
#include "antiasan.h"
5+
6+
int main(void)
7+
{
8+
char *s = (char *)malloc(0x18);
9+
strcpy(s, "HAHAHAHAHAHAHAHAHAHAHAH");
10+
printf("s[0x10] = %c\n", s[0x10]);
11+
free(s);
12+
antiasan((unsigned long)&s[0x10]);
13+
printf("s[0x10] = %c\n", s[0x10]);
14+
return 0;
15+
}

‎lab5/validate.sh

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
3+
# Check for unwanted files
4+
for file in *; do
5+
if [[ $file != "uaf.c" && $file != "antiasan.c" && $file != "antiasan.h" && $file != "Makefile" && $file != "README.md" && $file != "Answer.md" && $file != "validate.sh" && $file != "ans" ]]; then
6+
echo "[!] Unwanted file detected: $file."
7+
exit 1
8+
fi
9+
done
10+
11+
test_path="${BASH_SOURCE[0]}"
12+
solution_path="$(realpath .)"
13+
tmp_dir=$(mktemp -d -t lab5-XXXXXXXXXX)
14+
answer=""
15+
16+
cd $tmp_dir
17+
18+
rm -rf *
19+
cp $solution_path/Makefile .
20+
cp $solution_path/*.c .
21+
cp $solution_path/*.h .
22+
cp $solution_path/ans .
23+
24+
make
25+
make run > out 2>&1
26+
result=$(diff ans out)
27+
if [[ -n $result ]]; then
28+
echo "[!] Expected: "
29+
cat ans
30+
echo ""
31+
echo "[!] Actual: "
32+
cat out
33+
echo ""
34+
exit 1
35+
else
36+
echo "[V] Pass"
37+
fi
38+
39+
rm -rf $tmp_dir
40+
41+
exit 0
42+
43+
# vim: set fenc=utf8 ff=unix et sw=2 ts=2 sts=2:

‎lab6/.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
fuzz/
2+
src/bmpcomp

‎lab6/Answer.md

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Name:
2+
ID:
3+
4+
### Fuzz Monitor
5+
```
6+
7+
```
8+
9+
### Run Crash Result
10+
```
11+
12+
```

‎lab6/src/1.bmp

987 KB
Binary file not shown.

‎lab6/src/hw0302.c

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#include <stdio.h>
2+
#include <stdint.h>
3+
#include <stdlib.h>
4+
#include <string.h>
5+
typedef struct _BMPHeader {
6+
char BM[2];
7+
uint32_t size;
8+
uint32_t reserve;
9+
uint32_t offset;
10+
uint32_t header_size;
11+
uint32_t width;
12+
uint32_t height;
13+
uint16_t planes;
14+
uint16_t bpp;
15+
uint32_t compression;
16+
uint32_t bitmap_size;
17+
uint32_t h_res;
18+
uint32_t v_res;
19+
uint32_t palette;
20+
uint32_t important;
21+
}__attribute__((__packed__)) Header;
22+
int main(int argc, char **argv) {
23+
FILE *pF[9];
24+
char *filename = argv[1];
25+
for ( int i=0; i<9; ++i ) {
26+
pF[i] = fopen(filename, "rb");
27+
if ( pF[i] == NULL ) {
28+
printf("error! file %s doesn't exist.\n", filename);
29+
return 0;
30+
}
31+
}
32+
char output[11] = {'o', 'u', 't', 'p', 'u', 't', '.', 'b', 'm', 'p', '\0'};
33+
FILE *pR = fopen(output, "wb");
34+
Header H[9], res;
35+
printf("size of Herder %d\n", sizeof(Header));
36+
for ( int i=0; i<9; ++i ) fread(H+i, sizeof(Header), 1, pF[i]);
37+
res = H[0];
38+
res.height = H[0].height + H[3].height + H[6].height;
39+
res.width = H[0].width + H[1].width + H[2].width;
40+
res.bitmap_size = res.height*res.width*3+(res.width%4*res.height);
41+
res.size = res.bitmap_size + res.offset;
42+
fwrite(&res, sizeof(Header), 1, pR);
43+
for ( int i=2; i<9; i+=3 ) {
44+
for ( int j=0; j<H[i].height; ++j ) {
45+
for ( int k=0; k<3; ++k ) {
46+
uint8_t data[H[i-k].width*3];
47+
fread(data, sizeof(uint8_t), H[i-k].width*3, pF[i-k]);
48+
fwrite(data, sizeof(uint8_t), H[i-k].width*3, pR);
49+
fseek(pF[i-k], H[i-k].width%4, SEEK_CUR);
50+
}
51+
uint8_t padding;
52+
for ( int k=0; k<res.width%4; ++k ) fwrite(&padding, sizeof(uint8_t), 1, pR);
53+
}
54+
}
55+
for ( int i=0; i<9; ++i ) fclose(pF[i]);
56+
fclose(pR);
57+
puts("done!");
58+
return 0;
59+
}

‎lab6/src/makefile

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
bmpcomp: hw0302.c
2+
$(CC) $< -std=c11 -lm -o $@

‎lab6/validate.sh

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
# Check for unwanted files
4+
for file in *; do
5+
if [[ $file != "src" && $file != "src/makefile" && $file != "src/hw0302.c" && $file != "src/1.bmp" && $file != "Answer.md" && $file != "validate.sh" ]]; then
6+
echo "[!] Unwanted file detected: $file."
7+
exit 1
8+
fi
9+
done
10+
11+
echo "[V] Pass"
12+
13+
exit 0
14+
15+
# vim: set fenc=utf8 ff=unix et sw=2 ts=2 sts=2:

‎lab7/Makefile

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
login: login.o
2+
3+
login.o: login.c
4+
5+
.PHONY: clean
6+
clean:
7+
rm login login.o

‎lab7/README.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Lab7
2+
3+
## Introduction
4+
5+
In this lab, you will write a python script with Angr to find the password in executalbe file named 'login'.
6+
7+
## Preparation (Important!!!)
8+
9+
1. Sync fork your branch (e.g., `SQLab:311XXXXXX`)
10+
2. `git checkout -b lab7` (**NOT** your student ID !!!)
11+
12+
## Requirement
13+
14+
1. (100%) Detect the condition that login will print 'Login successful' if login success and print 'Login failed' if login fail, find the input of successful condition by Angr.
15+
16+
Please note that you must not alter files other than `sol.py` or just print the input. You will get 0 points if
17+
18+
1. you modify other files to achieve requirements.
19+
2. you can't pass all CI on your PR.
20+
21+
## Submission
22+
23+
You need to open a pull request to your branch (e.g. 311XXXXXX, your student number) and contain the code that satisfies the abovementioned requirements.
24+
25+
Moreover, please submit the URL of your PR to E3. Your submission will only be accepted when you present at both places.

‎lab7/login.c

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <string.h>
4+
5+
int encrypt(int a1, int a2) {
6+
if ( a1 <= 0x40 || a1 > 90 ) {
7+
puts("Login failed");
8+
exit(1);
9+
}
10+
return (0x1F * a2 + a1 - 65) % 26 + 65;
11+
}
12+
13+
int main(void) {
14+
char secret[0x20] = "VXRRJEURXDASBFHM";
15+
char pwd[0x20] = {0};
16+
17+
printf("Enter the password: ");
18+
scanf("%16s", pwd);
19+
for ( int j = 0; j < 0x10; ++j )
20+
pwd[j] = encrypt(pwd[j], j + 8);
21+
if ( !strcmp(secret, pwd) )
22+
puts("Login successful");
23+
else
24+
puts("Login failed");
25+
return 0;
26+
}

‎lab7/sol.py

Whitespace-only changes.

0 commit comments

Comments
 (0)