Page History

...

Code Block

language	cpp
title	addAdmin()

unsigned __int64 addAdmin()
{
  unsigned __int64 v0; // ST08_8

  v0 = __readfsqword(0x28u);
  gAccount[0].state = 1LL;
  gAccount[0].number = 1LL;
  gAccount[0].fd = (struct IDPW *)malloc(0x80uLL);
  gAccount[0].bk = 880LL;
  strncpy(gAccount[0].fd->id, "Admin", 8uLL);
  strncpy(gAccount[0].fd->pw, "admin", 8uLL);
  strncpy(gAccount[0].fd->description, "I'm Lazenca.0x0\nWebsite is \"https://www.lazenca.net/\"", 0x58uLL);
  return __readfsqword(0x28u) ^ v0;
}

...

해당 함수는 다음과 같은 기능을 합니다.
- 해당 함수는 전역 변수 gAccount[]를 이용해 삭제 가능한 계정들을 출력합니다.
- 해당 함수는 사용자로 부터 삭제 할 계정의 번호를 입력 받습니다.
- 해당 함수는 사용자가 선택한 계정의 state 정보가 '3' 일 경우 삭제를 진행합니다.
- 해당 함수는 gAccount[num].fd 영역에 "gAccount[num].fd - 16" 연산 한 값을 저장합니다.
  - 저장되는 값은 Free chunk의 Head 주소입니다.
  - 이것으로 인해 The House of Lore 취약성이 발생하게 됩니다.

Code Block

language	cpp
title	delAccount()

unsigned __int64 delAccount()
{
  unsigned int i; // [rsp+8h] [rbp-18h]
  unsigned int num; // [rsp+Ch] [rbp-14h] MAPDST
  unsigned __int64 v4;

Code Block

unsigned __int64 delAccount()
{
  unsigned int i; // [rsp+8h] [rbp-18h]
  unsigned int num; // [rsp+Ch] [rbp-14h] MAPDST
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  puts("\nAccount list");
  for ( i = 0; i <= 2; ++i )
  {
    if ( gAccount[i].state )
      printf("%d) %s\n", gAccount[i].number, gAccount[i].fd->id);
  }
  puts("\nPlease enter the number of the account you want to delete");
  num = retNumber(2LL);
  if ( num && num <= 3 )
  {
    if ( gAccount[--num].state == 3 )
    {
      gAccount[num].state = 0LL;
      gAccount[num].fd->state = 0LL;
      printf("The account(%s) has been deleted.\n", gAccount[num].fd->id);
      memset(gAccount[num].fd, 0, 0x80uLL);
      free(gAccount[num].fd);
      gAccount[num].fd = (struct IDPW *)((char *)gAccount[num].fd - 16);
    }
    else
    {
      puts("You can not delete the account.");
    }
  }
  return __readfsqword(0x28u) ^ v4;
}

Code Block

unsigned __int64 changePW()
{
  unsigned int i; // [rsp+8h] [rbp-18h]
  unsigned int num; // [rsp+Ch] [rbp-14h] MAPDST
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  puts("\nAccount list");
  for ( i = 0; i <= 2; ++i )
  {
    if ( gAccount[i].state )
      printf("%ld) %s\n", gAccount[i].number, gAccount[i].fd->id);
  }
  puts("\nPlease enter the number of the account you want to change PW");
  num = retNumber(2LL);
  if ( num )
  {
    if ( num <= 3 )
    {
      if ( gAccount[--num].fd )
      {
        if ( gAccount[num].fd->state )
        {
          puts("Enter your New Password.");
          UserInput(gAccount[num].fd->pw, 8LL);
        }
      }
    }
  }
  return __readfsqword(0x28u) ^ v4;
}

changePW

해당 함수는 다음과 같은 기능을 합니다.
- 해당 함수는 전역 변수 "gAccount[i].state"를 이용해 비밀번호 변경이 가능한 계정을 출력합니다.
- 해당 함수는 사용자로 부터 비밀번호를 변경할 계정의 번호를 입력 받습니다.
- 해당 함수는 해당 계정의 '.fd.state' 영역에 저장된 값이 '0'이 아닐 경우 비밀번호를 변경할 수 있습니다.

Code Block

language	cpp
title	changePW()

unsigned __int64 changePW()
{
  unsigned int i; // [rsp+8h] [rbp-18h]
  unsigned int num; // [rsp+Ch] [rbp-14h] MAPDST
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  puts("\nAccount list");
  for ( i = 0; i <= 2; ++i )
  {
    if ( gAccount[i].state )
      printf("%ld) %s\n", gAccount[i].number, gAccount[i].fd->id);
  }
  puts("\nPlease enter the number of the account you want to change PW");
  num = retNumber(2LL);
  if ( num )
  {
    if ( num <= 3 )
    {
      if ( gAccount[--num].fd )
      {
        if ( gAccount[num].fd->state )
        {
          puts("Enter your New Password.");
          UserInput(gAccount[num].fd->pw, 8LL);
        }
      }
    }
  }
  return __readfsqword(0x28u) ^ v4;
}

Code Block

unsigned __int64 orderList()
{
  unsigned int i; // [rsp+4h] [rbp-Ch]
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  if ( gOrderCnt )
  {
    puts("\n=*= Order list =*=");
    for ( i = 0; i < gOrderCnt; ++i )
    {
      printf("\nOrder code  : %s\n", gOrderList[i]);
      printf("Order count : %d\n", gOrderList[i]->orderNumber);
      printf("Order candy : %s\n", gOrderList[i]->orderCandyName);
      printf("Candy code  : %d\n", (unsigned int)gOrderList[i]->candyCode);
    }
  }
  else
  {
    puts("You have never ordered a product.");

Code Block

unsigned __int64 orderMenu()
{
  signed int i; // [rsp+8h] [rbp-88h]
  unsigned int control; // [rsp+Ch] [rbp-84h]
  char funcList[5][22]; // [rsp+10h] [rbp-80h]
  unsigned __int64 v4; // [rsp+88h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  control = 1;
  strcpy((char *)funcList, "Order List");
  *(_DWORD *)&funcList[0][16] = 0;
  *(_WORD *)&funcList[0][20] = 0;
  strcpy(funcList[1], "Add to Order List");
  *(_WORD *)&funcList[1][20] = 0;
  *(_QWORD *)&funcList[2][0] = 'o lecnaC';
  *(_QWORD *)&funcList[2][8] = 'o s���en';
  *(_DWORD *)&funcList[2][16] = 'redr';
  *(_WORD *)&funcList[2][20] = '.';
  strcpy(funcList[3], "Order candy");
  *(_DWORD *)&funcList[3][16] = 0;
  *(_WORD *)&funcList[3][20] = 0;
  *(_OWORD *)&funcList[4][0] = (unsigned __int64)'tixE';
  *(_DWORD *)&funcList[4][16] = 0;
  *(_WORD *)&funcList[4][20] = 0;
LABEL_11:
  while ( control )
  {
    puts("\nOrder candy.");
    for ( i = 0; i <= 4; ++i )
      printf("%d) %s\n", (unsigned int)(i + 1), funcList[i]);
    printf("Command : ");
    switch ( (unsigned int)retNumber(2LL) )
    {
      case 1u:
        orderList();
        break;
      case 2u:
        addToOrderList();
        break;
      case 3u:
        orderCancel();
        break;
      case 4u:
        orderCandy();
        break;
      case 5u:
        control = 0;
        break;
      default:
        goto LABEL_11;
    }
  }
  return __readfsqword(0x28u) ^ v4v2;
}

addToOrderList

해당 함수는 다음과 같은 기능을 합니다.
- 해당 함수는 choiceCandy() 함수를 사용해 주문할 사탕의 번호를 입력받습니다.
- 해당 함수는 malloc() 함수를 사용해 24 byte의 heap 영역을 할당받습니다.
  - 해당 함수는 해당 영역에 주문할 사탕의 정보를 저장합니다.

Code Block

language	cpp
title	addToOrderList

unsigned __int64 orderList()
{ addToOrderList()
{
  struct ORDER *newOrder; // ST08_8
  unsigned int tmp; // eax
  unsigned int icandyNum; // [rsp+4h] [rbp-Ch1Ch]
  char strOrdNum[8]; // [rsp+10h] [rbp-10h]
  unsigned __int64 v2v5; // [rsp+8h18h] [rbp-8h]

  v2v5 = __readfsqword(0x28u);
  if ( (unsigned int)gOrderCnt > 9 )
  {
    puts("\n=*= Order list =*=You can not order candy anymore.");
  }
  for ( i = 0; i < gOrderCnt; ++ielse
  {
    candyNum = choiceCandy();
    if ( candyNum > 9 )
    {
      printfputs("\nOrder code  : %s\n", gOrderList[i]Please enter a number between 0 and 9");
    }
   printf("Order count : %d\n", gOrderList[i]->orderNumber); else
    {
      printf("Order candy : %s\n", gOrderList[i]->orderCandyName);
  newOrder = (struct ORDER *)malloc(24uLL);
    printf("Candy code tmp : %d\n", (unsigned int)gOrderList[i]->candyCode)= getOrderNum();
    }
  }
  elsesprintf(strOrdNum, "%d", tmp);
  {
    puts("You have never ordered a product."strncpy(newOrder->orderCode, strOrdNum, 1uLL);
  }
  return __readfsqword(0x28u) ^ v2;
}

Code Block

language	cpp
title	addToOrderList

 newOrder->orderNumber = gCandies[candyNum]->orderNumber;
      strncpy(newOrder->orderCandyName, gCandies[candyNum]->candyName, 8uLL);
      newOrder->candyCode = gCandies[candyNum]->candyCode;
      gOrderList[gOrderCnt++] = newOrder;
      orderList();
    }
  }
  return __readfsqword(0x28u) ^ v5;
}

orderCancel

해당 함수는 다음과 같은 기능을 합니다.
- 해당 함수는 checkCancel(i) 함수를 취소 가능한 주문을 확인하고, 주문 취소 가능한 목록을 출력합니다.
- 해당 함수는 취소 가능한 주문이 있으며, 사용자로 부터 주문 번호을 입력받습니다.
- 해당 함수는 입력 값을 검증한 후 reSort() 함수를 호출 해 주문을 취소합니다.

Code Block

unsigned __int64 orderCancel()
{
  unsigned int i; // [rsp+Ch] [rbp-44h]
  int j; // [rsp+Ch] [rbp-44h]
  int orderCnt; // [rsp+10h] [rbp-40h]
  unsigned int canNum; // [rsp+1Ch] [rbp-34h]
  int cancelableList[10]; // [rsp+20h] [rbp-30h]
  unsigned __int64 v6; // [rsp+48h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  orderCnt = 0;
  if ( gOrderCnt )
  {
    for ( i = 0; i < gOrderCnt; ++i )
    {
      if ( (unsigned int)checkCancel(i) )
      {
        cancelableList[orderCnt++] = iunsigned __int64 addToOrderList()
{
  struct ORDER *newOrder; // ST08_8
  unsigned int tmp; // eax
  unsigned int candyNum; // [rsp+4h] [rbp-1Ch]
  char strOrdNum[8]; // [rsp+10h] [rbp-10h]
  unsigned __int64 v5; // [rsp+18h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  if ( (unsigned int)gOrderCnt > 9 )
  {
    puts("You can not order candy anymore.");
  }
  else
  {
    candyNum = choiceCandy();
    if ( candyNum > 9 )
    {
      puts("Please enter a number between 0 and 9");
    }
    else
    {
      newOrder = (struct ORDER *)malloc(0x18uLL);
      tmp = getOrderNum();
      sprintf(strOrdNum, "%d", tmp);
      strncpy(newOrder->orderCode, strOrdNum, 1uLL);
      newOrder->orderNumber = gCandies[candyNum]->orderNumber;
      strncpy(newOrder->orderCandyName, gCandies[candyNum]->candyName, 8uLL);
      newOrder->candyCode = gCandies[candyNum]->candyCode;
      gOrderList[gOrderCnt++] = newOrder;
      orderList();
    }
  }
  return __readfsqword(0x28u) ^ v5;
}

Code Block

unsigned __int64 orderCancel()
{
  unsigned int i; // [rsp+Ch] [rbp-44h]
  int j; // [rsp+Ch] [rbp-44h]
  int orderCnt; // [rsp+10h] [rbp-40h]
  unsigned int canNum; // [rsp+1Ch] [rbp-34h]
  int cancelableList[10]; // [rsp+20h] [rbp-30h]
  unsigned __int64 v6; // [rsp+48h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  orderCnt = 0;
  if ( gOrderCnt )
  {
    for ( i = 0; i < gOrderCnt; ++i )
    {
    printf("\n=*= Cancelable order (Order number : %d) =*=\n", i);
        printf("Order code: %s\n", gOrderList[i]);
        printf("Order count : %d\n", gOrderList[i]->orderNumber);
        printf("Order candy : %s\n", gOrderList[i]->orderCandyName);
        printf("Candy code: %d\n", (unsigned int)gOrderList[i]->candyCode);
      }
    }
    if ( (unsigned int)checkCancel(i)orderCnt )
      {
        cancelableList[orderCnt++]canNum = iretNumber(2LL);
      for  printf("\n=*( j = Cancelable0; orderj (Order< number : %d) =*=\n", i);orderCnt; ++j )
      {
        printf("Order code: %s\n", gOrderList[i]);if ( cancelableList[j] == canNum )
        printf("Order count : %d\n", gOrderList[i]->orderNumber reSort(canNum);
      }
  printf("Order candy : %s\n", gOrderList[i]->orderCandyName); }
  }
  else
  {
    printfputs("Candy code: %d\n", (unsigned int)gOrderList[i]->candyCode);
    You have never ordered a product.");
  }
  return __readfsqword(0x28u) ^ }
    if ( orderCnt )
    v6;
}

reSort

해당 함수는 다음과 같은 기능을 합니다.

Code Block

language	cpp
title	reSort(unsigned int a1)

unsigned __int64 __fastcall reSort(unsigned int a1)
{
  int i; //  canNum = retNumber(2LL);[rsp+14h] [rbp-Ch]
  unsigned    for ( j = 0; j < orderCnt; ++j )
      {
      __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  free(gOrderList[a1]);
  if ( cancelableList[j] == canNuma1 < gOrderCnt )
  {
    for ( i = reSort(canNum)0;
 a1 + i <  }gOrderCnt; ++i )
    }
  gOrderList[a1 }
+ i] else
= gOrderList[a1 {
+ i +  puts("You have never ordered a product.")1];
  }
  gOrderList[gOrderCnt--] = 0LL;
  }
  return __readfsqword(0x28u) ^ v6v3;
}

Code Block

unsigned __int64 orderCandy()
{
  struct STOCK *dest; // ST10_8
  unsigned int i; // [rsp+4h] [rbp-1Ch]
  int num; // [rsp+Ch] [rbp-14h]
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  if ( gOrderCnt )
  {
    orderList();
    puts("\nWould you like to order these candies?");
    puts("0) Yes, 1) No");
    if ( !(unsigned int)retNumber(2LL) )
    {
      for ( i = 0; i < gOrderCnt; ++i )
      {
        num = getStockNum(i);
        if ( num )
        {
          gStock[num - 1]->candyNumber += gOrderList[i]->orderNumber;
        }
        else if ( (unsigned int)gStockCnt > 4 )
        {
          puts("The warehouse is full. Your new order can not be completed.");
        }
        else
        {
          puts("\nEnter information about newly added candy.");
          dest = (struct STOCK *)malloc(0x18uLL);
          strncpy(dest->candyName, gOrderList[i]->orderCandyName, 8uLL);
          dest->candyNumber = gOrderList[i]->orderNumber;
          printf("Enter the price of %s candy.\n", dest);
          dest->candyPrice = retNumber(5LL);
          printf("Enter a description of the %s candy.\n", dest);
          dest->candyDescription = (char *)malloc(0x7CuLL);
          UserInput(dest->candyDescription, 124LL);
          gStock[gStockCnt++] = dest;
        }
      }
      while ( gOrderCnt )
      {
        free(gOrderList[gOrderCnt - 1]);
        gOrderList[gOrderCnt-- - 1] = 0LL;
      }
    }
  }
  else
  {
    puts("You have never ordered a product.");
  }
  return __readfsqword(0x28u) ^ v4;
}

...

Page tree

Versions Compared

Old Version 11

New Version 12

Key

changePW

addToOrderList

orderCancel

reSort