DEFCON 2015 - misc/patcher

/*
 * DEFCON 2015 - misc/patcher
 * @mykiimike
 */
#include <sys/types.h>
#include <fcntl.h>
#include <stdio.h>
#include <err.h>
#include <unistd.h>
#include <string.h>
#define BASE  0x08048000

//unsigned char shell[] = "\xC7\x04\x24\x94\x13\x00\x00"; // org shell
unsigned char shell_080487AF[] = "\xC7\x04\x24\xC0\x5A\x12\x00";
#define FLASH_080487AF 0x080487AF
unsigned char oldShell_080487AF[8];
int oldShellSize_080487AF = 7;

//unsigned char shell_08048C56[] = "\x81\xFF\x00\x00\x01\x00"; // org shell
unsigned char shell_08048C56[] = "\x81\xFF\x00\x01\x00\x00";
#define FLASH_08048C56 0x08048C56
unsigned char oldShell_08048C56[8];
int oldShellSize_08048C56 = sizeof(shell_08048C56)-1;

//unsigned char shell_080489BD[] = "\x81\xC1\xA0\x0F\x00\x00"; // org shell
unsigned char shell_080489BD[] = "\x81\xC1\xFA\x00\x00\x00";
#define FLASH_080489BD 0x080489BD
unsigned char oldShell_080489BD[8];
int oldShellSize_080489BD = sizeof(shell_080489BD)-1;

//unsigned char shell[] = "\xb8\x5\x0\x0\x0\x53\x51\x52\x8b\x5c\x24\x10\x8b\x4c\x24\x14\x8b\x54\x24\x18\xcd\x80\x5a\x59\x5b\xc3"; // org shell
//unsigned char shell[] = "\x60\x8B\x5C\x24\x10\x8B\x4C\x24\x14\x8B\x54\x24\x18\xCD\x80\x5A\x59\x5B\xC3";
void printbuf(unsigned char *p, int s) {
    int a;
    for(a=0; a<s; a++, p++)
        printf("\\x%x", *p);

    putchar('\n');
}
void flash(int f, off_t address, char *new, int newSize, char *old, int oldSize) {
    int a;
    unsigned char *p;
    off_t off;
    /* place */
    off = address-BASE;
    printf("* Seek 0x%x to %x\n", address, off);
    lseek(f, off, SEEK_SET);
    /* load the code */
    printf("* Recoding 0x%x old shell code:", address);
    p = old;
    for(a=0; a<oldSize;)
        a += read(f, p+a, oldSize-a);
    printbuf(old, oldSize);
    /* patch the code */
    printf("* Patching 0x%x the code using (%d bytes): ", address, newSize);
    printbuf(new, newSize);
    lseek(f, off, SEEK_SET);
    p = new;
    for(a=0; a<newSize;)
        a += write(f, p, newSize-a);

}
int main(int argc, char **argv) {
    int i, f, a;
    int ret = 0;
    unsigned char *p;
    if (argc < 2) {
        fprintf(stderr, "files...\n");
        return (1);
    }

    for (i = 1; i < argc; i++) {
        f = open(argv[i], O_RDWR, 0);
        if (f == -1) {
            ret = 1;
            warn("open %s", argv[i]);
            return(1);
        }
        flash(f, FLASH_080487AF, shell_080487AF, sizeof(shell_080487AF)-1, oldShell_080487AF, oldShellSize_080487AF);
        flash(f, FLASH_08048C56, shell_08048C56, sizeof(shell_08048C56)-1, oldShell_08048C56, oldShellSize_08048C56);
        flash(f, FLASH_080489BD, shell_080489BD, sizeof(shell_080489BD)-1, oldShell_080489BD, oldShellSize_080489BD);
        /* close file */
        if (f != -1) {
            close(f);
            f = -1;
        }
    }
    return (ret);
}