sophos - level3

// by petter wahlman, http://twitter.com/badeip

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>

#define PINK 0xedbbf100
int main(int argc, char **argv)
{
    struct stat st;
    char *target;
    char *addr;
    int match;
    int i;
    int fd;

    target = "./security-advice-for-train-commuters.gif";
    if (argc > 1)
        target = argv[1];

    printf("[+] opening: %s\n", target);
    fd = open(target, O_RDWR);
    if (-1 == fd) {
        perror(target);
        return 1;
    }

    fstat(fd, &st);

    addr = mmap(NULL, st.st_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
    close(fd);
    if (MAP_FAILED == addr) {
        perror("mmap");
        return 1;
    }

    match = 0;
    for (i = 0; i < st.st_size; i++) {
        if (*(unsigned int *)&addr[i] == PINK) {
            printf("[+] 0x%08x located at offset: 0x%08x\n", PINK, i);
            if (1 == match++) {
                printf("[+] patching offset: 0x%08x\n", i);
                *(unsigned int *)&addr[i] = 0x00000000;
                break;
            }
        }
    }
    munmap(addr, st.st_size);

    return 0;
}