Solution to the Australian Department of Defense challenge

// By petter wahlman, http://www.twitter.com/badeip
// IA-32 Solution for the Australian Government's Department of Defense job application challenge:
// https://plus.google.com/103685227755333384561/posts/VasNhJpVFA4
// Thanks to: @alfiejohn_ for sending me the image.

#include <stdio.h>
#include <stdint.h>
#include <malloc.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <time.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/utsname.h>

static uint8_t dsd[] = {
     0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x8b, 0xcb, 0x83, 0xc3, 0x1e, 0x33, 0xc0, 0x33, 0xd2, 0x8a,
     0x03, 0x8a, 0x11, 0x32, 0xc2, 0x88, 0x03, 0x3c, 0x00, 0x74, 0x2b, 0x83, 0xc1, 0x01, 0x83, 0xc3,
     0x01, 0xeb, 0xec, 0x33, 0xff, 0xbf, 0xf3, 0xf9, 0x31, 0x1c, 0xb7, 0x44, 0xa5, 0xa4, 0x67, 0xf9,
     0x75, 0x1c, 0xa5, 0xe7, 0x75, 0x12, 0x61, 0x01, 0x04, 0xe7, 0xa4, 0x62, 0xec, 0xa7, 0x64, 0x8f,
     0xc2, 0x00, 0x00, 0x19, 0x1c, 0x3a, 0xcc
};

static const uint8_t dump_mem[] = {
    0x8d, 0x79, 0xfc,                       // lea    edi,[ecx-0x4]
    0x57,                                   // push   edi
    0x31, 0xc9,                             // xor    ecx,ecx
    0x30, 0xc0,                             // xor    al,al
    0xf7, 0xd1,                             // not    ecx
    0xfc,                                   // cld
    0xf2, 0xae,                             // repne scasb
    0xf7, 0xd1,                             // not    ecx
    0x49,                                   // dec    ecx
    0x66, 0xc7, 0x47, 0xff, 0x0a, 0x00,     // mov    WORD PTR [edi-1],0xa00
    0x41,                                   // inc    ecx
    0x89, 0xca,                             // mov    edx,ecx
    0x59,                                   // pop    ecx
    0xb8, 0x04, 0x00, 0x00, 0x00,           // mov    eax,0x4
    0x31, 0xdb,                             // xor    ebx,ebx
    0xfe, 0xc3,                             // inc    bl
    0xcd, 0x80,                             // int    0x80
    0x89, 0xd3,                             // mov    ebx,edx
    0x31, 0xc0,                             // xor    eax,eax
    0xfe, 0xc0,                             // inc    al
    0xcd, 0x80                              // int    0x80
};


//#define UDIS86
#ifdef UDIS86
    #include <udis86.h>

    uint32_t btox(uint8_t *buf, uint32_t size, uint8_t *out)
    {
        uint32_t i;

        for (i = 0; i < size; i++)
            snprintf(&out[i * 3], 4, "%02x ", buf[i]);
        return i;
    }

    uint32_t disass(uint8_t *mem, uint32_t size)
    {
        ud_t u;
        ud_init(&u);
        ud_set_input_buffer(&u, mem, size);
        ud_set_mode(&u, 64);
        ud_set_syntax(&u, UD_SYN_INTEL);
        while (ud_disassemble(&u)) {
            uint64_t offset;
            uint32_t len;
            uint8_t hex[64];

            len =  ud_insn_len(&u);
            offset =  ud_insn_off(&u);
            btox(&dsd[offset], len, hex);
            printf("\t%-16s: %s\n", hex, ud_insn_asm(&u));
        }
        printf("\n");

    }
#else
    #define disass
#endif

int main(int argc, char **argv)
{
    uint8_t *mem;

    disass(dsd, sizeof(dsd));

    printf("[*] allocating page aligned memory\n");
    mem = memalign(4096, 4096);
    if (!mem) {
        printf("[-] error: %s\n", strerror(errno));
        return 1;
    }
    memset(mem, 0, 4096);

    printf("[*] setting page permissions\n");
    if (mprotect(mem, 4096, PROT_READ | PROT_WRITE | PROT_EXEC)) {
        printf("[-] error: %s\n", strerror(errno));
        return 1;
    }

    printf("[*] copying payload\n");
    memcpy(mem, dsd, sizeof(dsd));

    printf("[*] patching payload\n");
    memcpy(mem + sizeof(dsd) -1, dump_mem, sizeof(dump_mem));

    printf("[*] executing payload..\n\n");
    ((int(*)(void))mem)();

    return 0;
}