Skip to content

Commit 57adeaa

Browse files
committed
Add Level 5 FlareOn2018
1 parent 1ee9b8a commit 57adeaa

File tree

6 files changed

+577
-0
lines changed

6 files changed

+577
-0
lines changed

flareon-2018/level5/README.md

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# FlareOn 2018 Level 5 Wasabi
2+
3+
Run a local file server:
4+
5+
```
6+
python -m SimpleHTTPServer 6767
7+
```
8+
9+
Throw a fake string to the server and watch the output come out in the console log
10+
11+
```
12+
http://127.0.0.1:6767/?q=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
13+
```
14+
15+
```
16+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 119 " second =" 65 "result =" 0
17+
log-all.js:12 w
18+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 97 " second =" 65 "result =" 0
19+
log-all.js:12 wa
20+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 115 " second =" 65 "result =" 0
21+
log-all.js:12 was
22+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 109 " second =" 65 "result =" 0
23+
log-all.js:12 wasm
24+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 95 " second =" 65 "result =" 0
25+
log-all.js:12 wasm_
26+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 114 " second =" 65 "result =" 0
27+
log-all.js:12 wasm_r
28+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 117 " second =" 65 "result =" 0
29+
log-all.js:12 wasm_ru
30+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 108 " second =" 65 "result =" 0
31+
log-all.js:12 wasm_rul
32+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 101 " second =" 65 "result =" 0
33+
log-all.js:12 wasm_rule
34+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 122 " second =" 65 "result =" 0
35+
log-all.js:12 wasm_rulez
36+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 95 " second =" 65 "result =" 0
37+
log-all.js:12 wasm_rulez_
38+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 106 " second =" 65 "result =" 0
39+
log-all.js:12 wasm_rulez_j
40+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 115 " second =" 65 "result =" 0
41+
log-all.js:12 wasm_rulez_js
42+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 95 " second =" 65 "result =" 0
43+
log-all.js:12 wasm_rulez_js_
44+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 100 " second =" 65 "result =" 0
45+
log-all.js:12 wasm_rulez_js_d
46+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 114 " second =" 65 "result =" 0
47+
log-all.js:12 wasm_rulez_js_dr
48+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 111 " second =" 65 "result =" 0
49+
log-all.js:12 wasm_rulez_js_dro
50+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 111 " second =" 65 "result =" 0
51+
log-all.js:12 wasm_rulez_js_droo
52+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 108 " second =" 65 "result =" 0
53+
log-all.js:12 wasm_rulez_js_drool
54+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 122 " second =" 65 "result =" 0
55+
log-all.js:12 wasm_rulez_js_droolz
56+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 64 " second =" 65 "result =" 0
57+
log-all.js:12 wasm_rulez_js_droolz@
58+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 102 " second =" 65 "result =" 0
59+
log-all.js:12 wasm_rulez_js_droolz@f
60+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 108 " second =" 65 "result =" 0
61+
log-all.js:12 wasm_rulez_js_droolz@fl
62+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 97 " second =" 65 "result =" 0
63+
log-all.js:12 wasm_rulez_js_droolz@fla
64+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 114 " second =" 65 "result =" 0
65+
log-all.js:12 wasm_rulez_js_droolz@flar
66+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 101 " second =" 65 "result =" 0
67+
log-all.js:12 wasm_rulez_js_droolz@flare
68+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 45 " second =" 65 "result =" 0
69+
log-all.js:12 wasm_rulez_js_droolz@flare-
70+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 111 " second =" 65 "result =" 0
71+
log-all.js:12 wasm_rulez_js_droolz@flare-o
72+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 110 " second =" 65 "result =" 0
73+
log-all.js:12 wasm_rulez_js_droolz@flare-on
74+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 46 " second =" 65 "result =" 0
75+
log-all.js:12 wasm_rulez_js_droolz@flare-on.
76+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 99 " second =" 65 "result =" 0
77+
log-all.js:12 [email protected]
78+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 111 " second =" 65 "result =" 0
79+
log-all.js:12 [email protected]
80+
log-all.js:11 {func: 47, instr: 2099} "i32.eq" "first =" 109 " second =" 65 "result =" 0
81+
log-all.js:12 [email protected]
82+
```

flareon-2018/level5/index.html

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset='utf-8'>
5+
<style>
6+
</style>
7+
</head>
8+
<body>
9+
<span id="container"></span>
10+
<script src="./main.js"></script>
11+
<script src="./test.wasabi.js"></script>
12+
<script src="./log-all.js"></script>
13+
</body>
14+
</html>

flareon-2018/level5/log-all.js

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
/*
2+
* User-facing API for dynamic analyses.
3+
*/
4+
5+
result = ''
6+
7+
Wasabi.analysis = {
8+
binary(location, op, first, second, r) {
9+
if (op == 'i32.eq' && location['func'] == 47) {
10+
result += String.fromCharCode(first);
11+
console.log(location, op, "first =", first, " second =", second, "result =", r);
12+
console.log(result);
13+
}
14+
}
15+
};

flareon-2018/level5/main.js

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
let instance = null;
2+
let wasm_stdout = "";
3+
let memoryStates = new WeakMap();
4+
5+
/**
6+
* ref: https://stackoverflow.com/a/901144/87207
7+
*/
8+
function getParameterByName(name, url) {
9+
if (!url) url = window.location.href;
10+
name = name.replace(/[\[\]]/g, "\\$&");
11+
var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"),
12+
results = regex.exec(url);
13+
if (!results) return null;
14+
if (!results[2]) return '';
15+
return decodeURIComponent(results[2].replace(/\+/g, " "));
16+
}
17+
18+
function syscall(instance, n, args) {
19+
switch (n) {
20+
default:
21+
console.log("Syscall " + n + " NYI.");
22+
break;
23+
case /* brk */ 45: return 0;
24+
case /* writev */ 146:
25+
return instance.exports.writev_c(args[0], args[1], args[2]);
26+
case /* mmap2 */ 192:
27+
//debugger;
28+
const memory = instance.exports.memory;
29+
let memoryState = memoryStates.get(instance);
30+
const requested = args[1];
31+
if (!memoryState) {
32+
memoryState = {
33+
object: memory,
34+
currentPosition: memory.buffer.byteLength,
35+
};
36+
memoryStates.set(instance, memoryState);
37+
}
38+
let cur = memoryState.currentPosition;
39+
if (cur + requested > memory.buffer.byteLength) {
40+
const need = Math.ceil((cur + requested - memory.buffer.byteLength) / 65536);
41+
memory.grow(need);
42+
}
43+
memoryState.currentPosition += requested;
44+
return cur;
45+
}
46+
}
47+
48+
/**
49+
* allocate a region of the given size within the given WebAssembly instance.
50+
*/
51+
function wasm_alloc(instance, size) {
52+
return syscall(instance, /* mmap */ 192, [0, size]);
53+
}
54+
55+
/**
56+
* write the given data at the given address within the WebAssembly instance.
57+
*/
58+
function wasm_write(instance, address, buf) {
59+
const membuf = new Uint8Array(instance.exports.memory.buffer, address);
60+
61+
for (var i = 0; i < buf.byteLength; i++) {
62+
membuf[i] = buf[i];
63+
}
64+
return null;
65+
}
66+
67+
/**
68+
* read the given number of bytes from the given address within the given WebAssembly instance.
69+
*/
70+
function wasm_read(instance, address, size) {
71+
const membuf = new Uint8Array(instance.exports.memory.buffer);
72+
return membuf.slice(address, address + size);
73+
}
74+
75+
fetch("test.wasm").then(response =>
76+
response.arrayBuffer()
77+
).then(bytes =>
78+
WebAssembly.instantiate(bytes, {
79+
env: {
80+
/*
81+
* WASMCEPTION libc.a relies on the symbols for FPU,
82+
* but we don't really need them...
83+
**/
84+
__eqtf2: function() {},
85+
__multf3: function() {},
86+
__unordtf2: function() {},
87+
__addtf3: function() {},
88+
__eqtf2: function() {},
89+
__multf3: function() {},
90+
__subtf3: function() {},
91+
__netf2: function() {},
92+
__fixunstfsi: function() {},
93+
__floatunsitf: function() {},
94+
__fixtfsi: function() {},
95+
__floatsitf: function() {},
96+
__extenddftf2: function() {},
97+
98+
/* trampoline to our js syscall handlelr */
99+
__syscall0: function __syscall0(n) { return syscall(instance, n, []); },
100+
__syscall1: function __syscall1(n, a) { return syscall(instance, n, [a]); },
101+
__syscall2: function __syscall2(n, a, b) { return syscall(instance, n, [a, b]); },
102+
__syscall3: function __syscall3(n, a, b, c) { return syscall(instance, n, [a, b, c]); },
103+
__syscall4: function __syscall4(n, a, b, c, d) { return syscall(instance, n, [a, b, c, d]); },
104+
__syscall5: function __syscall5(n, a, b, c, d, e) { return syscall(instance, n, [a, b, c, d, e]); },
105+
__syscall6: function __syscall6(n, a, b, c, d, e, f) { return syscall(instance, n, [a, b, c, d, e, f]); },
106+
107+
putc_js: function (c) {
108+
c = String.fromCharCode(c);
109+
if (c == "\n") {
110+
console.log(wasm_stdout);
111+
wasm_stdout = "";
112+
} else {
113+
wasm_stdout += c;
114+
}
115+
}
116+
}
117+
})
118+
).then(results => {
119+
instance = results.instance;
120+
121+
let a = new Uint8Array([
122+
0xE4, 0x47, 0x30, 0x10, 0x61, 0x24, 0x52, 0x21, 0x86, 0x40, 0xAD, 0xC1, 0xA0, 0xB4, 0x50, 0x22, 0xD0, 0x75, 0x32, 0x48, 0x24, 0x86, 0xE3, 0x48, 0xA1, 0x85, 0x36, 0x6D, 0xCC, 0x33, 0x7B, 0x6E, 0x93, 0x7F, 0x73, 0x61, 0xA0, 0xF6, 0x86, 0xEA, 0x55, 0x48, 0x2A, 0xB3, 0xFF, 0x6F, 0x91, 0x90, 0xA1, 0x93, 0x70, 0x7A, 0x06, 0x2A, 0x6A, 0x66, 0x64, 0xCA, 0x94, 0x20, 0x4C, 0x10, 0x61, 0x53, 0x77, 0x72, 0x42, 0xE9, 0x8C, 0x30, 0x2D, 0xF3, 0x6F, 0x6F, 0xB1, 0x91, 0x65, 0x24, 0x0A, 0x14, 0x21, 0x42, 0xA3, 0xEF, 0x6F, 0x55, 0x97, 0xD6
123+
124+
//0xB6, 0xFF, 0x65, 0xC3, 0xED, 0x7E, 0xA4, 0x00,
125+
// 0x61, 0xD3, 0xFF, 0x72, 0x36, 0x02, 0x67, 0x91,
126+
//0xD2, 0xD5, 0xC8, 0xA7, 0xE0, 0x6E
127+
]);
128+
129+
let b = new Uint8Array(new TextEncoder().encode(getParameterByName("q")));
130+
131+
let pa = wasm_alloc(instance, 0x200);
132+
wasm_write(instance, pa, a);
133+
134+
let pb = wasm_alloc(instance, 0x200);
135+
wasm_write(instance, pb, b);
136+
137+
if (instance.exports.Match(pa, a.byteLength, pb, b.byteLength) == 1) {
138+
// PARTY POPPER
139+
document.getElementById("container").innerText = "🎉";
140+
} else {
141+
// PILE OF POO
142+
document.getElementById("container").innerText = "💩";
143+
}
144+
145+
// document.getElementById("answer_a").innerText = wasm_read(instance, pa, 0x200);
146+
// document.getElementById("answer_b").innerText = wasm_read(instance, pb, 0x200);
147+
148+
});

0 commit comments

Comments
 (0)