32 lines
1.2 KiB
C
32 lines
1.2 KiB
C
// Test fixture: a deliberate stack buffer overflow for fold's binary P-Code
|
|
// pipeline (BOF detection -> ROP gadget discovery -> chain synthesis).
|
|
//
|
|
// `vuln` copies attacker-controlled input into a fixed 64-byte stack buffer via
|
|
// strcpy (a recognized unbounded sink) with no length check -> stack overflow.
|
|
// Built dynamically so the image stays small (a handful of functions -> the
|
|
// per-function symbolic scan is fast) while strcpy/execve resolve to recognized
|
|
// PLT imports the detector models.
|
|
//
|
|
// Built once with zig cc and committed as bof_x64 / bof_arm64 (see README.md).
|
|
// fold scans these statically (r2 + SLEIGH); they are never executed.
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
__attribute__((noinline)) void vuln(const char *src) {
|
|
char buf[64];
|
|
strcpy(buf, src); // no bound vs sizeof(buf) -> stack buffer overflow
|
|
write(1, buf, sizeof(buf));
|
|
}
|
|
|
|
// A "win" target so chain synthesis has a callable shell primitive to consider.
|
|
__attribute__((noinline)) void win(void) {
|
|
char *argv[] = {(char *)"/bin/sh", 0};
|
|
execve("/bin/sh", argv, 0);
|
|
}
|
|
|
|
int main(int argc, char **argv) {
|
|
if (argc > 1) {
|
|
vuln(argv[1]);
|
|
}
|
|
return 0;
|
|
}
|