no problem, it can be a good occasion to make practice and learning it.
indeed if you have full power in the building of a file format (or a protocol which is exactly the same thing in programming) you can find more vulnerabilities, easier and moreover knowing perfectly where is located a bug in case of doubts.
the only requirements are:
- a documentation of the format reporting all its fields, so endianes of the numeric fields which can be of 8, 16, 32 or even 64 bits, string fields, data fields (numeric fields which specify the size followed by the data), bitstrings or bit fields, compressions and so on
- the usage of functions which help in this job
the second point is very important because building a file format using structures or memcpy/fwrite for each field is a pain and terribly confusing for both the author and who reads the code.
personally I like a lot to use functions that do this job and handle even the endianess, maybe you have noticed them in my PoCs.
the following is a partial list of those for doing operations with a memory buffer and a pointer automatically incremented:
Code:
// useful for filling memory with NOPs, 'A's, zeroes and so on
int putcc(unsigned char *data, int chr, int len) {
memset(data, chr, len);
return(len);
}
// for copying data from a buffer to the one on which we are working
int putmm(unsigned char *data, unsigned char *str, int len) {
memcpy(data, str, len);
return(len);
}
// for copying a string
int putss(unsigned char *data, unsigned char *str) {
int len;
len = strlen(str);
memcpy(data, str, len);
return(len);
}
// for storing a number of 8, 16 or 32 bits in little endian
int putxx(unsigned char *data, unsigned int num, int bits) {
int i,
bytes;
bytes = bits >> 3;
for(i = 0; i < bytes; i++) {
data[i] = (num >> (i << 3));
}
return(bytes);
}
example:
int buff_size;
char *p;
char buff[4000];
p = buff;
p += putxx(p, 123, 8);
p += putxx(p, 1234, 16);
p += putxx(p, 12345678, 32);
p += putss(p, "I'm a string");
p += putcc(p, 0x90, 100);
p += putmm(p, shellcode, sizeof(shellcode));
buff_size = p - buff;
I hope it helps or helps someone else interested to these things
