djhuevo
Joined: 10 Mar 2005
Posts: 47
|
 Posted: Thu May 19, 2005 11:52 am Post subject: sceBase64Decoder bug |
 |
|
sceBase64Decoder return the number of bytes sucefully decoded, you can send a bad formed base64 buffer to make the function return a minor number, only libhttp seems to use base64, I think the only form of send base64 stuff to an http client is with md5-sess.
| Code: | #include <stdio.h>
unsigned char tabla[256] = {
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3E, 0xFF, 0xFF, 0xFF, 0x3F,
0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0xFF, 0xFF, 0xFF, 0x00, 0xFF, 0xFF,
0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E,
0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};
int sceBaseDecoder(unsigned char *decbytes, unsigned char *encbuf, int length) {
char encbytes[4];
int count=0;
unsigned int decword;
if(length==0) return 0;
do {
if(encbuf[2]==0x3d) count--;
if(encbuf[3]==0x3d) count--;
encbytes[0]=tabla[encbuf[0]];
encbytes[1]=tabla[encbuf[1]];
encbytes[2]=tabla[encbuf[2]];
encbytes[3]=tabla[encbuf[3]];
if(encbytes[0]<0 || encbytes[1]<0 || encbytes[2]<0 || encbytes[3]<0) return -1;
decword=encbytes[0]<<18|encbytes[1]<<12|encbytes[2]<<6|encbytes[3];
decbytes[0]=decword>>16;
decbytes[1]=decword>>8;
decbytes[2]=decword;
encbuf+=4;
decbytes+=3;
count+=3;
length-=4;
} while(length>0);
decbytes[0]=0x00;
return count;
}
#define COMPORTAMIENTO_NORMAL
#ifdef COMPORTAMIENTO_NORMAL
unsigned char encstr[]="RWwgYXN1bnRvIGVzIHF1ZSBsYSBmdW5jaW9uIHNjZUJhc2U2NERlY29kZXIgcmV0b3JuYSAoZW4gdGVvcmlhKSBlbCBsYXJnbyBlbiBxdWUgcXVlZGEgZWwgc3RyaW5nIGRlY29kaWZpY2FkbywgcGVybyByZXZpc2FuZG8gZWwgY29kaWdvIGV4aXN0ZSB1bmEgZm9ybWEgcGFyYSBxdWUgcmV0b3JuZSB1biBudW1lcm8gbWVub3IgYWwgbGFyZ28gZGUgbG9zIGRhdG9zIHF1ZSBsbGVuYXJvbiBlbCBidWZmZXIsIGVudG9uY2VzIHRlbmVtb3MgcXVlIGVsIGJ1ZmZlciBlcyBtYXMgbGFyZ28gcXVlIGVsIG51bWVybyBxdWUgcmV0b3JuYSBsYSBmdW5jaW9uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uZXN0ZSBlcyB1biBleHBsb2l0IHF1ZSBtZSBwZXJtaXRlIGV4ZWN1dGFyIGVsZiBjYXNlcm9zIGVuIFBTUCA6cA==";
#else
unsigned char encstr[]="RW=gYX=1bn=vIG=zIH=1ZS=sYS=mdW=jaW=uIH=jZU=hc2=2NE=lY2=kZX=gcm=0b3=uYS=oZW=gdG=vcm=hKS=lbC=sYX=nby=lbi=xdW=gcX=lZG=gZW=gc3=yaW=nIG=lY2=kaW=pY2=kby=gcG=yby=yZX=pc2=uZG=gZW=gY2=kaW=vIG=4aX=0ZS=1bm=gZm=ybW=gcG=yYS=xdW=gcm=0b3=uZS=1bi=udW=lcm=gbW=ub3=gYW=gbG=yZ2=gZG=gbG=zIG=hdG=zIH=1ZS=sbG=uYX=vbi=lbC=idW=mZX=sIG=udG=uY2=zIH=lbm=tb3=gcX=lIG=sIG=1Zm=lci=lcy=tYX=gbG=yZ2=gcX=lIG=sIG=1bW=yby=xdW=gcm=0b3=uYS=sYS=mdW=jaW=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uLi=uZXN0ZSBlcyB1biBleHBsb2l0IHF1ZSBtZSBwZXJtaXRlIGV4ZWN1dGFyIGVsZiBjYXNlcm9zIGVuIFBTUCA6cA==";
#endif
unsigned char buf0[0x1000];
int main() {
printf("codificado: %d\ndecodificado (deberia ser esto, hasta esto -2): %d\nen la actualidad es: %d\n\n",sizeof(encstr)-1, (sizeof(encstr)+1)/4*3, sceBaseDecoder(buf0, encstr, sizeof(encstr)-1));
printf("base64 decodificado: %s\n", buf0);
return 0;
}
|
_________________
sobreviviendo en la tierra de los trolldev |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
