// ------------------------------------------------------- hack1.cpp begin



const size_t buffer_size = 16;
const size_t buffer_ret_offset = 8 ;
char*  buffer_data = "AAAABBBBCCCCDDD"; //"DEEEEFFFFGGGG";

void print_mem(unsigned char* mem, const int len, const int bytes_in_line = 8);
void stack_func(char* data);

// *******************************************************
itn main(int argc, char** argv)
{
	stack_func(buffer_data);
	return 0;
}

// *******************************************************
void stack_func(char* data)
{

	char buffer[buffer_size];  // Staticky vytvoreny buffer
	strcpy(buffer,data);
	print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);
	buffer[buffer_size+buffer_ret_offset+0] = 'A';
	buffer[buffer_size+buffer_ret_offset+1] = 'A';
	buffer[buffer_size+buffer_ret_offset+2] = 'A';
	buffer[buffer_size+buffer_ret_offset+3] = 'A';
	print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);
}

// *******************************************************
void print_mem(unsigned char* mem, const int len, const int bytes_in_line)
{
	printf("MEMORY DUMP BEGIN - 0x%p (%d Bytes)\n",mem, len);
	for(int i = 0; i < (len/bytes_in_line)+1; i++)  // Prizpusobene zpracovani po radcich
	{

		for(int j = 0; j < bytes_in_line && (i*bytes_in_line+j < len); j++)
		{
			int c = (int)mem[i*bytes_in_line+j];
			if(isprint(c))
			{
				printf("%c (0x%02X)  ",mem[i*bytes_in_line+j],mem[i*bytes_in_line+j]);
			}
			else
			{
				printf("%? (0x%02X)  ",mem[i*bytes_in_line+j]);
			}
			
		}
	}
	printf("\nMEMORY DUMP END\n");
}



// ------------------------------------------------------- hack1.cpp end









// Kod vygenerovany visual studiem pro debug verzi:
// -------------------------------------------------------
void stack_func(char* data)
{
		004138C0  push        ebp  
		004138C1  mov         ebp,esp 
		004138C3  sub         esp,0DCh 
		004138C9  push        ebx  
		004138CA  push        esi  
		004138CB  push        edi  
		004138CC  lea         edi,[ebp-0DCh] 
		004138D2  mov         ecx,37h 
		004138D7  mov         eax,0CCCCCCCCh 
		004138DC  rep stos    dword ptr es:[edi] 
		004138DE  mov         eax,dword ptr [___security_cookie (417004h)] 
		004138E3  xor         eax,ebp 
		004138E5  mov         dword ptr [ebp-4],eax 
	char buffer[buffer_size];  // Staticky vytvoreny buffer
	strcpy(buffer,data);
		004138E8  mov         eax,dword ptr [ebp+8] 
		004138EB  push        eax  
		004138EC  lea         ecx,[ebp-18h] 
		004138EF  push        ecx  
		004138F0  call        @ILT+170(_strcpy) (4110AFh) 
		004138F5  add         esp,8 
	print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);
		004138F8  push        8    
		004138FA  push        4    
		004138FC  lea         eax,[ebp] 
		004138FF  push        eax  
		00413900  call        print_mem (41110Eh) 
		00413905  add         esp,0Ch 
	buffer[buffer_size+buffer_ret_offset+0] = 'A';    // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka!
		00413908  mov         byte ptr [ebp],41h 
	buffer[buffer_size+buffer_ret_offset+1] = 'A';    // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka!
		0041390C  mov         byte ptr [ebp+1],41h 
	buffer[buffer_size+buffer_ret_offset+2] = 'A';    // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka!
		00413910  mov         byte ptr [ebp+2],41h 
	buffer[buffer_size+buffer_ret_offset+3] = 'A';    // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka!
		00413914  mov         byte ptr [ebp+3],41h 
	print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);
		00413918  push        8    
		0041391A  push        4    
		0041391C  lea         eax,[ebp] 
		0041391F  push        eax  
		00413920  call        print_mem (41110Eh) 
		00413925  add         esp,0Ch 
}


// Vystup v konzoli - Je videt, ze k prepsani DOSLO!
MEMORY DUMP BEGIN - 0x0012FE90 (4 Bytes)
h (0x68)  ? (0xFF)  ? (0x12)  ? (0x00)
MEMORY DUMP END

MEMORY DUMP BEGIN - 0x0012FE90 (4 Bytes)
A (0x41)  A (0x41)  A (0x41)  A (0x41)
MEMORY DUMP END


// -------------------------------------------------------




//Kod vygenerovany visual studiem pro release verzi:
// ------------------------------------------------------- 
void stack_func(char* data)
{
		00401020  sub         esp,14h 
		00401023  mov         eax,dword ptr [___security_cookie (403000h)] 
		00401028  xor         eax,esp 
		0040102A  mov         dword ptr [esp+10h],eax 
	char buffer[buffer_size];  // Staticky vytvoreny buffer
	strcpy(buffer,data);
		0040102E  xor         eax,eax 
		00401030  mov         cl,byte ptr string "AAAABBBBCCCCDDD" (402104h)[eax] 
		00401036  mov         byte ptr [esp+eax],cl 
		00401039  add         eax,1 
		0040103C  test        cl,cl 
		0040103E  jne         stack_func+10h (401030h) 
	print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);
		00401040  lea         eax,[esp+18h] 
		00401044  push        4    
		00401046  push        eax  
		00401047  call        print_mem (4010C0h) 
	buffer[buffer_size+buffer_ret_offset+0] = 'A';  // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod!
	buffer[buffer_size+buffer_ret_offset+1] = 'A';  // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod!
	buffer[buffer_size+buffer_ret_offset+2] = 'A';  // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod!
	buffer[buffer_size+buffer_ret_offset+3] = 'A';  // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod!
	print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);
		0040104C  lea         ecx,[esp+20h] 
		00401050  push        4    
		00401052  push        ecx  
		00401053  call        print_mem (4010C0h) 
}


// Vystup v konzoli - Opet je videt, ze k prepsani NEDOSLO!
MEMORY DUMP BEGIN - 0x0012FF80 (4 Bytes)
5 (0x35)  ? (0x12)  @ (0x40)  ? (0x00)
MEMORY DUMP END

MEMORY DUMP BEGIN - 0x0012FF80 (4 Bytes)
5 (0x35)  ? (0x12)  @ (0x40)  ? (0x00)
MEMORY DUMP END


// -------------------------------------------------------