From 4a6c57b1130fb2edea9ec71f2efb4468a4ee10b6 Mon Sep 17 00:00:00 2001
From: JoYo <rndpwn+bitbucket@gmail.com>
Date: Wed, 13 Jan 2016 22:59:23 +0000
Subject: [PATCH] mmap for memory allocation, mutation successful

---
 pic-linux.c          | 113 +++++++++++++++++++++++--------------------
 waf-1.8.18 => waf.py |   0
 2 files changed, 60 insertions(+), 53 deletions(-)
 rename waf-1.8.18 => waf.py (100%)

diff --git a/pic-linux.c b/pic-linux.c
index 66251e7..0e16098 100644
--- a/pic-linux.c
+++ b/pic-linux.c
@@ -10,12 +10,11 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <openssl/sha.h>
-#include <openssl/bio.h>
-#include <openssl/evp.h>
-#include <openssl/buffer.h>
 
 #pragma comment(lib, "openssl/sha.lib")
 
+#define SHA_SUM_LENGTH (SHA_DIGEST_LENGTH + SHA_DIGEST_LENGTH + 1)
+
 void picProto(void *picAddr, size_t picSize, void *clonePtr, char *checksum) {
   void (*cloneFunc)(void *, size_t, char *) = clonePtr;
   cloneFunc(picAddr, picSize, checksum);
@@ -28,7 +27,9 @@ void clone(void *picAddr, size_t picSize, char *checksum) {
   srand(time(NULL));
 
   unsigned int picOffset = (rand() % (picSize + 1));
-  unsigned char picFlip = ((char *)picAddr)[picOffset] & (rand() % 1);
+  unsigned char picFlip = ((char *)picAddr)[picOffset] & (rand() % 2);
+
+  printf("%x\t%x\n", picOffset, picFlip);
 
   ((char *)picAddr)[picOffset] = picFlip;
 
@@ -61,57 +62,63 @@ CLONE_CLEANUP:
 
 int main(int argc, const char **argv) {
   auto retVal = EX_SOFTWARE;
-  char *fileInPath = argv[1];
+  char fileInPath[SHA_SUM_LENGTH];
+  char checksum[SHA_SUM_LENGTH];
 
-  FILE *fileInHandle = fopen(fileInPath, "rb");
-  if (NULL == fileInHandle) {
-    retVal = errno;
-    goto MAIN_CLEANUP;
+  strncpy(fileInPath, argv[1], SHA_SUM_LENGTH);
+
+  while (1) {
+
+    FILE *fileInHandle = fopen(fileInPath, "rb");
+    if (NULL == fileInHandle) {
+      retVal = errno;
+      goto MAIN_CLEANUP;
+    }
+
+    struct stat picStat;
+    retVal = fstat(fileno(fileInHandle), &picStat);
+    if (-1 == retVal) {
+      retVal = errno;
+      goto MAIN_CLEANUP;
+    }
+
+    void *picBuffer =
+        mmap(NULL, picStat.st_size, PROT_READ | PROT_WRITE | PROT_EXEC,
+             MAP_ANON | MAP_PRIVATE, -1, 0);
+    if (MAP_FAILED == picBuffer) {
+      retVal = errno;
+      goto MAIN_CLEANUP;
+    }
+
+    retVal = fread(picBuffer, 1, picStat.st_size, fileInHandle);
+    if (retVal != picStat.st_size) {
+      retVal = errno;
+      goto MAIN_CLEANUP;
+    }
+
+    if (NULL != fileInHandle) {
+      fclose(fileInHandle);
+      fileInHandle = NULL;
+    }
+
+    memset(checksum, 0, SHA_SUM_LENGTH);
+    void (*cloneFunc)(void *, size_t, char *) = clone;
+    void (*picFunc)(void *, size_t, void *, char *) = picBuffer;
+
+    picFunc(picBuffer, picStat.st_size, cloneFunc, checksum);
+
+    strncpy(fileInPath, checksum, SHA_SUM_LENGTH);
+
+    retVal = EX_OK;
+  MAIN_CLEANUP:
+    if (NULL != picBuffer) {
+      munmap(picBuffer, picStat.st_size);
+    }
+    if (NULL != fileInHandle) {
+      fclose(fileInHandle);
+      fileInHandle = NULL;
+    }
   }
 
-  struct stat picStat;
-  fstat(fileno(fileInHandle), &picStat);
-  if (-1 == picStat.st_size) {
-    retVal = errno;
-    goto MAIN_CLEANUP;
-  }
-
-  void *picBuffer = memalign(getpagesize(), picStat.st_size);
-  if (NULL == picBuffer) {
-    retVal = errno;
-    goto MAIN_CLEANUP;
-  }
-
-  retVal =
-      mprotect(picBuffer, picStat.st_size, PROT_READ | PROT_WRITE | PROT_EXEC);
-  if (0 != retVal) {
-    retVal = errno;
-    goto MAIN_CLEANUP;
-  }
-
-  retVal = fread(picBuffer, 1, picStat.st_size, fileInHandle);
-  if (retVal != picStat.st_size) {
-    retVal = errno;
-    goto MAIN_CLEANUP;
-  }
-
-  if (fileInHandle) {
-    fclose(fileInHandle);
-  }
-
-  char checksum[(SHA_DIGEST_LENGTH * 2) + 1];
-  void (*cloneFunc)(void *, size_t, char *) = clone;
-  void (*picFunc)(void *, size_t, void *, char *) = picBuffer;
-
-  picFunc(picBuffer, picStat.st_size, cloneFunc, &checksum);
-
-  retVal = EX_OK;
-MAIN_CLEANUP:
-  if (fileInHandle) {
-    fclose(fileInHandle);
-  }
-  if (picBuffer) {
-    free(picBuffer);
-  }
   return retVal;
 }
diff --git a/waf-1.8.18 b/waf.py
similarity index 100%
rename from waf-1.8.18
rename to waf.py