fix buffer overflow in itg2ac-util

diff --git a/assets/utilities/itg2-util/src/itg2-swiss-army-knife.c b/assets/utilities/itg2-util/src/itg2-swiss-army-knife.c
index 18310be..61016ea 100644 (file)
--- a/assets/utilities/itg2-util/src/itg2-swiss-army-knife.c
+++ b/assets/utilities/itg2-util/src/itg2-swiss-army-knife.c
@@ -18,29 +18,30 @@ int main(int argc, char **argv) {
                return 0;
        }
 
+       int option_index = 0;
        while (1) {
                static struct option long_options[] = {
                        {"data", no_argument, 0, 'x'},
                        {"patch", no_argument, 0, 'p'},
                        {"decrypt", no_argument, 0, 'd'},
                        {"static", required_argument, 0, 's'},
-                       {"source", required_argument, 0, 'f'},
-                       {"dest",  required_argument, 0, 'w'},
+                       /*{"source", required_argument, 0, 'i'},
+                       {"dest",  required_argument, 0, 'o'},*/
                        {0, 0, 0, 0}
                };
 
-               int option_index = 0;
-
-               c = getopt_long(argc, argv, "xpds:f:w:", long_options, &option_index);
+               c = getopt_long(argc, argv, "xpds:", long_options, &option_index);
+               option_index++;
                if (c == -1) break;
 
                switch(c) {
                case 0:
-                       if (!strcmp(long_options[option_index].name,"source") && optarg) {
+                       /*if (!strcmp(long_options[option_index].name,"source") && optarg) {
                                openFile = optarg;
                        } else if (!strcmp(long_options[option_index].name,"dest") && optarg) {
                                destFile = optarg;
-                       } else if (!strcmp(long_options[option_index].name,"data")) {
+                       } else */
+                       if (!strcmp(long_options[option_index].name,"data")) {
                                type = KEYDUMP_ITG2_FILE_DATA;
                        } else if (!strcmp(long_options[option_index].name,"patch")) {
                                type = KEYDUMP_ITG2_FILE_PATCH;
@@ -69,27 +70,37 @@ int main(int argc, char **argv) {
                        keyFile = optarg;
                        break;
 
-               case 'f':
+/*
+               case 'i':
                        openFile = optarg;
                        break;
 
-               case 'w':
+               case 'o':
                        destFile = optarg;
                        break;
+*/
 
                default:
                        return -1;
                }
        }
 
+       if ( option_index+2 > argc ) {
+               printHelp(argv[0]);
+               return 0;
+       }
+
+       openFile = argv[option_index];
+       destFile = argv[option_index+1];
+
        // sanity checks
        if (openFile == NULL) {
-               printf("please specify a source file with -f (--source)\n");
+               printf("please specify a source file\n");
                printHelp(argv[0]);
                return 0;
        }
        if (destFile == NULL) {
-               printf("please specify a destination file with -w (--dest)\n");
+               printf("please specify a destination file\n");
                printHelp(argv[0]);
                return 0;
        }
@@ -102,7 +113,7 @@ int main(int argc, char **argv) {
        if (direction == 0) {
                int i;
                for (i = 0; i < 1024; i++)
-                       subkey[i] = rand() * 255;
+                       subkey[i] = (unsigned char)rand() * 255;
 
                if (keydump_itg2_retrieve_aes_key(subkey, 1024, aesKey, type, keyFile) == -1) {
                        fprintf(stderr, "%s: could not retrieve AES key, exiting...\n", argv[0]);
@@ -127,8 +138,8 @@ int main(int argc, char **argv) {
 void printHelp( const char *argv0 ) {
        printf("Usage: %s -f <source file> -w <dest file> [extra args]\n", argv0);
        printf("\t--decrypt (-d)\tDecrypt mode\n\n");
-       printf("\t--source (-f)\tSource File (required argument)\n");
-       printf("\t--dest (-w)\tDestination File (required argument)\n\n");
+       //printf("\t--source (-f)\tSource File (required argument)\n");
+       //printf("\t--dest (-w)\tDestination File (required argument)\n\n");
        printf("\t--data (-f)\tTreat source file as data file (default)\n");
        printf("\t--patch (-p)\tTreat source file as patch file\n");
        printf("\t--static (-s)\tStatic Encryption/Decryption: AES key is in a separate file (required argument as key file)\n\n");

diff --git a/assets/utilities/itg2-util/src/itg2util.c b/assets/utilities/itg2-util/src/itg2util.c
index 882fdc7..c0de3c2 100644 (file)
--- a/assets/utilities/itg2-util/src/itg2util.c
+++ b/assets/utilities/itg2-util/src/itg2util.c
@@ -1,3 +1,4 @@
+#include <stdlib.h>
 #include <stdio.h>
 #include <gcrypt.h>
 #include "keydump.h"
@@ -11,7 +12,7 @@ int keydump_itg2_encrypt_file(const char *srcFile, const char *destFile, const u
        unsigned int numcrypts, got, fileSize;
        int i,j;
        aes_encrypt_ctx ctx[1];
-       unsigned char encbuf[4080], decbuf[4080], backbuffer[16], verifyBlock[16], *plaintext = ":Dc09infamouspat";
+       unsigned char encbuf[4080], decbuf[4080], backbuffer[16], verifyBlock[16], *plaintext = ":DSPIGWITMERDIKS";
 
        aes_encrypt_key(aesKey, 24, ctx);
 
@@ -35,6 +36,7 @@ int keydump_itg2_encrypt_file(const char *srcFile, const char *destFile, const u
        fwrite(&subkeySize, 1, 4, dfd);
        fwrite(subkey, 1, subkeySize, dfd);
        fwrite(verifyBlock, 1, 16, dfd);
+       printf("verifyBlock: %02X %02X %02X %02X\n", verifyBlock[0], verifyBlock[1], verifyBlock[2], verifyBlock[3]);
 
        do {
                if ((got = fread(decbuf, 1, 4080, fd)) == -1) {
@@ -79,17 +81,19 @@ int keydump_itg2_decrypt_file(const char *srcFile, const char *destFile, int typ
                return -1;
        }
 
-       fread(magic, 2, 1, fd);
+       fread(magic, 1, 2, fd);
        if ( strncmp(magic, ITG2FileMagic[type], 2) ) {
                fprintf(stderr, "%s: source file is not an ITG2 %s zip\n",  __FUNCTION__, ITG2FileDesc[type]);
                fclose(fd);
                return -1;
        }
-       fread(&fileSize, 4, 1, fd);
-       fread(&subkeySize, 4, 1, fd);
+       fread(&fileSize, 1, 4, fd);
+       fread(&subkeySize, 1, 4, fd);
        subkey = (unsigned char*)malloc(subkeySize * sizeof(unsigned char));
-       fread(subkey, 1, subkeySize, fd);
-       fread(verifyBlock, 16, 1, fd);
+       got = fread(subkey, 1, subkeySize, fd);
+       printf("got: %d\n",got);
+       printf("first 4 bytes of subkey: %02x %02x %02x %02x\n", subkey[0], subkey[1], subkey[2], subkey[3]);
+       fread(verifyBlock, 1, 16, fd);
 
        if ( keydump_itg2_retrieve_aes_key(subkey, subkeySize, aesKey, type, keyFile) == -1 ) {
                fprintf(stderr, "%s: could not retrieve AES key\n", __FUNCTION__);
@@ -106,9 +110,6 @@ int keydump_itg2_decrypt_file(const char *srcFile, const char *destFile, int typ
                return -1;
        }
 
-       printKey(aesKey);
-       printbuffer("verifyBlock",verifyBlock);
-       printbuffer("plaintext",plaintext);
 
        if ((dfd = fopen(destFile, "wb")) == NULL) {
                fprintf(stderr, "%s: fopen(%s) failed D=\n", __FUNCTION__, destFile);
@@ -152,7 +153,7 @@ int keydump_itg2_decrypt_file(const char *srcFile, const char *destFile, int typ
 
 int keydump_itg2_retrieve_aes_key(const unsigned char *subkey, const unsigned int subkeySize, unsigned char *out, int type, const char *keyFile) {
        FILE *kfd;
-       unsigned char *SHAworkspace;
+       unsigned char *SHAworkspace, *SHAout;
        
        switch (type) {
        case KEYDUMP_ITG2_FILE_DATA:
@@ -164,10 +165,12 @@ int keydump_itg2_retrieve_aes_key(const unsigned char *subkey, const unsigned in
 
        case KEYDUMP_ITG2_FILE_PATCH:
                SHAworkspace = (unsigned char*)malloc(sizeof(unsigned char) * (subkeySize+47));
+               SHAout = (unsigned char*)malloc(sizeof(unsigned char) * 64);
                memcpy(SHAworkspace, subkey, subkeySize);
                memcpy(SHAworkspace+subkeySize, ITG2SubkeySalt, 47);
-               gcry_md_hash_buffer(GCRY_MD_SHA512, out, SHAworkspace, subkeySize+47);
-               free(SHAworkspace);
+               gcry_md_hash_buffer(GCRY_MD_SHA512, SHAout, SHAworkspace, subkeySize+47);
+               memcpy(out, SHAout, 24);
+               free(SHAworkspace); free(SHAout);
                break;
 
        case KEYDUMP_ITG2_FILE_STATIC: