void FUN_00012a50(void)
{
......
  pid = fork();
  if (pid < 0) {  
    ......
    }
  }
  else {
    if (pid == 0) {
      prctl(0xf,"rftest",0,0,0);
      FUN_0001218c();
      exit(0);
    }
    ......
  }
......
}

/* WARNING: Restarted to delay deadcode elimination for space: ram */

void FUN_0001218c(void)

{
......
  sockaddr_in local_16c;

  local_2c = __stack_chk_guard;
  local_16c.sin_addr.s_addr = 0;
  local_16c.sin_zero[0] = '\0';
  local_16c.sin_zero[1] = '\0';
  local_16c.sin_zero[2] = '\0';
  local_16c.sin_zero[3] = '\0';
  local_16c.sin_zero[4] = '\0';
  local_16c.sin_zero[5] = '\0';
  local_16c.sin_zero[6] = '\0';
  local_16c.sin_zero[7] = '\0';
                    /* 端口小端存储，实际上是0x22b8=8888 */
  local_16c.sin_port = 0xb822;
  local_16c.sin_family = 2;
                    /* 创建socket */
  sock_fd = socket(2,1,0);
  if ((int)sock_fd < 0) {
    perror("create socket error!\n");
    puts("create socket error!");
  }
  else {
    puts("rftest socket create success!");
                    /* 绑定端口 */
    iVar3 = bind(sock_fd,(sockaddr *)&local_16c,0x10);
    if (iVar3 < 0) {
      printf("socket bind error! bind return value:%d \n");
    }
    else {
                    /* 监听端口 */
      iVar3 = listen(sock_fd,5);
      if (-1 < iVar3) {
......
                    /* 使用select处理连接 */
        iVar4 = select(sock_fd + 1,__readfds,(fd_set *)0x0,(fd_set *)0x0,(timeval *)0x0);
        if ((uVar1 & *(uint *)(local_15c + iVar3 * 4 + 0x30)) != 0) goto code_r0x000122e0;
        goto LAB_00012350;
      }
      printf("socket listen error! listen return value:%d \n");
    }
  }
......
                    /* 接受新的连接 */
  local_170 = 0x10;
  iVar9 = 0;
  DAT_00026858 = accept(sock_fd,(sockaddr *)&local_16c,&local_170);
  piVar8 = (int *)local_15c;
  while (-1 < *piVar8) {
    iVar9 = iVar9 + 1;
    piVar8 = piVar8 + 1;
    if (iVar9 == 0xc) {
      perror("too many clients");
      printf("too many clients");
                    /* WARNING: Subroutine does not return */
      exit(-1);
    }
  }
  *(int *)(local_15c + iVar9 * 4) = DAT_00026858;
  if (0 < iVar4) {
LAB_00012350:
    __pid = fork();
                    /* 使用多进程进行数据处理 */
    if (__pid == 0) {
      close(sock_fd);
      FUN_00011538(DAT_00026858);
      goto LAB_00012474;
    }
......
  }
  goto LAB_0001229c;
}

iVar6 = strncmp((char *)pbVar16,"wl",2);
......
        iVar6 = strncmp((char *)pbVar17,"nvram",5);
        if (iVar6 == 0) {
          pcVar9 = strstr((char *)(pbVar17 + 5),"get");
          if (pcVar9 == (char *)0x0) {
            FUN_00011138(local_102c);
          }
          else {
            pFVar10 = popen((char *)local_102c,"r");
            memset(acStack_2158,0,100);
            if (pFVar10 == (FILE *)0x0) {
              *__s = 0x2023;
              (&DAT_0002385a)[iVar1] = 0;
            }

char * FUN_0041af68(undefined4 param_1)

{
  undefined4 post_smb_admin_name;
  int post_smb_user;
  char *post_smb_enable;
  int smb_username;
  char acStack_3c [52];
  
  post_smb_user = FUN_00410e4c();
  if (post_smb_user == 0) {
    post_smb_admin_name = uci_safe_get("usbapps.config.smb_admin_name");
    // 此处存在命令注入
    _system("deluser %s",post_smb_admin_name);
    for (smb_username = 0; smb_username < 0x19; smb_username = smb_username + 1) {
      sprintf(acStack_3c,"usbapps.@smb[%d].username",smb_username);
      post_smb_user = uci_safe_get(acStack_3c);
      if (post_smb_user == 0) break;
      _system("smbpasswd -x %s",post_smb_user);
      _system("deluser %s",post_smb_user);
    }
    __post2nvram(param_1);
    system("uci commit usbapps");
    post_smb_enable = (char *)uci_safe_get("usbapps.config.smb_enable");
    post_smb_user = atoi(post_smb_enable);
    if (post_smb_user == 1) {
      system("/etc/init.d/samba enable");
      system("/etc/init.d/samba restart");
    }
    else {
      system("/etc/init.d/samba stop");
      system("/etc/init.d/samba disable");
      smb_username = 0;
      while( true ) {
        sprintf(acStack_3c,"samba.@sambashare[%d].name",smb_username);
        post_smb_enable = (char *)uci_safe_get(acStack_3c);
        if (*post_smb_enable == '\0') break;
        _system("uci delete samba.@sambashare[%d]",smb_username);
        smb_username = smb_username + 1;
      }
      system("uci commit samba");
    }
    sleep(1);
    uci_free();
    post_smb_enable = (char *)get_response_page();
  }
  else {
    make_back_msg("Read only user cannot save settings.");
    post_smb_enable = "error.asp";
  }
  return post_smb_enable;
}

undefined4 uh_cgi_request_with_ssc(int *param_1,astruct *script_struct,char *cgi_name,int param_4)

{
......
/* 重定向 */
  iVar1 = pipe(&local_8c);
  if ((iVar1 < 0) || (iVar1 = pipe(&local_94), iVar1 < 0)) {
    if (0 < local_8c) {
      close(local_8c);
    }
    if (0 < local_88) {
      close(local_88);
    }
    if (0 < local_94) {
      close(local_94);
    }
    if (0 < local_90) {
      close(local_90);
    }
......
  }
  /* 使用fork创建子进程 */
  _Var3 = fork();
  if (_Var3 == -1) {
    piVar2 = __errno_location();
    tmp_env_value = strerror(*piVar2);
    pcVar9 = "Failed to fork child: %s\n";
    goto ERROR_500;
  }
......
/* 设置相关环境变量 */ 
  clearenv();
  setenv("GATEWAY_INTERFACE","CGI/1.1",1);
  setenv("SERVER_SOFTWARE","uHTTPd",1);
  setenv("PATH","/sbin:/usr/sbin:/bin:/usr/bin",1);
  if (*param_1 != 0) {
    setenv("HTTPS","on",1);
  }
  piVar2 = param_1 + 0x4a2;
  tmp_env_value = (char *)sa_straddr(piVar2);
  setenv("SERVER_NAME",tmp_env_value,1);
  tmp_env_value = (char *)sa_straddr(piVar2);
  setenv("SERVER_ADDR",tmp_env_value,1);
  piVar10 = param_1 + 0x4a9;
  tmp_env_value = (char *)sa_strport(piVar2);
  setenv("SERVER_PORT",tmp_env_value,1);
  tmp_env_value = (char *)sa_straddr(piVar10);
  setenv("REMOTE_HOST",tmp_env_value,1);
  tmp_env_value = (char *)sa_straddr(piVar10);
  setenv("REMOTE_ADDR",tmp_env_value,1);
  tmp_env_value = (char *)sa_strport(piVar10);
  setenv("REMOTE_PORT",tmp_env_value,1);
  setenv("SCRIPT_NAME",script_struct->script_name,1);
  setenv("SCRIPT_FILENAME",script_struct->script_filename,1);
  setenv("DOCUMENT_ROOT",script_struct->document_root,1);
  tmp_env_value = script_struct->envs;
  if (tmp_env_value == (char *)0x0) {
    tmp_env_value = "";
  }
  setenv("QUERY_STRING",tmp_env_value,1);
  if (script_struct->field3_0xc != (char *)0x0) {
    setenv("PATH_INFO",script_struct->field3_0xc,1);
  }
  if (param_1[0x41d] == 0x194) {
    tmp_env_value = "404";
  }
  else {
    tmp_env_value = "200";
  }
  setenv("REDIRECT_STATUS",tmp_env_value,1);
  setenv("SERVER_PROTOCOL",*(char **)(http_versions + param_1[0x41c] * 4),1);
  setenv("REQUEST_METHOD",(&http_methods)[param_1[0x41b]],1);
  setenv("REQUEST_URI",(char *)param_1[0x41e],1);
  if (param_1[0x45f] != 0) {
    setenv("REMOTE_USER",(char *)(param_1[0x45f] + 0x1000),1);
  }
  ppcVar11 = (char **)(param_1 + 0x420);
  iVar1 = 0;
  do {
    local_30 = ppcVar11[-1];
    if (local_30 == (char *)0x0) break;
    iVar5 = strcasecmp(local_30,"Accept");
    if (iVar5 == 0) {
      tmp_env_value = "HTTP_ACCEPT";
LAB_00408ea8:
      setenv(tmp_env_value,*ppcVar11,1);
    }
    else {
      iVar5 = strcasecmp(local_30,"Accept-Charset");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_ACCEPT_CHARSET";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Accept-Encoding");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_ACCEPT_ENCODING";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Accept-Language");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_ACCEPT_LANGUAGE";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Authorization");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_AUTHORIZATION";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Connection");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_CONNECTION";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Cookie");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_COOKIE";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Host");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_HOST";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Referer");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_REFERER";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"User-Agent");
      if (iVar5 == 0) {
        tmp_env_value = "HTTP_USER_AGENT";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Content-Type");
      if (iVar5 == 0) {
        tmp_env_value = "CONTENT_TYPE";
        goto LAB_00408ea8;
      }
      iVar5 = strcasecmp(local_30,"Content-Length");
      if (iVar5 == 0) {
        tmp_env_value = "CONTENT_LENGTH";
        goto LAB_00408ea8;
      }
    }
    iVar1 = iVar1 + 2;
    ppcVar11 = ppcVar11 + 2;
  } while (iVar1 != 0x40);
......
/* 根据cgi_name传递参数调用execl */
  if (cgi_name == (char *)0x0) {
    execl(script_struct->script_filename,script_struct->script_filename,0);
    cgi_name = script_struct->script_filename;
  }
  else {
    memset(acStack_54,0,0x24);
    memset(acStack_78,0,0x24);
    tmp_env_value = getenv("SERVER_PORT");
    iVar1 = strcmp(tmp_env_value,"80");
    if (iVar1 == 0) {
      tmp_env_value = getenv("REQUEST_METHOD");
      iVar1 = strcmp(tmp_env_value,"POST");
      if ((iVar1 != 0) || (iVar1 = strcmp((char *)param_1[0x41e],"/test_mode.cgi"), iVar1 == 0))
      goto LAB_00408fac;
LAB_00409004:
      __stream = fopen("/tmp/csrf_hash","r");
      if (__stream == (FILE *)0x0) {
        iVar1 = strncmp((char *)param_1[0x41e],"/apply_sec.cgi",0xd);
LAB_00409154:
        if (iVar1 == 0) goto EXEC_SCRIPT;
      }
      else {
        fgets(acStack_78,0x24,__stream);
        sVar6 = strlen(acStack_78);
        acStack_78[sVar6 - 1] = '\0';
        fscanf(__stream,"%lld",&local_80);
        fclose(__stream);
        unlink("/tmp/csrf_hash");
        time((time_t *)&local_98);
        uVar4 = (uint)(local_98 < local_98 - local_80);
        uVar8 = ((int)local_98 >> 0x1f) - local_7c;
        if (((int)(uVar8 - uVar4) < 1) && ((uVar8 != uVar4 || (local_98 - local_80 < 0x12d)))) {
          tmp_env_value = getenv("QUERY_STRING");
          tmp_env_value = strstr(tmp_env_value,"csrf_token");
          if (tmp_env_value != (char *)0x0) {
            strncpy(acStack_54,tmp_env_value + 0xb,0x20);
            iVar1 = strcmp(acStack_54,acStack_78);
            goto LAB_00409154;
          }
        }
      }
......
EXEC_SCRIPT:
    if (param_4 == 0) {
      execl(cgi_name,cgi_name,script_struct->script_filename,0);
    }
    else {
......
      execl(cgi_name,cgi_name,"-n",script_struct->script_filename,0);
    }
  }
  exit(0);
}

int websUrlHandlerDefine(char_t *urlPrefix, char_t *webDir, int arg,
		int (*handler)(webs_t wp, char_t *urlPrefix, char_t *webdir, int arg, 
		char_t *url, char_t *path, char_t *query), int flags)

websUrlHandlerDefine(&byte_4AA6CC, 0, 0, websAuthHandler, 1);
websUrlHandlerDefine("/goform", 0, 0, websFormHandler, 0);
websUrlHandlerDefine("/cgi-bin", 0, 0, websCgiHandler, 0);
websUrlHandlerDefine("/reboot.asp", 0, 0, sub_464028, 0);
websUrlHandlerDefine("/reboot", 0, 0, sub_464028, 0);
websUrlHandlerDefine("/exception_log", 0, 0, sub_462850, 0);
websUrlHandlerDefine("/nat_log", 0, 0, sub_4628F8, 0);
websUrlHandlerDefine("/attributes_log", 0, 0, sub_4628F8, 0);
websUrlHandlerDefine("/dhcpcliinfo", 0, 0, sub_4628F8, 0);
websUrlHandlerDefine("/auto_ch", 0, 0, sub_4628F8, 0);
websUrlHandlerDefine("/auto_5G_ch", 0, 0, sub_4628F8, 0);

/* Fork a sub-process to handle the connection. */
r = fork();
   ...
if ( r == 0 )
    {
    /* Child process. */
       ...
    handle_request();       // 数据包处理逻辑
    }
   ...
}

/* Parse the first line of the request. */
method_str = get_request_line();
if ( method_str == (char*) 0 )
	send_error( 400, "Bad Request", "", "Can't parse request." );
path = strpbrk( method_str, " \t\012\015" );
if ( path == (char*) 0 )
	send_error( 400, "Bad Request", "", "Can't parse request." );
*path++ = '\0';
path += strspn( path, " \t\012\015" );
protocol = strpbrk( path, " \t\012\015" );
if ( protocol == (char*) 0 )
	send_error( 400, "Bad Request", "", "Can't parse request." );
*protocol++ = '\0';
protocol += strspn( protocol, " \t\012\015" );
query = strchr( path, '?' );
if ( query == (char*) 0 )
	query = "";
else
	*query++ = '\0';

   /* Parse the rest of the request headers. */
   while ( ( line = get_request_line() ) != (char*) 0 )
{
if ( line[0] == '\0' )
    break;
else if ( strncasecmp( line, "Authorization:", 14 ) == 0 )
    {
       ...
    }
else if ( strncasecmp( line, "Content-Length:", 15 ) == 0 )
    {
       ...
    }

if ( g_bypass_flag == 1 )
{
  if ( !sub_4062C0() )
  {
    system("/bin/echo genie from wan, drop request > /dev/console");
    exit(0);
  }
  result = system("/bin/echo genie from lan, ok > /dev/console");
}
else { 
......
}

else if (strncasecmp(line, "SOAPAction:", 11) == 0)
{
    char *pTemp = NULL;
    cp = &line[11];
    cp += strspn(cp, " \t");
    pTemp = strcasestr(cp, "urn:NETGEAR-ROUTER:service:");
    if (pTemp != NULL)
    {
        int i = 0;
        pTemp += strlen("urn:NETGEAR-ROUTER:service:");
        while (*pTemp != ':' && *pTemp != '\0')
        {
            soapServiceName[i++] = *pTemp;              // <-- Out-Of-Bounds Write
            pTemp++;
        }
    }
}

bool check_soap_login_record()
{
    ... 
    v1 = getenv("SOAP_LOGIN_TOKEN");
    ...
    if ( !v3 )
    {
    ...
        strcat((char *)v25, v1);
    ...

#include <stdio.h>
#include <fcntl.h>
int key1(){
        asm("mov r3, pc\n");
}
int key2(){
        asm(
        "push   {r6}\n"
        "add    r6, pc, $1\n"
        "bx     r6\n"
        ".code   16\n"
        "mov    r3, pc\n"
        "add    r3, $0x4\n"
        "push   {r3}\n"
        "pop    {pc}\n"
        ".code  32\n"
        "pop    {r6}\n"
        );
}
int key3(){
        asm("mov r3, lr\n");
}
int main(){
        int key=0;
        printf("Daddy has very strong arm! : ");
        scanf("%d", &key);
        if( (key1()+key2()+key3()) == key ){
                printf("Congratz!\n");
                int fd = open("flag", O_RDONLY);
                char buf[100];
                int r = read(fd, buf, 100);
                write(0, buf, r);
        }
        else{
                printf("I have strong leg :P\n");
        }
        return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>

int main(int argc, char* argv[], char* envp[]){
	printf("Welcome to pwnable.kr\n");
	printf("Let's see if you know how to give input to program\n");
	printf("Just give me correct inputs then you will get the flag :)\n");

	// argv
	if(argc != 100) return 0;
	if(strcmp(argv['A'],"\x00")) return 0;
	if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
	printf("Stage 1 clear!\n");

	// stdio
	char buf[4];
	read(0, buf, 4);
	if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
	read(2, buf, 4);
	if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
	printf("Stage 2 clear!\n");

	// env
	if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
	printf("Stage 3 clear!\n");

	// file
	FILE* fp = fopen("\x0a", "r");
	if(!fp) return 0;
	if( fread(buf, 4, 1, fp)!=1 ) return 0;
	if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
	fclose(fp);
	printf("Stage 4 clear!\n");

	// network
	int sd, cd;
	struct sockaddr_in saddr, caddr;
	sd = socket(AF_INET, SOCK_STREAM, 0);
	if(sd == -1){
			printf("socket error, tell admin\n");
			return 0;
	}
	saddr.sin_family = AF_INET;
	saddr.sin_addr.s_addr = INADDR_ANY;
	saddr.sin_port = htons( atoi(argv['C']) );
	if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
			printf("bind error, use another port\n");
			return 1;
	}
	listen(sd, 1);
	int c = sizeof(struct sockaddr_in);
	cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
	if(cd < 0){
			printf("accept error, tell admin\n");
			return 0;
	}
	if( recv(cd, buf, 4, 0) != 4 ) return 0;
	if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
	printf("Stage 5 clear!\n");

	// here's your flag
	system("/bin/cat flag");
	return 0;
}

// argv
if(argc != 100) return 0;
if(strcmp(argv['A'],"\x00")) return 0;
if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
printf("Stage 1 clear!\n");

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>

int main() {
	int i;
	char *args[101] = {};

	for (i = 0; i < 101; ++i)
			args[i] = "A";
	args['A'] = "\x00";
	args['B'] = "\x20\x0a\x0d";
	args[100] = NULL;
	execve("./input", args, NULL);
}

// stdio
char buf[4];
read(0, buf, 4);
if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
read(2, buf, 4);
if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
printf("Stage 2 clear!\n");

pid_t child_pid;
int pipe_stdin[2];
int pipe_stderr[2];

if (pipe(pipe_stdin) < 0 || pipe(pipe_stderr) < 0) {
	perror("error creating pipes\n");
	exit(1);
}

if ((child_pid = fork()) < 0) {
	perror("error forking child\n");
	exit(1);
}

if (child_pid == 0) {
	close(pipe_stdin[0]);
	close(pipe_stderr[0]);

	write(pipe_stdin[1], "\x00\x0a\x00\xff", 4);
	write(pipe_stderr[1], "\x00\xoa\x02\xff", 4);

	return 0;
} else {
	close(pipe_stdin[1]);
	close(pipe_stderr[1]);

	dup2(pipe_stdin[0], 0);
	dup2(pipe_stderr[0], 2);

	close(pipe_stdin[0]);
	close(pipe_stderr[0]);
	execve("./input", args, NULL);
}

// env
if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
printf("Stage 3 clear!\n");

setenv("\xde\xad\xbe\xef", "\xca\xfe\xba\xbe", 1);
extern char** environ;
......
execve("./input", args, environ);

// file
FILE* fp = fopen("\x0a", "r");
if(!fp) return 0;
if( fread(buf, 4, 1, fp)!=1 ) return 0;
if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
fclose(fp);
printf("Stage 4 clear!\n");

FILE* fp = fopen("\x0a", "w");
fwrite("\x00\x00\x00\x00", 4, 1, fp);
fclose(fp);

// network
int sd, cd;
struct sockaddr_in saddr, caddr;
sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd == -1){
    printf("socket error, tell admin\n");
    return 0;
}
saddr.sin_family = AF_INET;
saddr.sin_addr.s_addr = INADDR_ANY;
saddr.sin_port = htons( atoi(argv['C']) );
if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
    printf("bind error, use another port\n");
return 1;
}
listen(sd, 1);
int c = sizeof(struct sockaddr_in);
cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
if(cd < 0){
    printf("accept error, tell admin\n");
    return 0;
}
if( recv(cd, buf, 4, 0) != 4 ) return 0;
if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
printf("Stage 5 clear!\n");

args['C'] = "6666";

sleep(5); // 等待input创建好
int sd, cd;
struct sockaddr_in saddr;
sd = socket(AF_INET, SOCK_STREAM, 0);

if (sd == -1) {
	printf("error creating socket\n");
	return 1;
}

saddr.sin_family = AF_INET;
saddr.sin_addr.s_addr = inet_addr("127.0.0.1");
saddr.sin_port = htons(atoi(args['C']));

if (connect(sd, (struct sockaddr *)&saddr, sizeof(saddr)) < 0) {
	printf("error connecting\n");
	return 1;
}

write(sd, "\xde\xad\xbe\xef", 4);
close(sd);

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>

int main() {
	int i;
	char *args[101] = {};
	pid_t child_pid;
	int pipe_stdin[2];
	int pipe_stderr[2];

	extern char** environ;

	setenv("\xde\xad\xbe\xef", "\xca\xfe\xba\xbe", 1);

	for (i = 0; i < 101; ++i)
		args[i] = "A";
	
	args['A'] = "\x00";
	args['B'] = "\x20\x0a\x0d";
	args['C'] = "6666";
	args[100] = NULL;
	if (pipe(pipe_stdin) < 0 || pipe(pipe_stderr) < 0) {
		perror("error creating pipes\n");
		exit(1);
	}

	if ((child_pid = fork()) < 0) {
		perror("error forking child\n");
		exit(1);
	}

	if (child_pid == 0) {
		close(pipe_stdin[0]);
		close(pipe_stderr[0]);

		write(pipe_stdin[1], "\x00\x0a\x00\xff", 4);
		write(pipe_stderr[1], "\x00\x0a\x02\xff", 4);

		sleep(5); // 等待input创建好
		int sd, cd;
		struct sockaddr_in saddr;
		sd = socket(AF_INET, SOCK_STREAM, 0);

		if (sd == -1) {
			printf("error creating socket\n");
			return 1;
		}

		saddr.sin_family = AF_INET;
		saddr.sin_addr.s_addr = inet_addr("127.0.0.1");
		saddr.sin_port = htons(atoi(args['C']));

		if (connect(sd, (struct sockaddr *)&saddr, sizeof(saddr)) < 0) {
			printf("error connecting\n");
			return 1;
		}

		write(sd, "\xde\xad\xbe\xef", 4);
		close(sd);
		return 0;

	} else {
		close(pipe_stdin[1]);
		close(pipe_stderr[1]);

		dup2(pipe_stdin[0], 0);
		dup2(pipe_stderr[0], 2);

		close(pipe_stdin[0]);
		close(pipe_stderr[0]);

		FILE* fp = fopen("\x0a", "w");
		fwrite("\x00\x00\x00\x00", 4, 1, fp);
		fclose(fp);

		execve("/home/input2/input", args, environ);
	}
}

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main() {
    int i, n;
    srand(time(0)); // 设置随机数种子为当前时间

    printf("请输入要生成的随机数个数：");
    scanf("%d", &n);

    printf("随机数序列：");
    for (i = 0; i < n; i++) {
        printf("%d ", rand());
    }

    return 0;
}

#include <stdio.h>
#include <stdlib.h>

void login(){
	int passcode1;
	int passcode2;

	printf("enter passcode1 : ");
	scanf("%d", passcode1);
	fflush(stdin);

	// ha! mommy told me that 32bit is vulnerable to bruteforcing :)
	printf("enter passcode2 : ");
    scanf("%d", passcode2);

	printf("checking...\n");
	if(passcode1==338150 && passcode2==13371337){
        printf("Login OK!\n");
        system("/bin/cat flag");
    }
    else{
        printf("Login Failed!\n");
		exit(0);
    }
}

void welcome(){
	char name[100];
	printf("enter you name : ");
	scanf("%100s", name);
	printf("Welcome %s!\n", name);
}

int main(){
	printf("Toddler's Secure Login System 1.0 beta.\n");

	welcome();
	login();

	// something after login...
	printf("Now I can safely trust you that you have credential :)\n");
	return 0;
}