library/src/exploitation/Utilities/PHP/GadgetGenerators/BP-PHPGadgetGenerators.cc
// PHP gadget run time arguments are added during gadget definition.  They
// can be set directly by using this function.
PHP gadget run time arguments are added during gadget definition.  They
can be set directly by using this function.
PHP gadget run time arguments are added during gadget definition . They can be set directly by using this function .
BP_ERROR_T BP_PHPGadgetSetRuntimeArgument
(
	P_BP_PHP_GADGET        gadget,
	char                   *arg_php_symbol,
	unsigned char          *arg,
	size_t                 arg_size
)
{
	if(!gadget)
		return ERR_FAILURE;
	if(!gadget->arguments_n)
		return ERR_FAILURE;
	if(	!arg_php_symbol || !arg || !arg_size )
		return ERR_FAILURE;
	size_t sym_len = strnlen(arg_php_symbol, 512);
	if(!gadget->runtime_tq)
	{
		gadget->runtime_tq = BP_CreateLinkL("PHP Gadget Runtime Allocator", BP_TRUE);
	}
	size_t n = 0;
	for(; n < gadget->arguments_n; n++)
	{
		if(gadget->arguments[n].arg_php_symbol)
		{
			size_t arg_sym_len = bpstrlen(gadget->arguments[n].arg_php_symbol);
			if(arg_sym_len != sym_len)
				continue;
			if(memcmp(arg_php_symbol, gadget->arguments[n].arg_php_symbol, arg_sym_len) != 0)
				continue;
			if(gadget->arguments[n].arg)
				tq_free(gadget->runtime_tq, gadget->arguments[n].arg);
			gadget->arguments[n].arg = (unsigned char *) tq_calloc(gadget->runtime_tq, arg_size+1, 1, BPLN);
			memcpy(gadget->arguments[n].arg, arg, arg_size);
			gadget->arguments[n].size = arg_size;
			gadget->arguments[n].arg_has_been_set = BP_TRUE;
			return ERR_SUCCESS;
		}
	}
	return ERR_SUCCESS;
}
BP_ERROR_T BP_PHPGadgetSetRuntimeArgument ( P_BP_PHP_GADGET gadget , char * arg_php_symbol , unsigned char * arg , size_t arg_size ) { if ( ! gadget ) return ERR_FAILURE ; if ( ! gadget -> arguments_n ) return ERR_FAILURE ; if ( ! arg_php_symbol || ! arg || ! arg_size ) return ERR_FAILURE ; size_t sym_len = strnlen ( arg_php_symbol , 512 ) ; if ( ! gadget -> runtime_tq ) { gadget -> runtime_tq = BP_CreateLinkL ( " " , BP_TRUE ) ; } size_t n = 0 ; for ( ; n < gadget -> arguments_n ; n ++ ) { if ( gadget -> arguments [ n ] . arg_php_symbol ) { size_t arg_sym_len = bpstrlen ( gadget -> arguments [ n ] . arg_php_symbol ) ; if ( arg_sym_len != sym_len ) continue ; if ( memcmp ( arg_php_symbol , gadget -> arguments [ n ] . arg_php_symbol , arg_sym_len ) != 0 ) continue ; if ( gadget -> arguments [ n ] . arg ) tq_free ( gadget -> runtime_tq , gadget -> arguments [ n ] . arg ) ; gadget -> arguments [ n ] . arg = ( unsigned char * ) tq_calloc ( gadget -> runtime_tq , arg_size + 1 , 1 , BPLN ) ; memcpy ( gadget -> arguments [ n ] . arg , arg , arg_size ) ; gadget -> arguments [ n ] . size = arg_size ; gadget -> arguments [ n ] . arg_has_been_set = BP_TRUE ; return ERR_SUCCESS ; } } return ERR_SUCCESS ; }
PHP gadget run time arguments are added during gadget definition.
PHP gadget run time arguments are added during gadget definition .
// check php gadget // ensure gadget has parameters // check parameters for nulls // calculate symbol length // the gadget should already have a tail queue allocator set, if // for whatever reason, it is unset -- set it here. // linear check to see if we can find the argument in the gadget required // arguments list. // check that the argument has a valid symbol pointer // calculate symbol length // compare length to symbol length and continue if they are // not matching. // compare to see if symbol matches up // if the argument is already set, free it // copy data into argument // copy data into place // set argument size // set flag indicating that values have been set for this argument // since the argument has been set, we can now return // return indicating success