spot-the-bug/stream-ciphers/client.c

#include <stdio.h>
#include <string.h>
#include <sys/random.h>

#include "epic_drm.h"

#define log(what) printf("[client] " what "\n")
#define logf(what, ...) printf("[client] " what "\n", __VA_ARGS__)

// this code is untrusted
// but don't worry, Epic DRM(tm) protections are unbreakable

void* get_cmd(struct command_channel* chan) {
    // get the protected shell command from the DRM server
    void* dst = malloc(sizeof(chan->data));

    log("sending get_cmd");
    chan->command = GET_CMD;
    sem_post(&chan->sem_c2s);
    sem_wait(&chan->sem_s2c);
    logf("result: %s", chan->command == SUCCESS ? "success" : "error");
    if (chan->command == SUCCESS) {
        memcpy(dst, &chan->data, sizeof(chan->data));
        return dst;
    } else {
        return NULL;
    }
}

void send_cmd(struct command_channel* chan, void* data) {
    // send a protected shell command back to the server
    log("sending execute_cmd");
    memcpy(&chan->data, data, sizeof(chan->data));

    chan->command = EXECUTE_CMD;
    sem_post(&chan->sem_c2s);
    sem_wait(&chan->sem_s2c);
    logf("result: %s", chan->command == SUCCESS ? "success" : "error");
}

int main() {
    // perform a basic interaction with epic_drm
    log("opening drm");
    int shm = shm_open(SHM_NAME, O_RDWR, 0);
    struct command_channel* chan = mmap(NULL, SHM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, shm, 0);

    // get protected shell command
    void* data = get_cmd(chan);
    log("data");
    for (size_t i = 0; i < 64; i++) {
        uint8_t b = ((uint8_t*)data)[i];
        printf("%02x ", b);
        if (i % 16 == 15) {
            printf("\n");
        }
    }
    printf("...\n");

    // send back
    send_cmd(chan, data);

    log("done");
}