wwmd 0.2.20.3

data/lib/wwmd/viewstate/viewstate_from_xml.rb

@@ -0,0 +1,129 @@
+module WWMD
+  class ViewState
+# directly serialize into stack from received xml (the easy way)
+# this is pretty silly but it didn't take me very long so...
+
+    attr_reader :xmlstack
+
+    def get_sym(str)
+      str.split(":").last.gsub(/[A-Z]+/,'\1_\0').downcase[1..-1].gsub(/\Avs/,"").to_sym
+    end
+
+    def opcode(name,val)
+      sym = get_sym(name)
+      if sym == :value
+        ret = VIEWSTATE_TYPES.index(val.to_sym)
+      else
+        ret = VIEWSTATE_TYPES.index(sym)
+      end
+      ret
+    end
+
+    def serialize_hashtable(node)
+      tstack = ""
+      tstack << self.write_7bit_encoded_int(node['size'].to_i)
+      node.children.each do |c|
+        next if c.text?
+        raise "Invalid Hashtable: got #{c.name}" if not c.name == "Pair"
+      end
+      tstack
+    end
+
+    def decode_text(node)
+      case node['encoding']
+        when "urlencoded"
+          node.inner_text.unescape
+        when "quoted-printable"
+          node.inner_text.from_qp
+        when "base64"
+          node.inner_text.b64d
+        when "hexify"
+          node.inner_text.dehexify
+        else
+#          node.inner_text
+          node.inner_text.unescape # ZZZZ auto-unescape for fuzzing
+      end
+    end
+
+    def write_node(node)
+      return false if node.text?
+      tstack = ""
+      # this is a hack to get sparse_array to work
+      return false if ["Pair","Key","Value"].include?(node.name) # skip and fall through
+      if ["Index","Size","Elements"].include?(node.name)
+        @xmlstack << self.write_7bit_encoded_int(node.inner_text.to_i)
+        return false
+      end
+      if node.name == "Mac"
+        @xmlstack << decode_text(node)
+        return false
+      end
+      # end hack
+      flag = true # begin; sillyness; rescue => me; end
+      case get_sym(node.name)
+        when :pair, :triplet, :value, :sparse_array, :type, :string_formatted
+        when :int_enum, :known_color, :int32
+          tstack << self.write_7bit_encoded_int(node.inner_text.to_i)
+        when :int16
+          tstack << self.write_short(node.inner_text.to_i)
+        when :byte, :char, :indexed_string_ref
+          tstack << self.write_byte(node.inner_text.to_i)
+        when :color, :single
+          tstack << self.write_int32(node.inner_text.to_i)
+        when :double, :date_time
+          tstack << self.write_double(node.inner_text.to_i)
+        when :unit
+          tstack << self.write_double(node['dword'].to_i)
+          tstack << self.write_single(node['word'].to_i)
+        when :list, :string_array, :array
+          tstack << self.write_7bit_encoded_int(node['size'].to_i)
+        when :string, :indexed_string, :binary_serialized
+          flag = false if ([:string_array,:string_formatted].include?(get_sym(node.parent.name)))
+          # get encoding
+          str = decode_text(node)
+          tstack << self.write_7bit_encoded_int(str.size)
+          tstack << str
+        when :hashtable, :hybrid_dict
+          tstack << serialize_hashtable(node)
+        else
+          raise "Invalid Node:\n#{node.name}"
+      end
+
+      # [flag] is a hack to get around string_array and string_formatted emitting opcodes
+      @xmlstack << self.write_byte(opcode(node.name,node.inner_text)) if flag
+      if node.has_attribute?("typeref")
+        if node['typeref'].to_i == 0x2b
+          @xmlstack << self.serialize_type(node['typeref'].to_i,node['typeval'].to_i)
+        else
+          @xmlstack << self.serialize_type(node['typeref'].to_i,node['typeval'])
+        end
+      end
+      @xmlstack << tstack
+    end
+
+    def serialize_xml(node)
+      begin
+        write_node(node)
+      rescue => e
+        STDERR.puts "ERROR parsing node:\n#{node.to_s}"
+        raise e
+      end
+      node.children.each do |c|
+        serialize_xml(c)
+      end
+    end
+
+    def from_xml(xml)
+      @xmlstack = ""
+      doc = Nokogiri::XML.parse(xml)
+      root = doc.root
+      raise "Invalid ViewState Version" if not root.has_attribute?("version")
+      @xmlstack << root['version'].b64d
+      root.children.each do |c|
+        serialize_xml(c)
+      end
+      self.deserialize(@xmlstack.b64e)
+    end
+
+  end
+end

data/lib/wwmd/viewstate/viewstate_types.rb

@@ -0,0 +1,51 @@
+module WWMD
+#    private const byte Marker_Format = 0xff;
+#    private const byte Marker_Version_1 = 1;
+#    private const int StringTableSize = 0xff;
+
+  VIEWSTATE_MAGIC = ["\xff\x01"] unless defined?(VIEWSTATE_MAGIC)
+
+  VIEWSTATE_TYPES = {
+# System.Web.UI.LosFormatter
+# System.Web.UI.ObjectStateFormatter
+#   .DeserializeValue
+
+    0x00 => :debug,               ##X  debugging
+    0x01 => :int16,               #RX  private const byte Token_Int16 = 1;
+    0x02 => :int32,               #RX  private const byte Token_Int32 = 2;
+    0x03 => :byte,                #RX  private const byte Token_Byte = 3;
+    0x04 => :char,                #RX  private const byte Token_Char = 4;
+    0x05 => :string,              ##X  private const byte Token_String = 5;
+    0x06 => :date_time,           #RX  private const byte Token_DateTime = 6;
+    0x07 => :double,              #RX  private const byte Token_Double = 7;
+    0x08 => :single,              #RX  private const byte Token_Single = 8;
+    0x09 => :color,               ##X  private const byte Token_Color = 9;
+    0x0a => :known_color,         ##X  private const byte Token_KnownColor = 10;
+    0x0b => :int_enum,            ##X  private const byte Token_IntEnum = 11;
+    0x0c => :empty_color,         #VX  private const byte Token_EmptyColor = 12;
+    0x0f => :pair,                ##X  private const byte Token_Pair = 15;
+    0x10 => :triplet,             ##X  private const byte Token_Triplet = 0x10;
+    0x14 => :array,               ##X  private const byte Token_Array = 20;
+    0x15 => :string_array,        ##X  private const byte Token_StringArray = 0x15;
+    0x16 => :list,                ##X  private const byte Token_ArrayList = 0x16;
+    0x17 => :hashtable,           ##X  private const byte Token_Hashtable = 0x17
+    0x18 => :hybrid_dict,         ##X  private const byte Token_HybridDictionary = 0x18;
+    0x19 => :type,                ##X  private const byte Token_Type = 0x19;
+    0x1b => :unit,                ##X  private const byte Token_Unit = 0x1b;
+    0x1c => :empty_unit,          #VX  private const byte Token_EmptyUnit = 0x1c;
+    0x1e => :indexed_string,      ##X  private const byte Token_IndexedStringAdd = 30;
+    0x1f => :indexed_string_ref,  ##X  private const byte Token_IndexedString = 0x1f;
+    0x28 => :string_formatted,    ##X  private const byte Token_StringFormatted = 40;
+    0x29 => :typeref_add,         ##X  private const byte Token_TypeRefAdd = 0x29;
+    0x2a => :typeref_add_local,   ##X  private const byte Token_TypeRefAddLocal = 0x2a;
+    0x2b => :typeref,             ##X  private const byte Token_TypeRef = 0x2b;
+    0x32 => :binary_serialized,   ##X  private const byte Token_BinarySerialized = 50;
+    0x3c => :sparse_array,        ##X  private const byte Token_SparseArray = 60;
+    0x64 => :null,                #VX  private const byte Token_Null = 100;
+    0x65 => :empty_byte,          #VX  private const byte Token_EmptyString = 0x65;
+    0x66 => :zeroint32,           #VX  private const byte Token_ZeroInt32 = 0x66;
+    0x67 => :bool_true,           #VX  private const byte Token_True = 0x67;
+    0x68 => :bool_false,          #VX  private const byte Token_False = 0x68;
+  } unless defined?(VIEWSTATE_TYPES)
+
+end

data/lib/wwmd/viewstate/viewstate_utils.rb

@@ -0,0 +1,164 @@
+module WWMD
+  module ViewStateUtils
+
+    def putd(msg)
+      puts(msg) if self.debug
+    end
+
+    def slog(obj,msg=nil)
+      raise "No @value" if not obj.respond_to?(:value)
+      raise "No @size"  if not obj.respond_to?(:size)
+      return nil if !self.debug
+      putd "#{@stack.size.to_s(16).rjust(8,"0")} [0x#{obj.opcode.to_s(16)}] #{obj.class}: #{msg}"
+    end
+
+    def dlog(t,msg)
+      raise "null token passed to dlog()" if t.nil?
+      o = WWMD::VIEWSTATE_TYPES[t]
+      @obj_counts[o] ||= 0
+      @obj_counts[o] += 1
+      return nil if !self.debug
+      putd "#{self.last_offset} [0x#{t.to_s(16).rjust(2,"0")}] #{VIEWSTATE_TYPES[t]}: #{msg}"
+    end
+
+    def write_7bit_encoded_int(val)
+      s = ""
+      while (val >= 0x80) do
+        s << [val | 0x80].pack("C")
+        val = val >> 7
+      end
+      s << [val].pack("C")
+      return s
+    end
+
+    # why oh why did I have to go find this?
+    # System.IO.BinaryReader.Read7BitEncodedInt
+    def read_7bit_encoded_int(buf=nil)
+      l = 0  # length
+      s = 0  # shift
+      b = "" # byte
+      buf = buf.scan(/./m) if buf
+      begin
+        if not buf
+          b = self.read_int
+        else
+          b = buf.shift.unpack("C").first
+        end
+        l |= (b & 0x7f) << s
+        s += 7
+      end while ((b & 0x80) != 0)
+      return l
+    end
+
+    def read_string
+      len = read_7bit_encoded_int
+      starr = []
+      (1..len).each { |i| starr << @buf.read(1) }
+      return starr.to_s
+    end
+
+    def read(count)
+      @buf.read(count)
+    end
+
+    def read_int
+      @buf.read(1).unpack("C").first
+    end
+    alias_method :read_byte, :read_int
+
+    def write_int(val)
+      [val].pack("C")
+    end
+    alias_method :write_byte, :write_int
+
+    def read_short
+      self.read(2).unpack("S").first
+    end
+
+    def write_short(val)
+      [val].pack("n")
+    end
+
+    def read_int32
+      @buf.read(4).unpack("L").first
+    end
+    alias_method :read_single, :read_int32
+
+    def write_int32(val)
+      [val].pack("I")
+    end
+    alias_method :write_single, :write_int32
+
+    def read_double
+      @buf.read(8).unpack("Q").first
+    end
+
+    def write_double(val)
+      [val].pack("Q")
+    end
+
+    def magic?
+      @magic = [@buf.read(1),@buf.read(1)].join("")
+      VIEWSTATE_MAGIC.include?(@magic)
+    end
+
+    def read_raw_byte
+      @buf.read
+    end
+
+    def serialize_type(op,ref)
+      op_str = [op].pack("C")
+      s = op_str
+      case op
+        when VIEWSTATE_TYPES.index(:typeref)
+          s << write_7bit_encoded_int(ref)
+        when VIEWSTATE_TYPES.index(:typeref_add_local)
+          s << write_7bit_encoded_int(ref.size)
+          s << ref
+        when VIEWSTATE_TYPES.index(:typeref_add)
+          s << write_7bit_encoded_int(ref.size)
+          s << ref
+        else
+          raise "Invalid Type Error #{op.to_s(16)}"
+      end
+      return s
+    end
+
+    def deserialize_type(t=nil)
+      op = self.read_byte
+      case op
+        when VIEWSTATE_TYPES.index(:typeref)
+          type = read_7bit_encoded_int
+          return [op,type]
+        when VIEWSTATE_TYPES.index(:typeref_add_local)
+          name  = read_string
+          return [op,name]
+        when VIEWSTATE_TYPES.index(:typeref_add)
+          name  = read_string
+          return [op,name]
+        else
+          raise "Invalid Type Error 0x#{op.to_s(16)}"
+      end
+    end
+
+    def offset(cur=nil)
+        @buf.pos.to_s(16).rjust(8,"0")
+    end
+
+    def throw(t=nil)
+      puts t.class
+      STDERR.puts "==== Error at Type 0x#{t.to_s(16).rjust(2,"0")}"
+      STDERR.puts "offset: #{self.offset}"
+      STDERR.puts "left:   #{@buf.size}"
+      STDERR.puts @buf.read(32).hexdump
+    end
+
+    def next_type
+      b = @buf.pos
+      t = read_byte
+      @buf.pos = b
+      throw(t) if not VIEWSTATE_TYPES.include?(t)
+      VIEWSTATE_TYPES[t]
+    end
+  end
+end

data/lib/wwmd/viewstate/viewstate_yaml.rb

@@ -0,0 +1,25 @@
+class String
+# right now I have no idea why "\x0d\x0a" is getting munged in yaml transforms
+# something weird helped find by timur@.  double up "\r" before "\n" works
+# this might be mac specific and break on other platforms.  I don't care.
+# patch not for general use do not try this at home.
+  def to_yaml( opts = {} )
+    YAML::quick_emit( is_complex_yaml? ? object_id : nil, opts ) do |out|
+      if is_binary_data?
+        out.scalar( "tag:yaml.org,2002:binary", [self].pack("m"), :literal )
+      elsif ( self =~ /\r\n/ )
+#        out.scalar( "tag:yaml.org,2002:binary", [self].pack("m"), :literal )
+        out.scalar( taguri, self.gsub(/\r\n/,"\r\r\n"), :quote2 )
+      elsif to_yaml_properties.empty?
+        out.scalar( taguri, self, self =~ /^:/ ? :quote2 : to_yaml_style )
+      else
+        out.map( taguri, to_yaml_style ) do |map|
+          map.add( 'str', "#{self}" )
+          to_yaml_properties.each do |m|
+            map.add( m, instance_variable_get( m ) )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/wwmd/viewstate/vs_stubs.rb

@@ -0,0 +1,22 @@
+module WWMD::VSStubs; end
+require 'wwmd/viewstate/vs_stubs/vs_stub_helpers'
+require 'wwmd/viewstate/vs_stubs/vs_read_value'
+require 'wwmd/viewstate/vs_stubs/vs_read_types'
+require 'wwmd/viewstate/vs_stubs/vs_value'
+require 'wwmd/viewstate/vs_stubs/vs_array'
+require 'wwmd/viewstate/vs_stubs/vs_binary_serialized'
+require 'wwmd/viewstate/vs_stubs/vs_int_enum'
+require 'wwmd/viewstate/vs_stubs/vs_hashtable'
+require 'wwmd/viewstate/vs_stubs/vs_hybrid_dict'
+require 'wwmd/viewstate/vs_stubs/vs_list'
+require 'wwmd/viewstate/vs_stubs/vs_pair'
+require 'wwmd/viewstate/vs_stubs/vs_sparse_array'
+require 'wwmd/viewstate/vs_stubs/vs_string'
+require 'wwmd/viewstate/vs_stubs/vs_string_array'
+require 'wwmd/viewstate/vs_stubs/vs_string_formatted'
+require 'wwmd/viewstate/vs_stubs/vs_triplet'
+require 'wwmd/viewstate/vs_stubs/vs_type'
+require 'wwmd/viewstate/vs_stubs/vs_unit'
+require 'wwmd/viewstate/vs_stubs/vs_indexed_string'
+require 'wwmd/viewstate/vs_stubs/vs_indexed_string_ref'
+

data/lib/wwmd/viewstate/vs_stubs/vs_array.rb

@@ -0,0 +1,38 @@
+module WWMD
+  class VSStubs::VSArray
+    include VSStubHelpers
+
+    attr_accessor :value
+    attr_reader   :typeref
+    attr_reader   :typeval
+
+    def initialize(typeref,typeval)
+      @typeref = typeref
+      @typeval = typeval
+      @value = []
+    end
+
+    def add(obj)
+      @value << obj
+    end
+
+    def serialize
+      stack = super
+      stack << self.write_7bit_encoded_int(self.value.size)
+      self.value.each do |v|
+        stack << v.serialize
+      end
+      return stack
+    end
+
+    def to_xml
+      xml = super
+      xml.add_attribute("size", self.value.size.to_s)
+      self.value.each do |v|
+        xml.add_element(v.to_xml)
+      end
+      xml
+    end
+
+  end
+end

data/lib/wwmd/viewstate/vs_stubs/vs_binary_serialized.rb

@@ -0,0 +1,30 @@
+module WWMD
+  class VSStubs::VSBinarySerialized
+    include VSStubHelpers
+
+    attr_accessor :value
+
+    def initialize()
+      @value = ''
+    end
+
+    def set(str)
+      @value = str
+    end
+
+    def serialize
+      stack = super
+      stack << self.write_7bit_encoded_int(self.size)
+      stack << self.value
+      return stack
+    end
+
+    def to_xml
+      xml = super
+      xml.add_attribute("encoding","base64")
+      xml.add_text(self.value.b64e)
+      xml
+    end
+
+  end
+end