// File: sharmin-lalani[P]Port-knocking-Backdoor/knocker.c
// Function: main
int main(int argv, char** argc) {

	FILE *config_file; 
	int sockfd, n, serverlen;
	short unsigned int port_num;
	struct sockaddr_in serveraddr, srcaddr;

	// parse the config file   	
	config_file = fopen(argc[1],"r");
    	if(config_file == NULL) {
        	printf("Unable to open config file.\n");
		return -1;
    	}

	
    	/* socket: create the socket */
    	sockfd = socket(AF_INET, SOCK_DGRAM, 0);
    	if (sockfd < 0) {
        	printf("ERROR opening socket\n");
		return -1;
	}

    	/* build the server's Internet address */
    	memset(&serveraddr, 0, sizeof(serveraddr));
    	serveraddr.sin_family = AF_INET;
	inet_aton(argc[2], &serveraddr.sin_addr);

	/* build the knocker's Internet address */
	memset(&srcaddr, 0, sizeof(srcaddr));
	srcaddr.sin_family = AF_INET;
	srcaddr.sin_addr.s_addr = htonl(INADDR_ANY);
    	srcaddr.sin_port = htons(22222);

	/* bind the client socket */
	if (bind(sockfd, (struct sockaddr *) &srcaddr, sizeof(srcaddr)) < 0)
		printf("ERROR in bind\n");

	serverlen = sizeof(serveraddr);

	while (fscanf(config_file, "%hu", &port_num) == 1) {
		//printf("%d\n", port_num);		

		serveraddr.sin_port = htons(port_num);
    		/* send the message to the server */
    		n = sendto(sockfd, NULL, 0, 0, (const sockaddr*)&serveraddr, serverlen);
    		if (n < 0) 
      			printf("ERROR in sendto\n");
		//else
			//printf("packet successfully sent\n");
		sleep(0.1);    

	}
	fclose(config_file);
	return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x50, %rsp
movl $0x0, -0x4(%rbp)
movl %edi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq -0x10(%rbp), %rax
movq 0x8(%rax), %rdi
leaq 0xdef(%rip), %rsi       # 0x2004
callq 0x10d0
movq %rax, -0x18(%rbp)
cmpq $0x0, -0x18(%rbp)
jne 0x123f
leaq 0xdda(%rip), %rdi       # 0x2006
movb $0x0, %al
callq 0x1030
movl $0xffffffff, -0x4(%rbp) # imm = 0xFFFFFFFF
jmp 0x1365
movl $0x2, %esi
xorl %edx, %edx
movl %esi, %edi
callq 0x1070
movl %eax, -0x1c(%rbp)
cmpl $0x0, -0x1c(%rbp)
jge 0x1270
leaq 0xdc6(%rip), %rdi       # 0x2023
movb $0x0, %al
callq 0x1030
movl $0xffffffff, -0x4(%rbp) # imm = 0xFFFFFFFF
jmp 0x1365
leaq -0x38(%rbp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1080
movw $0x2, -0x38(%rbp)
movq -0x10(%rbp), %rax
movq 0x10(%rax), %rdi
leaq -0x38(%rbp), %rsi
addq $0x4, %rsi
callq 0x1090
leaq -0x48(%rbp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1080
movw $0x2, -0x48(%rbp)
xorl %edi, %edi
callq 0x10b0
movl %eax, -0x44(%rbp)
movl $0x56ce, %edi           # imm = 0x56CE
callq 0x1040
movw %ax, -0x46(%rbp)
movl -0x1c(%rbp), %edi
leaq -0x48(%rbp), %rsi
movl $0x10, %edx
callq 0x1060
cmpl $0x0, %eax
jge 0x12ed
leaq 0xd53(%rip), %rdi       # 0x2039
movb $0x0, %al
callq 0x1030
movl $0x10, -0x24(%rbp)
movq -0x18(%rbp), %rdi
leaq 0xd49(%rip), %rsi       # 0x2048
leaq -0x26(%rbp), %rdx
movb $0x0, %al
callq 0x10e0
cmpl $0x1, %eax
jne 0x1355
movzwl -0x26(%rbp), %edi
callq 0x1040
movw %ax, -0x36(%rbp)
movl -0x1c(%rbp), %edi
movl -0x24(%rbp), %r9d
xorl %eax, %eax
movl %eax, %edx
xorl %ecx, %ecx
leaq -0x38(%rbp), %r8
movq %rdx, %rsi
callq 0x1050
movl %eax, -0x20(%rbp)
cmpl $0x0, -0x20(%rbp)
jge 0x134c
leaq 0xd07(%rip), %rdi       # 0x204c
movb $0x0, %al
callq 0x1030
xorl %edi, %edi
callq 0x10a0
jmp 0x12f4
movq -0x18(%rbp), %rdi
callq 0x10c0
movl $0x0, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x50, %rsp
popq %rbp
retq