User Roles & Permissions

Creating Challenges

C Compiler

The emulator includes a built-in C compiler that translates C code into x86 assembly code compatible with the simulator. This allows you to write programs in C and see exactly how they compile to assembly.

How to Use the Compiler

1. Click the "Open C Compiler" button when creating or editing challenges
2. Write your C code in the left panel or choose from example programs.
3. Click "Compile" to generate x86 assembly code.
4. The generated assembly appears in the right panel.
5. Click "Insert Code" to use the assembly in your challenge.

Supported C Features

• Data Types: int, char, char*, void, structs
• Control Flow: if/else, while, for, do-while, break, continue, return
• Functions: Function definitions and calls with parameters, function pointers
• Arrays: Single-dimensional arrays of int and char
• Pointers: Address-of (&) and dereference (*) operators
• Structs: Structure definitions, member access (. and ->), nested structs
• Function Pointers: Declaration, assignment, and indirect function calls
• Operators: Arithmetic, comparison, logical, increment/decrement (++, --)
• Library Functions: printf, scanf, malloc, free, strcpy, strcmp, gets

Compiler Features

• Generates only instructions supported by the emulator
• Produces assembly in the emulator's format (.data and .text sections)
• Automatically handles calling conventions and stack management
• Supports both prefix and postfix increment/decrement operators
• Properly allocates stack space based on data types (1 byte for char, 4 bytes for int)
• Includes return path checking for non-void functions
• Control Flow Integrity (CFI): Optional protection against control flow hijacking attacks (enable via checkbox)

Example C Program

int main() {
    char name[20];
    printf("Enter your name: ");
    scanf("%s", name);
    printf("Hello, %s!\\n", name);
    
    int i;
    for (i = 0; i < 5; i++) {
        printf("Count: %d\\n", i);
    }
    
    return 0;
}

Tips for Using the Compiler

• The compiler enforces that all code paths in non-void functions have a return statement
• String literals in printf must use double backslashes (e.g., "Hello\\n")
• The gets function is available but marked as unsafe (just like in real systems)
• Array indexing and pointer arithmetic work as expected
• Local variables are allocated on the stack with proper alignment
• The compiler automatically generates the _start entry point that calls main

Working with Structs

The compiler supports C struct definitions and operations:

• Definition: struct Point { int x; int y; };
• Declaration: struct Point p; or struct Point *ptr;
• Member Access: p.x = 10; (dot operator) or ptr->x = 10; (arrow operator)
• Nested Structs: Structs can contain other structs as members
• Memory Layout: Members are laid out sequentially with proper offset calculation

struct Rectangle {
    struct Point top_left;
    struct Point bottom_right;
    int color;
};

struct Rectangle rect;
rect.top_left.x = 0;
rect.top_left.y = 0;
rect.color = 0xFF0000;

Using Function Pointers

Function pointers allow storing and calling functions indirectly:

• Declaration: int (*operation)(int, int); - pointer to function taking two ints, returning int
• Assignment: operation = add; - assign function address to pointer
• Indirect Call: result = operation(5, 3); - call function through pointer
• In Structs: Function pointers can be struct members for implementing callbacks or vtables

int add(int a, int b) { return a + b; }
int multiply(int a, int b) { return a * b; }

struct Calculator {
    int (*operation)(int, int);
    int last_result;
};

struct Calculator calc;
calc.operation = add;
calc.last_result = calc.operation(10, 5);  // Calls add(10, 5)

Control Flow Integrity (CFI)

CFI is a security feature that protects against control flow hijacking attacks:

• Purpose: Validates indirect function calls to ensure they target legitimate functions
• How it Works:
  • Each function is assigned a type hash based on its signature
  • A runtime table maps function addresses to their type hashes
  • Before indirect calls, CFI checks verify the target is valid
• Enable CFI: Check the "Enable CFI" checkbox in the compiler overlay
• Generated Code: When enabled, the compiler adds:
  • __cfi_init function to initialize the runtime table
  • __cfi_check function to validate call targets
  • CFI checks before each indirect function call
• Protection: Prevents attackers from redirecting function pointers to arbitrary code

Note: CFI adds runtime overhead but significantly improves security against ROP/JOP attacks.

Available C Functions

printf("Hello %s\\n", name);
printf("Value: %d, Hex: %x\\n", val, val);

char buffer[64];
gets(buffer);  // Classic buffer overflow vulnerability!

char buffer[16];
strcpy(buffer, user_input);  // Overflow if input > 16!

memcpy(buffer, shellcode, sizeof(shellcode));

exit(0);  // Success
exit(1);  // Error

int num;
scanf("%d", &num);
char buffer[100];
scanf("%s", buffer);  // Vulnerable to overflow!

char *buffer = (char *)malloc(100);
if (buffer == NULL) exit(1);

free(buffer);
buffer = NULL;  // Prevent use-after-free

if (strcmp(password, "secret") == 0) {
    win();
}

int len = strlen(user_input);
if (len > 64) return;  // Basic bounds check

char buffer[100];
memset(buffer, 0, sizeof(buffer));  // Zero out buffer

system("cat flag.txt");  // Command injection risk!
system(user_input);      // VERY dangerous!

void win() {
    printf("FLAG{you_found_it}\\n");
}

x86 Assembly Instructions

mov  eax, 0x41414141    ; Move immediate value
mov  eax, [ebp-0x10]    ; Move from memory
mov  [esp], eax         ; Move to memory
push eax                ; Push to stack
pop  ebx                ; Pop from stack
lea  eax, [ebp-0x20]    ; Load effective address
xchg eax, ebx           ; Exchange values

add  eax, 0x10          ; Addition
sub  esp, 0x40          ; Subtraction
mul  ebx                ; Unsigned multiply
div  ecx                ; Unsigned divide
inc  eax                ; Increment
dec  ebx                ; Decrement
and  eax, 0xff          ; Bitwise AND
or   eax, ebx           ; Bitwise OR
xor  eax, eax           ; Bitwise XOR (zero register)
not  eax                ; Bitwise NOT
shl  eax, 2             ; Shift left
shr  ebx, 1             ; Shift right

jmp  0x08048000         ; Unconditional jump
je   label              ; Jump if equal (ZF=1)
jne  label              ; Jump if not equal (ZF=0)
jg   label              ; Jump if greater
jl   label              ; Jump if less
call function           ; Call function
ret                     ; Return from function
ret  0x10               ; Return and clean stack
nop                     ; No operation
int  0x80               ; System call (Linux)

push ebp                ; Save base pointer
mov  ebp, esp           ; Set up stack frame
sub  esp, 0x40          ; Allocate local space
leave                   ; Restore stack frame
ret                     ; Return

cmp  eax, 0x41          ; Compare values
test eax, eax           ; Test (AND without storing)