Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587612
Earl Grey v1.0.2 cppcheck analysis
./cppcheck --template=gcc --enable=all --force ~/cmn/Earl_Grey_v1.0.2/ 2> ~/cmn/earl_grey_v1.0_cppcheck.txt
- In Makefiles, cppcheck is being run every build: cppcheck -f ${INCLUDES} ${C2_MODULE_SRCS}
- Ignored any errors that are in DEBUG() macros, since they won't affect release builds
-
/home/User #76519/cmn/earl-grey-1.0.2/common/randomNumber.c:164: style: Assignment of function parameter has no effect outside the function.
- looks like they meant to provide a seed to init random number generator, but instead are using the current time (in secs)
- implant/rp/c2_manager.c calls randomInit(time(NULL))
- redundant code, but no material effect
-
/home/User #76519/cmn/earl-grey-1.0.2/exploit/clear_history_on_sip.c:28: portability: scanf without field width limits can crash with huge input data on some versions of libc.
- warning is because sscanf() has potential portability issues - if the platform used on the SIPSession Initiation Protocol (Internet Telephony) changes (or more likely this code is ported to another ASRAzure Site Recovery target), then there's potential this call will read in the wrong number of bytes and cause an over/underflow
- ulong on SIPSession Initiation Protocol (Internet Telephony) should be 8 bytes
- in general, shouldn't use scanf(), other uses of it should be scruitnized
- Check Cannoli v2.0 code to see what they did about scanf() for reading beacon_interval from file
- verified recalc_csum() is now only called by recalc_csum_int() (EG-5)
- implant/qfp/trigger.c
- smells like User #?'s code - no error checking, hard coded offsets into buffers/QFP memory locations inlined in code; no one's made any changes to it since the earl grey repo initial checkin
- dead code, not compiled into current baseline; make sure it doesn't get used in future releases
- home/User #76519/cmn/earl-grey-1.0.2/implant/rp/c2_manager.c:850: portability: scanf without field width limits can crash with huge input data on some versions of libc.
- scanf() same as above, potential issue if code is ported to new ASRAzure Site Recovery target