# IERG4130 — off-by-one demos
CC := gcc

# Flags that make the off-by-one EXPLOITABLE (name flush with the saved EBP):
#   -m32                          32-bit; the SFP is 4 bytes
#   -fno-stack-protector          no canary between the buffer and the SFP
#   -no-pie -fno-pic              fixed addresses; no saved %ebx before the SFP
#   -mpreferred-stack-boundary=2  4-byte stack alignment -> no padding above name
EXPLOIT_FLAGS := -m32 -fno-stack-protector -no-pie -fno-pic -mpreferred-stack-boundary=2 -g

.PHONY: all run clean
all: offbyone offbyone_asan offbyone_win

# plain, "silent" off-by-one — for the gdb / ASan walkthrough
offbyone: offbyone.c
	$(CC) -m32 -fno-stack-protector -no-pie -g $< -o $@

offbyone_asan: offbyone.c
	$(CC) -g -fsanitize=address $< -o $@

# the exploitable build
offbyone_win: offbyone_win.c
	$(CC) $(EXPLOIT_FLAGS) $< -o $@

# build + fire the exploit (exploit.py disables ASLR via setarch -R)
run: offbyone_win
	python3 exploit.py

clean:
	rm -f offbyone offbyone_asan offbyone_win in21 pwn pwng pwnc
