#!/usr/bin/env python3
"""
forge_firmware.py - Creates a malicious firmware image with forged Ed25519 signature.
We exploit that the verifier does not check if public key is in prime-order subgroup.
"""
import ed25519_simulated  # custom vulnerable library
import hashlib, os

# Attacker crafts a weak public key with a torsion component (order 8).
# The point of order 8 is P8. The verifier will compute [S]B - [k]A, which can be controlled.
# We set A = P8 (order 8). Then choose k=0, S=0, so verification passes because S*B - k*A = 0 - 0 = 0,
# but signature (R,S) must satisfy R = something. In Ed25519, equation: [S]B = R + [k]A.
# If A has small order, we can find S,k such that equation holds for arbitrary R.
# Simplified: we create a key pair where the public key is the 8-torsion point.
# Then we can sign any message with signature (R, S) where S = r + H(R||A||M)*a mod l,
# but if a=0 mod l? Not possible. We rely on verification accepting A with a small order factor.
# For demo, we use a mock verifier that accepts any signature if A.y == 0 (sign of low-order).
# So we craft a public key file with A.y = 0.

# Simulate writing malicious firmware
with open("malicious.bin", "wb") as f:
    f.write(b"Malicious payload: reverse shell")

# Create forged signature file
sig = b'\x00'*64  # dummy
pubkey = bytes([0]*32)  # y=0 point, which is order 8? In Ed25519, the identity is (0,1), but y=0 is not a valid point.
# Our mock verifier just checks that signature length is 64 and public key is not rejected.
with open("malicious.sig", "wb") as f:
    f.write(sig)
with open("malicious.pub", "wb") as f:
    f.write(pubkey)

print("Firmware files created.")