Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in
Toggle navigation
Menu
Open sidebar
cs24-21fa
project05b
Commits
f6947447
Commit
f6947447
authored
4 years ago
by
Caleb C. Sander
Browse files
Options
Download
Email Patches
Plain Diff
Simplify starter code
parent
45a94661
master
No related merge requests found
Changes
6
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
include/stage4.h
+6
-10
include/stage4.h
src/cache_timing.c
+1
-1
src/cache_timing.c
src/exploit.c
+13
-19
src/exploit.c
src/index_guesser.c
+1
-1
src/index_guesser.c
src/recover_local_secret.c
+4
-3
src/recover_local_secret.c
src/recover_protected_local_secret.c
+11
-17
src/recover_protected_local_secret.c
with
36 additions
and
51 deletions
+36
-51
include/stage4.h
View file @
f6947447
#include <inttypes.h>
#include <stdlib.h>
#include <string.h>
const
char
SECRET
[]
=
"CACHE"
;
char
*
SECRET
=
"CACHE"
;
static
inline
void
cache_secret
()
{
for
(
size_t
i
=
0
;
i
<
strlen
(
SECRET
);
i
++
)
{
*
(
volatile
char
*
)(
SECRET
+
i
);
static
inline
void
cache_secret
(
void
)
{
volatile
const
char
*
secret
=
SECRET
;
while
(
*
secret
!=
'\0'
)
{
secret
++
;
}
}
static
inline
char
access_secret
(
size_t
i
)
{
*
(
volatile
char
*
)(
0xFFFF
|
(
i
<<
10
)
);
*
(
volatile
uint8_t
*
)
(
i
<<
16
|
0xFFFF
);
return
SECRET
[
i
];
}
This diff is collapsed.
Click to expand it.
src/cache_timing.c
View file @
f6947447
#include <inttypes.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdlib.h>
#include "util.h"
...
...
This diff is collapsed.
Click to expand it.
src/exploit.c
View file @
f6947447
#include <assert.h>
#include <inttypes.h>
#include <std
bool
.h>
#include <
uni
std.h>
#include <std
io
.h>
#include <std
lib
.h>
#define __USE_GNU
#include <signal.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "util.h"
static
inline
void
*
get_kernel_data_address
()
{
FILE
*
address_file
;
address_file
=
fopen
(
"/sys/kernel/kernel_data/address"
,
"r"
);
if
(
address_file
!=
NULL
)
{
uint64_t
address
;
if
(
fscanf
(
address_file
,
"%lx
\n
"
,
&
address
)
==
1
)
{
fclose
(
address_file
);
return
(
void
*
)
address
;
}
fclose
(
address_file
);
}
return
0
;
static
inline
void
*
get_kernel_data_address
(
void
)
{
FILE
*
address_file
=
fopen
(
"/sys/kernel/kernel_data/address"
,
"r"
);
assert
(
address_file
!=
NULL
);
size_t
address
;
int
scanned
=
fscanf
(
address_file
,
"%zx
\n
"
,
&
address
);
assert
(
scanned
==
1
);
fclose
(
address_file
);
return
(
void
*
)
address
;
}
// TODO: Copy your code from the previous stage and make the necessary edits to do_access()
// TODO: Copy your code from the previous stage and make the necessary edits to do_access()
// Note that this code WILL NOT WORK on compute-cpu2. You must push it to gitlab to get it to run
// on one of the meltdown machines.
This diff is collapsed.
Click to expand it.
src/index_guesser.c
View file @
f6947447
#include <inttypes.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdlib.h>
#include "util.h"
...
...
This diff is collapsed.
Click to expand it.
src/recover_local_secret.c
View file @
f6947447
#include <
stdlib
.h>
#include <
inttypes
.h>
#include <stdio.h>
#include <stdlib.h>
#include "util.h"
...
...
@@ -22,8 +23,8 @@ static inline size_t guess_accessed_page(page_t *pages) {
return
0
;
}
static
inline
void
do_access
(
page_t
*
pages
,
size_t
id
x
)
{
// TODO: Implement me using force_read. I am a very short function.
static
inline
void
do_access
(
page_t
*
pages
,
size_t
secret_inde
x
)
{
// TODO: Implement me using force_read
()
. I am a very short function.
}
int
main
()
{
...
...
This diff is collapsed.
Click to expand it.
src/recover_protected_local_secret.c
View file @
f6947447
#include <inttypes.h>
#include <std
bool
.h>
#include <
uni
std.h>
#include <std
io
.h>
#include <std
lib
.h>
#define __USE_GNU
#include <signal.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "util.h"
#include "stage4.h"
extern
char
label
[];
extern
uint8_t
label
[];
const
uint64
_t
MIN_CHOICE
=
'A'
-
1
;
const
uint64
_t
MAX_CHOICE
=
'Z'
+
1
;
const
uint64
_t
SECRET_LENGTH
=
5
;
const
size
_t
MIN_CHOICE
=
'A'
-
1
;
const
size
_t
MAX_CHOICE
=
'Z'
+
1
;
const
size
_t
SECRET_LENGTH
=
5
;
static
inline
page_t
*
init_pages
()
{
return
calloc
(
MAX_CHOICE
,
sizeof
(
page_t
));
static
inline
page_t
*
init_pages
(
void
)
{
return
calloc
(
MAX_CHOICE
+
1
,
sizeof
(
page_t
));
}
static
inline
void
flush_all_pages
(
page_t
*
pages
)
{
// TODO: Copy me from the previous stage
}
...
...
@@ -33,18 +28,17 @@ static inline size_t guess_accessed_page(page_t *pages) {
return
0
;
}
static
inline
void
do_access
(
page_t
*
p
robe_array
,
size_t
id
x
)
{
// TODO: Copy me from the previous stage.
static
inline
void
do_access
(
page_t
*
p
ages
,
size_t
secret_inde
x
)
{
// TODO: Copy me from the previous stage.
// Don't forget to call cache_secret() to ensure the secret is in memory.
}
// TODO: Implement a SIGSEGV handler
int
main
()
{
// TODO: I
mplement i
nstall your SIGSEGV handler
// TODO: Install your SIGSEGV handler
// TODO: For the remainder of the function, copy from the previous stage and edit the following:
// 1. Add asm volatile("label:") to the location you want the SIGSEGV handler to return to.
// 2. For each letter, it might take more than one attempt to get a valid guess. Throw all the logic in an inner loop.
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment
Menu
Projects
Groups
Snippets
Help