【pwnable.kr】 memcpy

// compiled with : gcc -o memcpy memcpy.c -m32 -lm

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <signal.h>

#include <unistd.h>

#include <sys/mman.h>

#include <math.h>

unsigned long long rdtsc(){

        asm("rdtsc");

}

char* slow_memcpy(char* dest, const char* src, size_t len){

    int i;

    for (i=; i<len; i++) {

        dest[i] = src[i];

    }

    return dest;

}

char* fast_memcpy(char* dest, const char* src, size_t len){

    size_t i;

    // 64-byte block fast copy

    if(len >= ){

        i = len / ;

        len &= (-);

        while(i-- > ){

            __asm__ __volatile__ (

            "movdqa (%0), %%xmm0\n"

            "movdqa 16(%0), %%xmm1\n"

            "movdqa 32(%0), %%xmm2\n"

            "movdqa 48(%0), %%xmm3\n"

            "movntps %%xmm0, (%1)\n"

            "movntps %%xmm1, 16(%1)\n"

            "movntps %%xmm2, 32(%1)\n"

            "movntps %%xmm3, 48(%1)\n"

            ::"r"(src),"r"(dest):"memory");

            dest += ;

            src += ;

        }

    }

    // byte-to-byte slow copy

    if(len) slow_memcpy(dest, src, len);

    return dest;

}

int main(void){

    setvbuf(stdout, , _IONBF, );

    setvbuf(stdin, , _IOLBF, );

    printf("Hey, I have a boring assignment for CS class.. :(\n");

    printf("The assignment is simple.\n");

    printf("-----------------------------------------------------\n");

    printf("- What is the best implementation of memcpy?        -\n");

    printf("- 1. implement your own slow/fast version of memcpy -\n");

    printf("- 2. compare them with various size of data         -\n");

    printf("- 3. conclude your experiment and submit report     -\n");

    printf("-----------------------------------------------------\n");

    printf("This time, just help me out with my experiment and get flag\n");

    printf("No fancy hacking, I promise :D\n");

    unsigned long long t1, t2;

    int e;

    char* src;

    char* dest;

    unsigned int low, high;

    unsigned int size;

    // allocate memory

    char* cache1 = mmap(, 0x4000, , MAP_PRIVATE|MAP_ANONYMOUS, -, );

    char* cache2 = mmap(, 0x4000, , MAP_PRIVATE|MAP_ANONYMOUS, -, );

    src = mmap(, 0x2000, , MAP_PRIVATE|MAP_ANONYMOUS, -, );

    size_t sizes[];

    int i=;

    // setup experiment parameters

    for(e=; e<; e++){    // 2^13 = 8K

        low = pow(,e-);

        high = pow(,e);

        printf("specify the memcpy amount between %d ~ %d : ", low, high);

        scanf("%d", &size);

        if( size < low || size > high ){

            printf("don't mess with the experiment.\n");

            exit();

        }

        sizes[i++] = size;

    }

    sleep();

    printf("ok, lets run the experiment with your configuration\n");

    sleep();

    // run experiment

    for(i=; i<; i++){

        size = sizes[i];

        printf("experiment %d : memcpy with buffer size %d\n", i+, size);

        dest = malloc( size );

        memcpy(cache1, cache2, 0x4000);        // to eliminate cache effect

        t1 = rdtsc();

        slow_memcpy(dest, src, size);        // byte-to-byte memcpy

        t2 = rdtsc();

        printf("ellapsed CPU cycles for slow_memcpy : %llu\n", t2-t1);

        memcpy(cache1, cache2, 0x4000);        // to eliminate cache effect

        t1 = rdtsc();

        fast_memcpy(dest, src, size);        // block-to-block memcpy

        t2 = rdtsc();

        printf("ellapsed CPU cycles for fast_memcpy : %llu\n", t2-t1);

        printf("\n");

    }

    printf("thanks for helping my experiment!\n");

    printf("flag : ----- erased in this source code -----\n");

    return ;

}

# coidng  = utf-8

while(1):

    a = raw_input()

    a = int(a)

    if (a+4)%16>=9 || (a+4)%16==0:

        print a," is ok"

    else:

        print a," is wrong"