#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
	if(argc<2){
		printf("pass argv[1] a number\n");
		return 0;
	}
	int fd = atoi( argv[1] ) - 0x1234;	//将第一个参数转为整型
	int len = 0;
	len = read(fd, buf, 32);		//从fd中读取数据到bug中
	if(!strcmp("LETMEWIN\n", buf)){	 //如果buf中的内容为"LETMEWIN"就结束
		printf("good job :)\n");
		system("/bin/cat flag");
		exit(0);
	}
	printf("learn about Linux file IO\n");
	return 0;

}

#include <stdio.h>
#include <string.h>
unsigned long hashcode = 0x21DD09EC;	//比对的是16进制数
unsigned long check_password(const char* p){	//传入一个指向字符串的指针
	int* ip = (int*)p;	//转为int型 **注意这里变为了5个数组，具体看下面**
	int i;
	int res=0;
	for(i=0; i<5; i++){
		res += ip[i];	//将字符串中前5个字符的ascii值进行加和，得出结果res
	}
	return res;
}

int main(int argc, char* argv[]){
	if(argc<2){
		printf("usage : %s [passcode]\n", argv[0]);
		return 0;
	}
	if(strlen(argv[1]) != 20){	//要求长度为20
		printf("passcode length should be 20 bytes\n");
		return 0;
	}

	if(hashcode == check_password( argv[1] )){
		system("/bin/cat flag");
		return 0;
	}
	else
		printf("wrong passcode.\n");
	return 0;
}

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me!
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}
}
int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

#include <stdio.h>
#include <stdlib.h>

void login(){
	int passcode1;
	int passcode2;

	printf("enter passcode1 : ");
	scanf("%d", passcode1);			// <------------
	fflush(stdin);

	// ha! mommy told me that 32bit is vulnerable to bruteforcing :)
	printf("enter passcode2 : ");	
        scanf("%d", passcode2);		 // <------------

	printf("checking...\n");
	if(passcode1==338150 && passcode2==13371337){
                printf("Login OK!\n");
                system("/bin/cat flag");
        }
        else{
                printf("Login Failed!\n");
		exit(0);
        }
}

void welcome(){
	char name[100];
	printf("enter you name : ");
	scanf("%100s", name);	//这里对输入长度做了限制
	printf("Welcome %s!\n", name);
}

int main(){
	printf("Toddler's Secure Login System 1.0 beta.\n");

	welcome();
	login();

	// something after login...
	printf("Now I can safely trust you that you have credential :)\n");
	return 0;	
}

#include <stdio.h>

void hello(){
    int b = 2;		//<----此处设置断点
    printf("Hello");
}

int main(){
    int a = 1;		//<----此处设置断点
    hello();
    return 0;
}

#include <stdio.h>

int main(){
	unsigned int random;
	random = rand();	// random value!

	unsigned int key=0;
	scanf("%d", &key);

	if( (key ^ random) == 0xdeadbeef ){
		printf("Good!\n");
		system("/bin/cat flag");
		return 0;
	}

	printf("Wrong, maybe you should try 2^32 cases.\n");
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>

int main(int argc, char* argv[], char* envp[]){
	printf("Welcome to pwnable.kr\n");
	printf("Let's see if you know how to give input to program\n");
	printf("Just give me correct inputs then you will get the flag :)\n");

	// argv
	if(argc != 100) return 0;	
	if(strcmp(argv['A'],"\x00")) return 0;
	if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
	printf("Stage 1 clear!\n");	

	// stdio
	char buf[4];
	read(0, buf, 4);
	if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
	read(2, buf, 4);
        if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
	printf("Stage 2 clear!\n");
	
	// env
	if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
	printf("Stage 3 clear!\n");

	// file
	FILE* fp = fopen("\x0a", "r");
	if(!fp) return 0;
	if( fread(buf, 4, 1, fp)!=1 ) return 0;
	if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
	fclose(fp);
	printf("Stage 4 clear!\n");	

	// network
	int sd, cd;
	struct sockaddr_in saddr, caddr;
	sd = socket(AF_INET, SOCK_STREAM, 0);
	if(sd == -1){
		printf("socket error, tell admin\n");
		return 0;
	}
	saddr.sin_family = AF_INET;
	saddr.sin_addr.s_addr = INADDR_ANY;
	saddr.sin_port = htons( atoi(argv['C']) );
	if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
		printf("bind error, use another port\n");
    		return 1;
	}
	listen(sd, 1);
	int c = sizeof(struct sockaddr_in);
	cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
	if(cd < 0){
		printf("accept error, tell admin\n");
		return 0;
	}
	if( recv(cd, buf, 4, 0) != 4 ) return 0;
	if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
	printf("Stage 5 clear!\n");

	// here's your flag
	system("/bin/cat flag");	
	return 0;
}

// argv		1.首先参数是100个 2.'A'对应值为\x00 3.'B'对应值为\x20\x0a\x0d
if(argc != 100) return 0;	
if(strcmp(argv['A'],"\x00")) return 0;
if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
printf("Stage 1 clear!\n");	

//step1 argv
char *argv[100];
for (i = 0; i < 100; i++){		//先进行填充，在定位地修改
    argv[i] = "A";
}
argv[0] = "/home/input2/input"	//指定要运行的程序
argv['A'] = "\x00";			   //argv['A'] 即下标为A的ascii码值
argv['B'] = "\x20\x0a\x0d"

// stdio
char buf[4];
read(0, buf, 4);
if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
read(2, buf, 4);
if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
printf("Stage 2 clear!\n");

int pipe(int pipefd[2]);
  pipe()  creates  a  pipe, a unidirectional data channel that can be used for interprocess communication.  The array pipefd is used to return two file descriptors referring to the ends of the pipe.  
  pipefd[0] refers to the read end of the pipe.  pipefd[1] refers to the write end of the pipe. Data written to the write end of the pipe  is  buffered  by  the kernel until it is read from the read end of the pipe. 
  On success, zero is returned.  On error, -1 is returned, errno is set appropriately, and pipefd is left unchanged.

//step2 stdio
int pip_stdin[2] = {-1, -1};
int pip_stderr[2] = {-1, -1};

# define STDIN_READ pip_stdin[0]
# define STDIN_WRITE pip_stdin[1]
# define STDERR_READ pip_stderr[0]
# define STDERR_WRITE pip_stderr[1]

if (!pipe(pip_stdin) && !pipe(pip_stderr)){		//创建管道成功
    //todo
}

int dup2(int oldfd, int newfd);
  The dup() system call creates a copy of the file descriptor oldfd, using the lowest-numbered unused file descriptor for the new descriptor.
  The dup2() system call performs the same task as dup(), but instead of using the lowest-numbered unused file descriptor, it uses the file descriptor number  specified  in  newfd.
  If the file descriptor newfd was previously open, it is silently closed before being reused.

//step2 stdio
int pip_stdin[2] = {-1, -1};
int pip_stderr[2] = {-1, -1};

# define STDIN_READ pip_stdin[0]
# define STDIN_WRITE pip_stdin[1]
# define STDERR_READ pip_stderr[0]
# define STDERR_WRITE pip_stderr[1]

if (!pipe(pip_stdin) && !pipe(pip_stderr)){		//创建管道成功
    pid_t child;
    if (child = fork()){	//子进程返回值为0
        //关闭两个读端
        close(STDIN_READ);
        close(STDERR_READ);
        //写入数据
        write(STDIN_WRITE, "\x00\x0a\x00\xff", 4);
        write(STDERR_WRITE, "\x00\x0a\x02\xff", 4);
    } else{		//父进程
        //关闭两个写端
        close(STDIN_WRITE);
        close(STDERR_WRITE);
        //将数据进行重定向到标准输入与错误输出
        dup2(STDIN_READ, 0);
        dup2(STDERR_READ, 2);
        execve("/home/input2/input", argv, envp);	//这里执行
    }
}

// env
if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
printf("Stage 3 clear!\n");

//step3 env
char *envp[2] = {"\xde\xad\xbe\xef=\xca\xfe\xba\xbe", NULL}

// file
FILE* fp = fopen("\x0a", "r");
if(!fp) return 0;
if( fread(buf, 4, 1, fp)!=1 ) return 0;
if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
fclose(fp);
printf("Stage 4 clear!\n");

//step4 file
FILE *fp = open("\x0a", "wb");
fwrite("\x00\x00\x00\x00", 4, 1, fp);

// network
int sd, cd;
struct sockaddr_in saddr, caddr;	//分别代表服务端和客户端的套接字结构
sd = socket(AF_INET, SOCK_STREAM, 0);	//申请一个TCP套接字
if(sd == -1){
	printf("socket error, tell admin\n");
	return 0;
}

saddr.sin_family = AF_INET;
saddr.sin_addr.s_addr = INADDR_ANY;
saddr.sin_port = htons( atoi(argv['C']) );	//端口为命令行参数中'C'对应的那个值
if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){	//套接字绑定
	printf("bind error, use another port\n");	//这里只要不用常用端口就行
    	return 1;
}
listen(sd, 1);	//监听 客户端数为1
int c = sizeof(struct sockaddr_in);	
cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);	//接受一个客户端的连接
if(cd < 0){
	printf("accept error, tell admin\n");
	return 0;
}
if( recv(cd, buf, 4, 0) != 4 ) return 0;	//客户端发来的数据必须是4个字节
if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;	//且内容为\xde\xad\xbe\xef
printf("Stage 5 clear!\n");

argv['C'] = 6666

# define PORT 6666
int cfd;
struct sockaddr_in server;
char buf[4] = "\xde\xad\xbe\xef";	//payload
cfd = socket(AF_INET, SOCK_STREAM, 0);	//申请客户端套接字
if (cfd == -1){		//申请失败
    perror("socket request error\n");
    return 0;
}
//设置服务端的信息
server.sin_family = AF_INET;
server.sin_addr.s_addr = INADDR_ANY;
server.sin_port = PORT;
if (connect(cfd, (struct sockaddr*)&server, sizeof(server)) < 0){
    perror("connect failed\n");           //连接被拒绝
    return 0;
}
//连接成功，发送数据，发送后结束通信
send(cfd, buf, 4, 0);
close(cfd);

#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define PORT 6666

int main(){
    //step1 argv
    char *argv[100];
    int i;
    for (i = 0; i < 100; i++){    //先进行填充，在定位地修改
        argv[i] = "A";
    }
    argv[0] = "/home/input2/input";    //指定要运行的程序
    argv['A'] = "\x00";       //argv['A'] 即下标为A的ascii码值
    argv['B'] = "\x20\x0a\x0d";
    argv['C'] = "6666";       //for step5 network using 
    argv[100] = NULL;
    char *envp[2] = {"\xde\xad\xbe\xef=\xca\xfe\xba\xbe", NULL};        //for step3 env Using
    
    //step2 stdio
    int pip_stdin[2] = {-1, -1};
    int pip_stderr[2] = {-1, -1};

    # define STDIN_READ pip_stdin[0]
    # define STDIN_WRITE pip_stdin[1]
    # define STDERR_READ pip_stderr[0]
    # define STDERR_WRITE pip_stderr[1]

    if (!pipe(pip_stdin) && !pipe(pip_stderr)){    //创建管道成功
        pid_t child;
        if (child = fork()){    //子进程返回值为0
            //关闭两个读端
            close(STDIN_READ);
            close(STDERR_READ);
            //写入数据
            write(STDIN_WRITE, "\x00\x0a\x00\xff", 4);
            write(STDERR_WRITE, "\x00\x0a\x02\xff", 4);
        } else{    //父进程
            //关闭两个写端
            close(STDIN_WRITE);
            close(STDERR_WRITE);
            //将数据进行重定向到标准输入与错误输出
            dup2(STDIN_READ, 0);
            dup2(STDERR_READ, 2);
            execve("/home/input2/input", argv, envp);    //这里执行
        }
    }
    
    //step4 file
    FILE *fp = fopen("\x0a", "wb");
    printf("Open file successfully!\n");
    fwrite("\x00\x00\x00\x00", 4, 1, fp);
    fclose(fp);
    
    //step5 network
    sleep(2);       //等待服务开启
    int cfd;
    struct sockaddr_in server;
    char buf[4] = "\xde\xad\xbe\xef";    //payload
    cfd = socket(AF_INET, SOCK_STREAM, 0);    //申请客户端套接字
    if (cfd == -1){    //申请失败
        perror("socket request error\n");
        return 0;
    }
    //设置服务端的信息
    server.sin_family = AF_INET;
    server.sin_addr.s_addr = inet_addr("127.0.0.1");
    server.sin_port = htons(PORT);
    if (connect(cfd, (struct sockaddr*)&server, sizeof(server)) < 0){
        perror("connect failed\n");           //连接被拒绝
        return 0;
    }
    //连接成功，发送数据，发送后结束通信
    send(cfd, buf, 4, 0);
    close(cfd);
}

#include <stdio.h>
#include <fcntl.h>

#define PW_LEN 10
#define XORKEY 1

void xor(char* s, int len){
	int i;
	for(i=0; i<len; i++){
		s[i] ^= XORKEY;		//逐位和1进行异或
	}
}

int main(int argc, char* argv[]){
	
	int fd;
	if(fd=open("/home/mistake/password",O_RDONLY,0400) < 0){	//0400即r-- --- --- 只读模式
		printf("can't open password %d\n", fd);
		return 0;
	}

	printf("do not bruteforce...\n");
	sleep(time(0)%20);	//睡眠1~20s

	char pw_buf[PW_LEN+1];
	int len;
	if(!(len=read(fd,pw_buf,PW_LEN) > 0)){		//从password文件中读取10个字节到pw_buf
		printf("read error\n");
		close(fd);
		return 0;		
	}

	char pw_buf2[PW_LEN+1];
	printf("input password : ");
	scanf("%10s", pw_buf2);		//输入10位字符串

	// xor your input
	xor(pw_buf2, 10);		//将你的输入逐位与1异或

	if(!strncmp(pw_buf, pw_buf2, PW_LEN)){		//如果相等即可通过
		printf("Password OK\n");
		system("/bin/cat flag\n");
	}
	else{
		printf("Wrong Password\n");
	}

	close(fd);
	return 0;
}

#include <stdio.h>
int main(){
	setresuid(getegid(), getegid(), getegid());
	setresgid(getegid(), getegid(), getegid());
	system("/home/shellshock/bash -c 'echo shock_me'");
	return 0;
}

int setresuid(uid_t ruid, uid_t euid, uid_t suid);
int setresgid(gid_t rgid, gid_t egid, gid_t sgid);
  setresuid() sets the real user ID, the effective user ID, and the saved set-user-ID of the calling process.
  Completely analogously, setresgid() sets the real GID, effective GID, and saved set-group-ID of the calling process (and always modifies the filesystem GID to be the same as  the effective GID), with the same restrictions for unprivileged processes.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>

unsigned char submit[6];

void play(){
	
	int i;
	printf("Submit your 6 lotto bytes : ");
	fflush(stdout);

	int r;
	r = read(0, submit, 6);

	printf("Lotto Start!\n");
	//sleep(1);

	// generate lotto numbers
	int fd = open("/dev/urandom", O_RDONLY);
	if(fd==-1){
		printf("error. tell admin\n");
		exit(-1);
	}
	unsigned char lotto[6];
	if(read(fd, lotto, 6) != 6){
		printf("error2. tell admin\n");
		exit(-1);
	}
	for(i=0; i<6; i++){
		lotto[i] = (lotto[i] % 45) + 1;		// 1 ~ 45
	}
	close(fd);
	
	// calculate lotto score
	int match = 0, j = 0;
	for(i=0; i<6; i++){
		for(j=0; j<6; j++){
			if(lotto[i] == submit[j]){
				match++;
			}
		}
	}

	// win!
	if(match == 6){
		system("/bin/cat flag");
	}
	else{
		printf("bad luck...\n");
	}

}

void help(){
	printf("- nLotto Rule -\n");
	printf("nlotto is consisted with 6 random natural numbers less than 46\n");
	printf("your goal is to match lotto numbers as many as you can\n");
	printf("if you win lottery for *1st place*, you will get reward\n");
	printf("for more details, follow the link below\n");
	printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");
	printf("mathematical chance to win this game is known to be 1/8145060.\n");
}

int main(int argc, char* argv[]){

	// menu
	unsigned int menu;

	while(1){

		printf("- Select Menu -\n");
		printf("1. Play Lotto\n");
		printf("2. Help\n");
		printf("3. Exit\n");

		scanf("%d", &menu);

		switch(menu){
			case 1:
				play();
				break;
			case 2:
				help();
				break;
			case 3:
				printf("bye\n");
				return 0;
			default:
				printf("invalid menu\n");
				break;
		}
	}
	return 0;
}

// calculate lotto score
int match = 0, j = 0;
for(i=0; i<6; i++){
	for(j=0; j<6; j++){
		if(lotto[i] == submit[j]){
			match++;
		}
	}

#include <stdio.h>
#include <string.h>

int filter(char* cmd){
	int r=0;
	r += strstr(cmd, "flag")!=0;	//strstr函数会返回一个指向第一个发现后面字符串的指针
	r += strstr(cmd, "sh")!=0;
	r += strstr(cmd, "tmp")!=0;
	return r;
}
int main(int argc, char* argv[], char** envp){
	putenv("PATH=/thankyouverymuch");	//设置一个环境变量
	if(filter(argv[1])) return 0;
	system( argv[1] );
	return 0;
}

#include <stdio.h>
#include <string.h>

int filter(char* cmd){
	int r=0;
	r += strstr(cmd, "=")!=0;
	r += strstr(cmd, "PATH")!=0;
	r += strstr(cmd, "export")!=0;
	r += strstr(cmd, "/")!=0;
	r += strstr(cmd, "`")!=0;
	r += strstr(cmd, "flag")!=0;
	return r;
}

extern char** environ;
void delete_env(){
	char** p;
	for(p=environ; *p; p++)	memset(*p, 0, strlen(*p));
}

int main(int argc, char* argv[], char** envp){
	delete_env();
	putenv("PATH=/no_command_execution_until_you_become_a_hacker");
	if(filter(argv[1])) return 0;
	printf("%s\n", argv[1]);
	system( argv[1] );
	return 0;
}

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main()
{
    char *p1;
    p1 = (char *) malloc(sizeof(char)*10);  //申请内存空间
    memcpy(p1,"hello",10);
    printf("p1 addr:%x,%s\n",p1,p1);
    free(p1);       //释放内存空间
    char *p2;
    p2 = (char *)malloc(sizeof(char)*10);   //二次申请内存空间，与第一次大小相同，申请到了同一块内存
    memcpy(p1,"world",10);      //对内存进行修改
    printf("p2 addr:%x,%s\n",p2,p1);    //验证
    return 0;
}

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <sys/mman.h>
#include <math.h>

unsigned long long rdtsc(){
        asm("rdtsc");	//这个指令可以获得程序运行期间的CPU周期数，用以测量程序的运行时间
}

char* slow_memcpy(char* dest, const char* src, size_t len){
	int i;
	for (i=0; i<len; i++) {		//这种拷贝方式属于一个字节一个字节的拷贝，效率低
		dest[i] = src[i];
	}
	return dest;
}

char* fast_memcpy(char* dest, const char* src, size_t len){
	size_t i;
	// 64-byte block fast copy
	if(len >= 64){
		i = len / 64;
		len &= (64-1);
		while(i-- > 0){
			__asm__ __volatile__ (		//使用汇编指令mobdpa进行拷贝
			"movdqa (%0), %%xmm0\n"
			"movdqa 16(%0), %%xmm1\n"
			"movdqa 32(%0), %%xmm2\n"
			"movdqa 48(%0), %%xmm3\n"
			"movntps %%xmm0, (%1)\n"
			"movntps %%xmm1, 16(%1)\n"
			"movntps %%xmm2, 32(%1)\n"
			"movntps %%xmm3, 48(%1)\n"
			::"r"(src),"r"(dest):"memory");
			dest += 64;
			src += 64;
		}
	}

	// byte-to-byte slow copy
	if(len) slow_memcpy(dest, src, len);
	return dest;
}

int main(void){

	setvbuf(stdout, 0, _IONBF, 0);	//_IONBF - unbuffered 将标准输出流指向标准输入流，大小至少为0字节
	setvbuf(stdin, 0, _IOLBF, 0);	//_IOLBF - line buffered 将标准输入指向标准输入，大小至少为0字节

	printf("Hey, I have a boring assignment for CS class.. :(\n");	//:(
	printf("The assignment is simple.\n");

	printf("-----------------------------------------------------\n");
	printf("- What is the best implementation of memcpy?        -\n");
	printf("- 1. implement your own slow/fast version of memcpy -\n");
	printf("- 2. compare them with various size of data         -\n");
	printf("- 3. conclude your experiment and submit report     -\n");
	printf("-----------------------------------------------------\n");

	printf("This time, just help me out with my experiment and get flag\n");
	printf("No fancy hacking, I promise :D\n");

	unsigned long long t1, t2;
	int e;
	char* src;
	char* dest;
	unsigned int low, high;
	unsigned int size;
	// allocate memory
    // mmap函数返回值为映射到内存中的起始地址
    // 函数原型：void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset);
	char* cache1 = mmap(0, 0x4000, 7, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);//7表示可以被执行、读取、写入
	char* cache2 = mmap(0, 0x4000, 7, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
	src = mmap(0, 0x2000, 7, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);

	size_t sizes[10];	//存放你输入的10次的size值
	int i=0;

	// setup experiment parameters
	for(e=4; e<14; e++){
		low = pow(2,e-1);	//2^3 2^4 ...
		high = pow(2,e);	//2^4 2^5 ...
		printf("specify the memcpy amount between %d ~ %d : ", low, high);
		scanf("%d", &size);		//输入的size变量必须小于low或者大于high
		if( size < low || size > high ){
			printf("don't mess with the experiment.\n");
			exit(0);
		}
		sizes[i++] = size;	//存放到结果记录数组sizes中
	}

	sleep(1);
	printf("ok, lets run the experiment with your configuration\n");
	sleep(1);

	// run experiment
	for(i=0; i<10; i++){
		size = sizes[i];
		printf("experiment %d : memcpy with buffer size %d\n", i+1, size);
		dest = malloc( size );	//分配你指定的内存大小

		memcpy(cache1, cache2, 0x4000);		// to eliminate cache effect
		t1 = rdtsc();
		slow_memcpy(dest, src, size);		// byte-to-byte memcpy
		t2 = rdtsc();
		printf("ellapsed CPU cycles for slow_memcpy : %llu\n", t2-t1);	//输出两种拷贝方式的CPU周期差

		memcpy(cache1, cache2, 0x4000);		// to eliminate cache effect
		t1 = rdtsc();
		fast_memcpy(dest, src, size);		// block-to-block memcpy
		t2 = rdtsc();
		printf("ellapsed CPU cycles for fast_memcpy : %llu\n", t2-t1);	//输出两种拷贝方式的CPU周期差
		printf("\n");
	}

	printf("thanks for helping my experiment!\n");
	printf("flag : ----- erased in this source code -----\n");	//:(
	return 0;
}

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <seccomp.h>
#include <sys/prctl.h>
#include <fcntl.h>
#include <unistd.h>

#define LENGTH 128

void sandbox(){
	scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);
	if (ctx == NULL) {
		printf("seccomp error\n");
		exit(0);
	}

	seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0);
	seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
	seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
	seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);
	seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);

	if (seccomp_load(ctx) < 0){
		seccomp_release(ctx);
		printf("seccomp error\n");
		exit(0);
	}
	seccomp_release(ctx);
}

char stub[] = "\x48\x31\xc0\x48\x31\xdb\x48\x31\xc9\x48\x31\xd2\x48\x31\xf6\x48\x31\xff\x48\x31\xed\x4d\x31\xc0\x4d\x31\xc9\x4d\x31\xd2\x4d\x31\xdb\x4d\x31\xe4\x4d\x31\xed\x4d\x31\xf6\x4d\x31\xff";
unsigned char filter[256];
int main(int argc, char* argv[]){

	setvbuf(stdout, 0, _IONBF, 0);
	setvbuf(stdin, 0, _IOLBF, 0);

	printf("Welcome to shellcoding practice challenge.\n");
	printf("In this challenge, you can run your x64 shellcode under SECCOMP sandbox.\n");
	printf("Try to make shellcode that spits flag using open()/read()/write() systemcalls only.\n");
	printf("If this does not challenge you. you should play 'asg' challenge :)\n");

	char* sh = (char*)mmap(0x41414000, 0x1000, 7, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0, 0);
	memset(sh, 0x90, 0x1000);	//使用0x90(NOP)进行初始化
	memcpy(sh, stub, strlen(stub));		//这里stub长度为45
	
	int offset = sizeof(stub);	//大小为118
	printf("give me your x64 shellcode: ");
	read(0, sh+offset, 1000);	//从标准输入中输入1000字节内容到sh+offset地址

	alarm(10);
	chroot("/home/asm_pwn");	// you are in chroot jail. so you can't use symlink in /tmp
	sandbox();
	((void (*)(void))sh)();	//执行
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
typedef struct tagOBJ{
	struct tagOBJ* fd;
	struct tagOBJ* bk;
	char buf[8];
}OBJ;

void shell(){
	system("/bin/sh");
}

void unlink(OBJ* P){	//获取要删除节点的前后指针，并将其前驱节点和后驱节点的指针进行修改
	OBJ* BK;
	OBJ* FD;
	BK=P->bk;
	FD=P->fd;
	FD->bk=BK;
	BK->fd=FD;
}
int main(int argc, char* argv[]){
	malloc(1024);
    //声明三个结构体对象
	OBJ* A = (OBJ*)malloc(sizeof(OBJ));
	OBJ* B = (OBJ*)malloc(sizeof(OBJ));
	OBJ* C = (OBJ*)malloc(sizeof(OBJ));

	// double linked list: A <-> B <-> C	形成这样一个链
	A->fd = B;
	B->bk = A;
	B->fd = C;
	C->bk = B;

	printf("here is stack address leak: %p\n", &A);	//A变量的栈地址
	printf("here is heap address leak: %p\n", A);	//A变量的堆地址
	printf("now that you have leaks, get shell!\n");
	// heap overflow!
	gets(A->buf);	//输入到A对象的buf数组中，该数组为8字节大小

	// exploit this unlink!
	unlink(B);	//将B传入
	return 0;
}

struct malloc_chunk {
	INTERNAL_SIZE_T prev_size;//前一个堆块大小(堆是低地址向高地址生长的，前一个堆块就是它下面的那一块)
	INTERNAL_SIZE_T size;	//堆块大小
	struct malloc_chunk *fd;	//前向指针
	Struct malloc_chunk *bk;	//后向指针
}