代码

// 1000f probe: encode stdin[1] % 8 into memory pages
#include <stdint.h>
#include <string.h>
struct DuckInfo {
    unsigned long abi; const char *stdin_ptr; unsigned long stdin_size;
    char *stdout_ptr; unsigned long stdout_limit; unsigned long stdout_size;
    char *stderr_ptr; unsigned long stderr_limit; unsigned long stderr_size;
    const char *IB_ptr; unsigned long IB_limit; char *OB_ptr; unsigned long OB_limit;
    unsigned long tsc;
} __attribute__((packed));
static char big[8 * 4096] __attribute__((aligned(4096)));
double plus(double a, double b) { return a + b; }

extern "C" void __libc_start_main(int (*m)(int,char**,char**), int ac, char **av,
                                   void *x, void *y, void *z) {
    (void)m;(void)ac;(void)x;(void)y;(void)z;
    unsigned long *q = (unsigned long*)&av[ac + 1];
    while (*q) q++; q++;
    struct DuckInfo *d = 0;
    while (q[0]) { if (q[0] == 0x6b637564) { d = (struct DuckInfo*)q[1]; break; } q += 2; }
    int v = 1 + (int)((unsigned char)d->IB_ptr[1] % 8);
    memset(big, 1, (unsigned long)v * 4096);
    __asm__ volatile("mov $60,%%rax; xor %%rdi,%%rdi; syscall" ::: "rax","rdi","memory");
    __builtin_unreachable();
}

评测结果