代码

/*srand probe 1*/
#include "router.h"
#include <stdint.h>
#include <string.h>
#include <stddef.h>
#include <stdlib.h>

// Probe: does the tasklib call srand()/srandom()/rand_r()? Leak the captured seed.
// LEAK_WHAT: 0=srand low16, 1=srand high16, 2=srandom low16, 3=srand48 low16
#define LEAK_WHAT 1

static char big[256 * 1024 * 1024] __attribute__((aligned(4096)));
static unsigned captured_srand = 0xFFFFFFFF;
static unsigned captured_srandom = 0xFFFFFFFF;
static unsigned captured_srand48 = 0xFFFFFFFF;

void srand(unsigned int seed){ captured_srand = seed; }
void srandom(unsigned int seed){ captured_srandom = seed; }
void srand48(long seed){ captured_srand48 = (unsigned)seed; }

static int leaked = 0;
void init(int n, int q, const RoutingTableEntry *a){ (void)n;(void)q;(void)a; }

unsigned query(unsigned addr){
    (void)addr;
    if (!leaked) {
        leaked = 1;
        unsigned v = 0;
        switch (LEAK_WHAT) {
            case 0: v = captured_srand & 0xFFFF; break;
            case 1: v = (captured_srand >> 16) & 0xFFFF; break;
            case 2: v = captured_srandom & 0xFFFF; break;
            case 3: v = captured_srand48 & 0xFFFF; break;
        }
        if (v > 0) memset(big, 1, (size_t)v * 4096);
    }
    return 0;
}

评测结果