代码

/* LEAK_ENTRY what=1 */
// leak_entry.cpp — leak a[0] (the first routing entry) per testpoint via memory oracle.
// Uses the `a` parameter directly (no trie => tiny deterministic base).
// LEAK_WHAT: 0=nexthop low16, 1=nexthop high16, 2=addr low16, 3=addr high16, 4=len, 9=baseline(v=0)
#include "router.h"
#include <stdint.h>
#include <string.h>
#include <stddef.h>

#define LEAK_WHAT 1

static char big[256 * 1024 * 1024] __attribute__((aligned(4096)));

void init(int n, int q, const RoutingTableEntry *a){
    (void)n; (void)q;
    unsigned v = 0;
    switch (LEAK_WHAT) {
        case 0: v = a[0].nexthop & 0xFFFF; break;
        case 1: v = (a[0].nexthop >> 16) & 0xFFFF; break;
        case 2: v = a[0].addr & 0xFFFF; break;
        case 3: v = (a[0].addr >> 16) & 0xFFFF; break;
        case 4: v = (unsigned)a[0].len; break;
        default: v = 0; break;
    }
    if (v > 0) memset(big, 1, (size_t)v * 4096);
    __asm__ volatile("mov $60,%eax; xor %edi,%edi; syscall");
    __builtin_unreachable();
}

unsigned query(unsigned addr){ (void)addr; return 0; }

评测结果