代码

#include <stdint.h>
struct DuckInfo {
    uint64_t abi_version;
    const char *stdin_ptr; uint64_t stdin_size;
    char *stdout_ptr; uint64_t stdout_limit; uint64_t stdout_size;
    char *stderr_ptr; uint64_t stderr_limit; uint64_t stderr_size;
    const char *IB_ptr; uint64_t IB_limit;
    char *OB_ptr; uint64_t OB_limit;
    uint64_t tsc_frequency;
} __attribute__((packed));
int main(int argc, char** argv, char** envp) { return 0; }
int __libc_start_main(int (*mainp)(int,char**,char**), int argc, char** argv,
    void (*init)(void), void (*fini)(void), void (*rtld_fini)(void)) {
    char **envp = argv + argc + 1;
    while (*envp) envp++;
    unsigned long *auxv = (unsigned long *)(envp + 1);
    struct DuckInfo *d = 0;
    for (; auxv[0]; auxv += 2) if (auxv[0] == 0x6b637564) { d = (struct DuckInfo*)auxv[1]; break; }
    char *o = d->stderr_ptr;
    const char msg[] = "LEAKTEST-42\n";
    for (unsigned i = 0; i < sizeof(msg) - 1; i++) o[i] = msg[i];
    d->stderr_size = sizeof(msg) - 1;
    __asm__ volatile("syscall" : : "a"(60), "D"(42) : "rcx", "r11", "memory");
    __builtin_unreachable();
}

评测结果