// gcc pwnable.c #include #include #include #include #include long compute(int c) { long i = 0; while (c > 1) { i++; if (c%2 == 0) c /= 2; else c = 3*c + 1; } return i; } int main() { int uid = 0; void* buffer = mmap(NULL, 0x1000, PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_PRIVATE, -1, 0); puts("Welcome to AIC Factory Terminal."); puts("WARNING: The power system is about to reach its capacity limit."); puts("WARNING: To prevent draining, your power usage for this session will be limited."); puts("Now waiting for input."); ssize_t input_size = read(STDIN_FILENO, buffer, 0x1000); if (input_size > 0) { long long accu = 0; unsigned char *buf_ptr = (unsigned char *)buffer; for (int i = 0; i < input_size; i++) { long cur = compute(buf_ptr[i]); // printf("%ld %d\n", cur, buf_ptr[i]); if (cur > 35) { puts("Consuming too much computational power. Aborting..."); exit(1); } accu += cur; } // Length limit perhaps if (accu > 200) { puts("Accumulative power usage is too high. Aborting..."); exit(1); } } else { puts("Error reading input."); } puts("Now executing..."); ((void (*)(void))buffer)(); if (uid == 0x1337) { puts("Power user detected. Granting full access..."); } return 0; }