├── LICENSE
├── README.md
└── demo.cpp


/LICENSE:
--------------------------------------------------------------------------------
 1 | The MIT License (MIT)
 2 | 
 3 | Copyright (c) 2014 Michael Meyer
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 
23 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | strcmp-pwn
 2 | ==========
 3 | 
 4 | A strcmp timing attack example
 5 | 
 6 | # Run the demo
 7 | ```
 8 | g++ -o demo -lrt demo.cpp ; watch ./demo
 9 | ```
10 | 


--------------------------------------------------------------------------------
/demo.cpp:
--------------------------------------------------------------------------------
 1 | #include <stdlib.h>
 2 | #include <string.h>
 3 | #include <stdio.h>
 4 | #include <time.h>
 5 | using namespace std;
 6 |  
 7 | // this is just strcmp() wrapped in timer calls
 8 | bool CheckEqual(char* a, char* b, bool show)
 9 | {
10 |     int i, r, trv;
11 |     long time_pre, time_post;
12 |     struct timespec ts;
13 |  
14 |     if((trv = clock_gettime(CLOCK_MONOTONIC,&ts)) != 0) {
15 |         printf("Timing error, pre. Code = %d\n", trv);
16 |     }
17 |     time_pre = ts.tv_nsec + (ts.tv_sec * 1000000000L);
18 |  
19 |     r = strcmp(a, b);
20 |  
21 |     if((trv = clock_gettime(CLOCK_MONOTONIC,&ts)) != 0) {
22 |         printf("Timing error, post. Code = %d\n", trv);
23 |     }
24 |     time_post = ts.tv_nsec + (ts.tv_sec * 1000000000L);
25 |  
26 |     if (show)
27 |         printf("Time: %ld\n", time_post - time_pre);
28 |     else
29 |         printf("First compare done.\n");
30 |  
31 |     return r == 0;
32 | }
33 |  
34 | // this function helps us avoid the problem of the compiler being too smart.
35 | // if we were to use string literals that were equal, it'd optimise compile-time
36 | // constant strings into a single instance, so strcmp() would just early-out on
37 | // the fact that the two pointers were equal, which is not what we want to
38 | // demonstrate here - in reality we'd be comparing buffers that aren't static.
39 | char* MakeStr(char c, int n)
40 | {
41 |     int i;
42 |     char* s = (char*)calloc(n+1, sizeof(c));
43 |     for(i=0; i<n; i++)
44 |         s[i] = c;
45 |     return s;
46 | }
47 |  
48 | int main()
49 | {
50 |  
51 |     // equal apart from last
52 |     char* aa = MakeStr('0', 64);
53 |     char* ab = "0000000000000000000000000000000000000000000000000000000000000001";
54 |  
55 |     // equal apart from first
56 |     char* ba = MakeStr('0', 64);
57 |     char* bb = "1000000000000000000000000000000000000000000000000000000000000000";
58 |  
59 |     // inequality in the middle
60 |     char* ca = "0000000000000000000000000000010000000000000000000000000000000000";
61 |     char* cb = "0000000000000000000000000000001000000000000000000000000000000000";
62 |  
63 |     // equal
64 |     char* da = MakeStr('0', 64);
65 |     char* db = MakeStr('0', 64);
66 |  
67 |     // first call to strcmp() and time functions will result in cache misses
68 |     // so we call it once and don't display output to account for that.
69 |     CheckEqual(aa, ab, false);
70 |  
71 |     printf("Completely equal, ");
72 |     CheckEqual(da, db, true);
73 |     printf("Equal but last, ");
74 |     CheckEqual(aa, ab, true);
75 |     printf("Equal but mid, ");
76 |     CheckEqual(ca, cb, true);
77 |     printf("Equal but first, ");
78 |     CheckEqual(ba, bb, true);
79 |  
80 |     free(aa); free(ba); free(da); free(db);
81 |     return 0;
82 | }
83 | 


--------------------------------------------------------------------------------