ImanHosseini

#include <vector>
#include <stdlib.h>
#include <stdio.h>
#include <math.h>

// Choose prec...
typedef double FLT;
//typedef float FLT;

static inline void evaluate_kernel_vector(FLT * __restrict__ ker, const FLT * __restrict__ args, const FLT beta, const FLT c, const int N)

ImanHosseini

Iman Hosseini

Avid positivist. Retired CTF player. Physicist at heart. GPU connoisseur. HPC Compilers aficionado.

---

Computer Science PhD student @ NYU since 2019 in MESS Lab, supervised by Brendan Dolan-Gavitt
Compiler Engineer Intern @ NVIDIA during summer 2022 and summer 2023
Finished 1st in SC'22 Parallel Programming Marathon
Finished 2nd in DEFCON 30 CTF Finals in Vegas (captained Katzebin)
Finished 3rd in Arm HPC User Group Hackaton 2021
BSc Theoretical Physics, Sharif University (Iran) 2019
BSc Computer Engineering, Sharif University (Iran) 2019

ImanHosseini

import torch
import torch.nn as nn

from datasets import load_dataset
import functools
from collections import defaultdict
from transformers.models.opt.modeling_opt import OPTForCausalLM
from transformers.models.gptj.modeling_gptj import GPTJForCausalLM
from functools import partial
import numpy as np

ImanHosseini

# 1 "cv.cu"
# 1 "<built-in>"
# 1 "<command-line>"
# 1 "/usr/include/stdc-predef.h" 1 3 4
# 1 "<command-line>" 2
# 1 "/usr/local/cuda-11.3/bin/../targets/x86_64-linux/include/cuda_runtime.h" 1
# 61 "/usr/local/cuda-11.3/bin/../targets/x86_64-linux/include/cuda_runtime.h"
#pragma GCC diagnostic push

ImanHosseini

// #cc -fPIC -shared -o myunlink.so myunlink.c -ldl
// #LD_PRELOAD=./unlk/myunlink.so gcc h.c
#include <string.h>

int unlink(const char *name){
    int (*_unlink)(const char*) = dlsym(RTLD_NEXT, "unlink");
    int i = 1;
    char c0 = name[0];
    char c1 = name[1];
    while (name[++i] != '\0'){

ImanHosseini

# 1 "cv.cu"
# 1 "<built-in>"
# 1 "<command-line>"
# 1 "/usr/include/stdc-predef.h" 1 3 4
# 1 "<command-line>" 2
# 1 "/usr/local/cuda-11.3/bin/../targets/x86_64-linux/include/cuda_runtime.h" 1
# 61 "/usr/local/cuda-11.3/bin/../targets/x86_64-linux/include/cuda_runtime.h"
#pragma GCC diagnostic push

ImanHosseini

NCORE Writeup

Writeup to ncore challenge CSAW'21 quals. This was my 2nd time authoring a chal @ CSAW and I hope ppl enjoyed it. Security enclaves are the idea behind Intel SGX, which allow for having portions of "private" memory.
User sends byte data, we run sim, send out the results. It's a tiny cpu, hooked up to a ram and a safe-rom, with a key that is initialized per each run, they send us the ram contents and their program gets executed. The idea is that they must bruteforce the key in the ISA of this tiny cpu. As it is a made-up ISA, you have to do the plumbing yourself and assemble together your shellcode.
The main challenge is that the memory ops only support direct accessing, so imagine you have a for loop to read bytes, "R0 <- MEM(i)" looping over i, you cannot put i in a regsiter and increment because in a move instructions you have to specify the address explicitly, i.e. "R0 <- MEM(0)" where the 0 is encoded into the instructions. The solution to this challenge is that well, as it is

ImanHosseini

from OpenGL.GL import *
from OpenGL.GLUT import *
from OpenGL.GLU import *
import time
import math

B = 6000    
L = 3000
H = 400
g = 1000.0

ImanHosseini

import random, string

def random_alphanumeric(length=8):
    lettersAndDigits = string.ascii_letters + string.digits
    return ''.join((random.choice(lettersAndDigits) for i in range(length)))

def gen_basictype(type):
    if type=='Int':
        return str(random.randint(0,100))
    if type=='Bool':

ImanHosseini

The simplest attempt, just set "CC" to "gcc -g" in the environment. Easy right?

1. Some Makefiles, redefine "CC" inside them.
   SOLUTION: skim through Makefiles and delete any definition of CC
2. Some Makefiles simply don't use CC, they just do "gcc source.c -o output"
   SOLUTION: skim through Makefiles, check if this happens and if it does add the "-g" inline
3. Some projects don't even compile with the provided Makefile!
   NO SOLUTION! Just skip 'em.