\documentclass[12pt]{exam}
\usepackage[homework,id=1]{cs161}
\usepackage{graphicx}
\usepackage{listings}
\usepackage{pdfpages}
\usepackage{array}
\usepackage{hyperref}
\usepackage{subfiles}
\usepackage{etoolbox}

\lstset{
language=C,                % choose the language of the code
basicstyle=\scriptsize,       % the size of the fonts that are used for the code
numbers=left,                   % where to put the line-numbers
numberstyle=\scriptsize,      % the size of the fonts that are used for the line-numbers
stepnumber=1,                   % the step between two line-numbers. If it is 1 each line will be numbered
numbersep=5pt,                  % how far the line-numbers are from the code
backgroundcolor=\color{white},  % choose the background color. You must add \usepackage{color}
showspaces=false,               % show spaces adding particular underscores
showstringspaces=false,         % underline spaces within strings
showtabs=false,                 % show tabs within strings adding particular underscores
frame=single,           % adds a frame around the code
tabsize=2,          % sets default tabsize to 2 spaces
captionpos=b,           % sets the caption-position to bottom
breaklines=true,        % sets automatic line breaking
breakatwhitespace=false,    % sets if automatic breaks should only happen at whitespace
escapeinside={\%*}{*)}          % if you want to add a comment within your code
}

\newcommand{\solbox}[2]{%
\fbox{%
\parbox[c][#1][t]{\dimexpr\linewidth-2\fboxsep-2\fboxrule}{
  \hrule width \hsize height 0pt
  #2
 }%
}%
\par\vspace{\ht\strutbox}
}
\makeatother

\usepackage{etoolbox}
\newtoggle{pdfform}
\togglefalse{pdfform} % may be toggled true in configuration

\InputIfFileExists{config}{}

\newcommand{\textfield}[3]{%
\iftoggle{pdfform}{%
\TextField[name = #1, backgroundcolor=white, height=#2,
width = \linewidth, multiline=true]{\mbox}%
}{%
\ifprintanswers\else{%
    \solbox{#2}{#3}}
\fi%
}%
}

\newcommand{\includesolution}[1]{%
\IfFileExists{solutions/#1.tex}{%
\begin{solution}%
\subfile{solutions/#1.tex}%
\end{solution}%
}{}
}

\newcommand{\checkbox}[3]{%
\ifprintanswers\else%
\CheckBox[name = #1, checked = #3, backgroundcolor=white, bordercolor=black, #2]{}%
\fi%
}

\def\duedate{Tuesday, 5 February 2019}

\begin{document}
\begin{Form}

\begin{center}
  \large
  Due: \duedate, at 11:59pm
\end{center}

\paragraph{Instructions.}
This homework is due on \textbf{\duedate, at 11:59pm}. No late homeworks will be accepted unless you have prior accomodations from us.
This assignment must be done on your own.

Create an EECS instructional class account if you have not already. To do so,
visit \url{https://inst.eecs.berkeley.edu/webacct/}, click ``Login
using your Berkeley CalNet ID,'' then find the cs161 row and click ``Get a new
account.'' Be sure to take note of the account login and password, and log in to
your instructional account.

Make sure you have a Gradescope account and are joined in this course.  The
homework \emph{must} be submitted electronically via Gradescope (not by
any other method).  Your answer for each question,
when submitted on Gradescope, should be a
single file with each question's answer on a separate page.

\begin{questions}
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%QUESTION 1%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
\titledquestion{Policy}[10]

The aim of this exercise is to ensure that you read the course policies, as
well as to make sure that you are registered in the class and have a working
EECS instructional class account.

Open the course website \url{http://inst.eecs.berkeley.edu/~cs161/sp19/}.

Read the course policies and answer the following question:

How many project ``slip days'' do you get?

\textfield{Q1}{0.5cm}{
%Your solution to Q1 here
    0
}

\vspace{0.12em}

\includesolution{sol1}

\newpage
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%QUESTION 2%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
\titledquestion{Collaboration}[10]

You're working on a course project.
Your code isn't working, and you can't figure out why not.
Is it OK to show another student (who is not your project partner) your
draft code and ask them if they have any idea why your code is broken
or any suggestions for how to debug it?\\\\
Select if yes \checkbox{Q2Y}{}{
%Yes/No directions: change this argument to 'true' to check the box
%Alternatively, export and check the box using a pdf editor
false}


\includesolution{sol2}

\newpage
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%QUESTION 3%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
\titledquestion{Security Principles}[20]
For each of the following paragraphs, there is exactly one security principle that best applies to the situation described. Select the best \textbf{four options} from below after reading the following scenario:

Getting on the cryptocurrency hype, one day Bob decides to set up his own exchange. He
sets up all the infrastructure, but worries about forgetting the password, so Bob hides
his login credentials in an HTML comment on the login page.

Eventually, Bob manages to gather a large user-base and realizes his site looks like a
back-end developer trying to learn CSS, so he contracts out front-end work to Mallory's
Do-No-Evil design firm (for an incredible price too!). He gives them an account with access
to his front-end and back-end codebase, and databases of user information as well.

Finally, Bob wants to enforce password security. Bob requires every user to use a "super-secure" 
password; that is, the password cannot contain any English word, cannot contain any birthday, and 
must have many special characters (e.g., \$ \%). The user needs to type in this password every 5 minutes. 
Bob disables the clipboard on the password field; in this way, the user must manually enter the password, nothing else. 

Unfortunately for him, one day he wakes up to his website being
featured on a well-known news site after a data leak. Pressured by an
internet mob, he hires a contractor to find all the issues with his
site. However, fixing the website ended up being a different story,
as much of the code was written (uncommented) in a late-night
coffee-fuled frenzy, and Bob finds that he can't change any aspect of
the website without breaking it in its entirety.  In a panic, Bob
announced the closure of his site and goes into hiding.

\begin{tabular}{m{12cm} m{3.5cm}}
1. Does Bob violate \textbf{security is economics}?
& Select if yes \checkbox{Q2P1Y}{width=1.5em}{
%Yes/No directions: uncomment 'X' to make it appear
X
}\\\\

2. Does Bob violate \textbf{least privilege}?
& Select if yes \checkbox{Q3P2Y}{width=1.5em}{
%X
}\\\\

3. Does Bob violate \textbf{fail-safe defaults}?
& Select if yes \checkbox{Q3P3Y}{width=1.5em}{
X
}\\\\

4. Does Bob violate \textbf{separation of responsibility}?
& Select if yes \checkbox{Q3P4Y}{width=1.5em}{
X
}\\\\

5. Does Bob violate \textbf{don't rely on security by obscurity}?
& Select if yes \checkbox{Q3P5Y}{width=1.5em}{
%X
}\\\\

6. Does Bob violate \textbf{consider human factors}?
& Select if yes \checkbox{Q3P6Y}{width=1.5em}{
%X
}\\\\

7. Does Bob violate \textbf{complete mediation}?
& Select if yes \checkbox{Q3P7Y}{width=1.5em}{
X
}\\\\

8. Does Bob violate \textbf{detect if you can't protect}?
& Select if yes \checkbox{Q3P8Y}{width=1.5em}{
X
}\\\\

9. Does Bob violate \textbf{design security in from the start}?
& Select if yes \checkbox{Q3P9Y}{width=1.5em}{
%X
}\\\\

\end{tabular}
\includesolution{sol3}


%\newpage
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%QUESTION 4%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
\titledquestion{Vulnerable Code}[40]
Consider the following C code:
\begin{lstlisting}
void greet(char *arg)
{
  char buffer[12];
  printf(``I am the Senate. What is your name?\n");
  scanf(``%s", buffer);
  printf(``It's treason then, %s\n", buffer);
}

int main(int argc, char *argv[])
{
  char beg[3] = `Obi';
  char end[11] = `Wan Kenobi?';
  strncat(beg, end, 5);
  greet(argv[1]);
  return 0;
}
\end{lstlisting}

\begin{enumerate}
  \item What is the line number that has a memory vulnerability? \\
\textfield{Q4P1}{0.5cm}{
%Your solution to Q4 part 1 here
    5
}
  \item What is this vulnerability called?\\
\textfield{Q4P2}{0.5cm}{
%Your solution to Q4 part 2 here
    buffer overflow attack
}
  \item Just before the program executes the line in part 1, the registers are:
    \begin{center}
      \texttt{\%esp: 0xBFFFF820}
      \hspace{2cm}
      \texttt{\%ebp: 0xBFFFF848}
    \end{center}
    Given this information, describe in detail how an attacker would take advantage of the vulnerability.
    Also make sure to include the address that the attacker needs to over-write. (Maximum 5 sentences)\\
\textfield{Q4P3}{2.7cm}{
%Your solution to Q4 part 3 here
    The most simple exploit is code injection. The attacker should input more than 12 characters (I can't determine the exact number because of memory alignment issue) and overwrite the function return address area. The address that the attacker need to overwrite is 0xbffff820. By the way, the attacker can printf any stack data as he want.
}
  \item What would you change to fix the problem in part 1?\\
\textfield{Q4P4}{4cm}{
%Your solution to Q4 part 4 here
    Please use C++ std::getline rather than unsafe scanf. An example written by me is here: \url{https://github.com/recolic/rlib/blob/3a442c6dd8661d45cfe7528112b93c42ffa5d591/stdio.hpp\#L52} \\
    
        If I must figure out the implementation of std::getline, please read here: \url{https://github.com/recolic/rlib/blob/3a442c6dd8661d45cfe7528112b93c42ffa5d591/sys/sio.hpp\#L516}
}
  \item Given the code as is, would stack canaries prevent exploitation of this vulnerability?\\
      Select if yes \checkbox{Q4P5Y}{}{
      %Yes/No directions: change this argument to 'true' to check the box
      %Alternatively, export and check the box using a pdf editor
      false}\\
    Why or why not?\\
\textfield{Q4P5}{2cm}{
%Your solution to Q4 part 5 here
    Stack canaries can make the exploit harder, but it won't prevent the exploitation. The attacker can still printf data on stack. However, canaries are still very very useful to protect this program. I considered for some time and answer "no".
}
\end{enumerate}
\includesolution{sol4}


\newpage
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%QUESTION 5%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
\titledquestion{Reasoning About Memory Safety}[35]

Consider the following C code.

\begin{lstlisting}
/* (a) Precondition: ____________________ */
void dectohex(uint32_t decimal, char* hex) {
    char tmp[9];
    int digit, j = 0, k = 0;
    do {
        digit = decimal % 16;
        if (digit < 10) {
            digit += '0';
        } else {
            digit += 'A' - 10;
        }
        /* (b) Invariant: _______________ */
        tmp[j++] = digit;
        decimal /= 16;
    } while (decimal > 0);
    while (j > 0) {
        hex[k++] = tmp[--j];
        /* (c) Invariant: _______________ */
    }
    hex[k] = '\0';
}
\end{lstlisting}

\begin{enumerate}
\item Please identify the \textbf{preconditions} that must hold true for the following code to be memory safe. In addition, the precondition must be as conservative as possible (e.g. \texttt{decimal} cannot be required to be solely zero). Justify why your given precondition cannot be any less strict.\\
\textfield{Q5P1}{4.5cm}{
%Your solution to Q5 part 1 here
    Argument `hex` must be a valid pointer to a writable memory space, and its size must be at least 9 bytes.  \\

    If my precondition is not true, one of the following thing happens: 1. The pointer hex is invalid. It will
        write some random memory address or cause segmentation fault. 2. The buffer size is less than 9 bytes.
        Because 32bit unsigned integer has maximum value "0xffffffff", and we have k<=8. So buffer size must be 
        at least 9 byte to avoid buffer overflow.

}
\item Please identify the loop \textbf{invariants} (b, c) that must hold true and justify them as well.\\
\textfield{Q5P2}{4.5cm}{
%Your solution to Q5 part 2 here
    b: j>=0 \&\& j<=7 \\

    c: j>=1 \&\& j<=8, k>=0 \&\& k<=7
}
\end{enumerate}
\includesolution{sol5}

\newpage


%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%FEEDBACK%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%
\titledquestion{Feedback}[0]

Optionally, feel free to include feedback.  What's the single thing we could do
to make the class better?  Or, what did you find most difficult or confusing from
lectures or the rest of class, and what would you like to see explained better?
If you have feedback, submit your comments as your answer to Q{\thequestion}.\\
\textfield{Feedback}{15cm}{
%Your feedback here
}
\includesolution{feedback}


\end{questions}
\end{Form}
\end{document}

