Important differences w.r.t. a regular Linux system:

No signal handling. (But note that QEMU itself needs to handle some of them.)
In particular, no SIGPIPE (it's probably OK to just ignore it, write() knows it can return EPIPE).
Syscall auto-restart (EINTR should never be returned)
Syscalls return either 0 or a positive error value.
Only int 0x80 is allowed.
ADDR_NO_RANDOMIZE and STICKY_TIMEOUTS are set.

A cgc_bytes field exists in task_struct, unclear why (seems to equal the number of bytes handled by the last syscall).

Initial state

https://github.com/CyberGrandChallenge/libcgc/blob/master/cgcabi.md

Initial stack

Pages are auto-allocated, rwx, zeroed. Maximum size: 8MB

 Initial EIP: 0xbaaaaffc
              8MB (max)

Guess result: 0xbaaa b000 INVALID 0xbaaa afff first valid dword . 0xbaaa affc first valid dword

           |
           |     grows downward, as usual
           _
                 8 MB max

 0xb2aab000    last possible valid dword

Flag page

Flag page retrieval [PoV type 2] for (this) CFE:

 any 4 contiguous bytes
   in
 page [ 0x4347C000 .. 0x4347CFFF ]

https://github.com/CyberGrandChallenge/cgc-release-documentation/blob/master/walk-throughs/submitting-a-cb.md

Simple test with the VM's gdb

maps:

08048000-08049000 r-xp 00000000 fe:01 107659     /home/vagrant/passacarte
4347c000-4347d000 r--p 00000000 00:00 0
baa8b000-baaab000 rwxp 00000000 00:00 0          [stack]

gdb info:

Breakpoint 1, 0x080480c0 in _start ()
(gdb) info r
eax            0x0  0
ecx            0x4347c000   1128775680
edx            0x0  0
ebx            0x0  0
esp            0xbaaaaffc   0xbaaaaffc
ebp            0x0  0x0
esi            0x0  0
edi            0x0  0
eip            0x80480c0    0x80480c0 <_start>
eflags         0x202    [ IF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x7b 123
gs             0x7b 123

(gdb) info float
  R7: Empty   0x00000000000000000000
  R6: Empty   0x00000000000000000000
  R5: Empty   0x00000000000000000000
  R4: Empty   0x00000000000000000000
  R3: Empty   0x00000000000000000000
  R2: Empty   0x00000000000000000000
  R1: Empty   0x00000000000000000000
=>R0: Empty   0x00000000000000000000

Status Word:         0x0000
                       TOP: 0
Control Word:        0x037f   IM DM ZM OM UM PM
                       PC: Extended Precision (64-bits)
                       RC: Round to nearest
Tag Word:            0xffff
Instruction Pointer: 0x00:0x00000000
Operand Pointer:     0x00:0x00000000
Opcode:              0x0000


(gdb) p *((unsigned char*) 0xbaaab000)
Cannot access memory at address 0xbaaab000

(gdb) x/x $esp
0xbaaaaffc: 0x00000000

BUT: p *(unsigned char*)0xba2aa000 Causes a kernel panic!

kernel BUG at mm/memory.c:1838!
invalid opcode: 0000 [#2] SMP
Modules linked in: fbcon bitblit softcursor font qxl drm_kms_helper ttm drm i2c_core fb fbdev virtio_blk virtio_net virtio_pci virtio_ring virtio
CPU: 0 PID: 3193 Comm: gdb Tainted: G      D       3.13.11-ckt21+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: c743ccb0 ti: c69a0000 task.ti: c69a0000
EIP: 0060:[<c10af1f9>] EFLAGS: 00010246 CPU: 0
EIP is at __get_user_pages.part.12+0x429/0x430
EAX: 00000040 EBX: 00000016 ECX: c76c4d40 EDX: 00000000
ESI: c7655880 EDI: c6b4ad70 EBP: ba2aa000 ESP: c69a1dbc
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
CR0: 8005003b CR2: 082dc530 CR3: 06806000 CR4: 000007f0
Stack:
 c64583c0 00000010 c743ccb0 00000000 00000296 cac74000 c6efbc00 cac74034
 00000296 00000000 c64583c0 00000004 ba2aa000 c69a1e74 c10af378 00000001
 00000016 c69a1e24 c69a1e20 00000000 c1097071 c64583c0 c6b4ad70 00000016
Call Trace:
 [<c10af378>] ? __access_remote_vm+0xb8/0x160
 [<c1097071>] ? get_page_from_freelist+0x431/0x540
 [<c10af6a9>] ? access_process_vm+0x29/0x50
 [<c103de0f>] ? ptrace_request+0x49f/0x6d0
 [<c10ab229>] ? __do_fault+0x419/0x5d0
 [<c10ae4dd>] ? handle_mm_fault+0x11d/0xa10
 [<c100b070>] ? arch_ptrace+0x320/0x4b0
 [<c102dec3>] ? __do_page_fault+0x163/0x460
 [<c102df96>] ? __do_page_fault+0x236/0x460
 [<c1053f9a>] ? task_rq_lock+0x3a/0x70
 [<c1055892>] ? wait_task_inactive+0x72/0xe0
 [<c103e24b>] ? SyS_ptrace+0x20b/0x580
 [<c138ba0c>] ? default_syscall+0x12/0x12
Code: e0 05 03 05 e4 c2 54 c1 89 c2 e9 58 ff ff ff 89 d0 89 54 24 20 e8 08 b7 fe ff 8b 54 24 20 84 c0 0f 85 8a fd ff ff e9 52 ff ff ff <0f> 0b 90 8d 74 26 00 55 57 56 53 83 ec 04 8b 74 24 1c 8b 5c 24
EIP: [<c10af1f9>] __get_user_pages.part.12+0x429/0x430 SS:ESP 0068:c69a1dbc

configure

Use either ./cgc_configure_debug or ./cgc_configure_opt

(Note that --disable-werror should not be necessary, but you may not want to waste time on that.)

mechaphish/qemu-cgc

Initial state

Initial stack

Flag page

Simple test with the VM's gdb

configure