从HITCON Trainging lab13 学习Chunk Extend and Overlapping 攻击

Chunk Extend and Overlapping 学习

HITCON Trainging lab13题目地址

查看保护措施，RelRO为Partial，即可以修改GOT表项

用IDA分析一下

这个题目，定义了一种heap结构体，大概如下

struct heap
{
   
    int size;	 //heap的大小；占8字节
    int content; //指针，指向content；占8字节
}

下面是main函数，定义了菜单选项，按选项调用相关函数。

int __cdecl main(int argc, const char **argv, const char **envp)
{
   
  char buf; // [rsp+0h] [rbp-10h]
  unsigned __int64 v4; // [rsp+8h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  setvbuf(_bss_start, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 2, 0LL);
  while ( 1 )
  {
   
    menu();
    read(0, &buf, 4uLL);
    switch ( atoi(&buf) )
    {
   
      case 1:
        create_heap();
        break;
      case 2:
        edit_heap();
        break;
      case 3:
        show_heap();
        break;
      case 4:
        delete_heap();
        break;
      case 5:
        exit(0);
        return;
      default:
        puts("Invalid Choice");
        break;
    }
  }
}

create_heap函数，创建heap结构体

unsigned __int64 create_heap()
{
   
  _QWORD *v0; // rbx
  signed int i; // [rsp+4h] [rbp-2Ch]
  size_t size; // [rsp+8h] [rbp-28h]
  char buf; // [rsp+10h] [rbp-20h]
  unsigned __int64 v5; // [rsp+18h] [rbp-18h]

  v5 = __readfsqword(0x28u);
  for ( i = 0; i <= 9; ++i )
  {
   
    if ( !heaparray[i] )  //heaparray数组存储在bss段
    {
   
      heaparray[i] = malloc(0x10uLL); //heaparray保存heap结构体
      if ( !heaparray[i] )			  //heap结构体是这样的：
      {
   								  //{ QWORD size 
        puts("Allocate Error");		  //  QWORD  content_address
        exit(1);					  //}
      }
      printf("Size of Heap : ");
      read(0, &buf, 8uLL);
      size = atoi(&buf);
      v0 = heaparray[i];
      v0[1] =