利用chunk重设大小攻击堆

只是笔记························································

堆块学习···

DWORD SHOOT

下面环境为  XP   sp3 VC6.0  RELEASE

#include <windows.h>

int main()  
{  
    HLOCAL h1 = 0, h2 = 0;  
    HANDLE hp;  
    hp = HeapCreate(0,0x1000,0x10000);  
    h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,0x10);  

    return 0;  
}  

xp 下面介绍 CHUNK插入链表的过程：

执行完 HeapCreate 后  

开始拆卸链表:

接着开始关键部分: