hitcon_2018_children_tcache

最新推荐文章于 2025-12-18 14:34:50 发布

原创

最新推荐文章于 2025-12-18 14:34:50 发布 · 234 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#安全

hitcon_2018_children_tcache

    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  Enabled

64位，保护全开

unsigned __int64 ADD()
{
  int i; // [rsp+Ch] [rbp-2034h]
  char *dest; // [rsp+10h] [rbp-2030h]
  unsigned __int64 size; // [rsp+18h] [rbp-2028h]
  char s[8216]; // [rsp+20h] [rbp-2020h] BYREF
  unsigned __int64 v5; // [rsp+2038h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  memset(s, 0, 0x2010uLL);
  for ( i = 0; ; ++i )
  {
    if ( i > 9 )
    {
      puts(":(");
      return __readfsqword(0x28u) ^ v5;
    }
    if ( !qword_202060[i] )
      break;
  }
  printf("Size:");
  size = READ();
  if ( size > 0x2000 )
    exit(-2);
  dest = (char *)malloc(size);
  if ( !dest )
    exit(-1);
  printf("Data:");
  sub_BC8((__int64)s, size);
  strcpy(dest, s);
  qword_202060[i] = dest;
  qword_2020C0[i] = si