android 栈溢出 检查,Android栈溢出漏洞利用练习

按照以下改动修改linker代码，重新编译ROM

diff --git a/linker/linker.cpp b/linker/linker.cpp

index c78b9aba6..d20995162 100644

--- a/linker/linker.cpp

+++ b/linker/linker.cpp

@@ -1493,13 +1493,13 @@ static bool find_library_internal(android_namespace_t* ns,

static void soinfo_unload(soinfo* si);

-static void shuffle(std::vector* v) {

- for (size_t i = 0, size = v->size(); i < size; ++i) {

- size_t n = size - i;

- size_t r = arc4random_uniform(n);

- std::swap((*v)[n-1], (*v)[r]);

- }

-}

+// static void shuffle(std::vector* v) {

+// for (size_t i = 0, size = v->size(); i < size; ++i) {

+// size_t n = size - i;

+// size_t r = arc4random_uniform(n);

+// std::swap((*v)[n-1], (*v)[r]);

+// }

+// }

// add_as_children - add first-level loaded libraries (i.e. library_names[], but

// not their transitive dependencies) as children of the start_with library.

@@ -1603,7 +1603,7 @@ bool find_libraries(android_namespace_t* ns,

load_list.push_back(task);

}

}

- shuffle(&load_list);

+ // shuffle(&load_list);

for (auto&& task : load_list) {

if (!task->load()) {

diff --git a/linker/linker_phdr.cpp b/linker/linker_phdr.cpp

index a5eab44ec..4c6cdf494 100644

--- a/linker/linker_phdr.cpp

+++ b/linker/linker_phdr.cpp

@@ -548,6 +548,7 @@ static void* ReserveAligned(void* hint, size_t size, size_t align) {

uint8_t* first = align_up(mmap_ptr, align);

uint8_t* last = align_down(mmap_ptr + mmap_size, align) - size;

size_t n = arc4random_uniform((last - first) / PAGE_SIZE + 1);

+ n = 1;

uint8_t* start = first + n * PAGE_SIZE;

munmap(mmap_ptr, start - mmap_ptr);

munmap(start + size, mmap_ptr + mmap_size - (start + size));