Skip to content

Latest commit

 

History

History

pwn-young_heap

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
Makefile
Makefile
 
 
README
README
 
 
hack.py
hack.py
 
 
heap.c
heap.c
 
 
heap.h
heap.h
 
 
libc.so.6
libc.so.6
 
 
main.c
main.c
 
 
solve.md
solve.md
 
 

README

A malloc and free Method for 64bit

    chunk struct
    |--------------------|
    | Last Chunk Size    |  last bit 0:free, 1:use
    |--------------------|  last two bit: 1:mmaped chunk
    | Chunk Size         |
    |--------------------|
    | Content or Next ptr|
    |                    |
    |--------------------|


bins_ptr

----------------------------------------------------------------------------------
    big chunk   |   0x18   |    0x20    |    0x28    |    0x30    |   0x38   | ...
-------|-------------|------------------------|------------------------|----------
       |             |                        |                        |
  |---------|   |---------|              |---------|               |---------|
  |  Chunk  |   |  Chunk  |              |  Chunk  |               |  Chunk  |
  |         |   |         |              |         |               |         |
  |         |   |         |              |         |               |         |
  |---------|   |---------|              |---------|               |---------|
       |             |                        |                        |
  |---------|   |---------|              |---------|               |---------|
  |  Chunk  |   |  Chunk  |              |  Chunk  |               |  Chunk  |
  |         |   |         |              |         |               |         |
  |         |   |         |              |         |               |         |
  |---------|   |---------|              |---------|               |---------|
       |             |                                                 |
  |---------|   |---------|                                        |---------|
  |  Chunk  |   |  Chunk  |                                        |  Chunk  |
  |         |   |         |                                        |         |
  |         |   |         |                                        |         |
  |---------|   |---------|                                        |---------|
      ...           ...