{"id":180,"date":"2025-11-13T17:54:17","date_gmt":"2025-11-13T09:54:17","guid":{"rendered":"http:\/\/www.xuanbin.top\/?p=180"},"modified":"2025-11-13T17:54:19","modified_gmt":"2025-11-13T09:54:19","slug":"house-of-force","status":"publish","type":"post","link":"http:\/\/www.xuanbin.top\/index.php\/2025\/11\/13\/house-of-force\/","title":{"rendered":"House Of Force"},"content":{"rendered":"\n<p>\u9002\u7528libc\u7248\u672c:2.23\u30012.27<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u601d\u8def<\/h2>\n\n\n\n<p>\u5229\u7528\u6ea2\u51fa\u4fee\u6539top chunk\u7684size\u4e3a-1\uff0c\u5728malloc\u65f6-1\u8f6c\u6362\u4e3a\u65e0\u7b26\u53f7\u6570\u540e\u8f93\u5165\u8d1f\u6570\u4e5f\u57fa\u672c\u80fd\u901a\u8fc7\uff0c\u63a7\u5236top chunk\u6307\u9488\u7684\u5411\u524d\u5411\u540e\u79fb\u52a8\u5b9e\u73b0\u4efb\u610f\u5730\u5740\u5199\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5229\u7528\u6761\u4ef6<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5b58\u5728\u5806\u6ea2\u51fa\uff0c\u53ef\u4ee5\u4fee\u6539top chunk\u7684size<\/li>\n\n\n\n<li>\u672a\u5bf9malloc\u7684size\u505a\u5927\u5c0f\u8fc7\u6ee4<\/li>\n\n\n\n<li>\u6cc4\u9732\u5806\u5730\u5740\uff08\u5982\u679c\u4ec5\u662ftop chunk\u5730\u5740\u7684\u76f8\u5bf9\u504f\u79fb\u5730\u5740\u5199\u4e0d\u9700\u8981\uff09<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u4f8b\u9898<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"405\" height=\"100\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947271-QQ_1762947266926.png\" alt=\"\" class=\"wp-image-182\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947271-QQ_1762947266926.png 405w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947271-QQ_1762947266926-300x74.png 300w\" sizes=\"auto, (max-width: 405px) 100vw, 405px\" \/><\/figure>\n\n\n\n<p>menu\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"581\" height=\"655\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947289-QQ_1762947285877.png\" alt=\"\" class=\"wp-image-183\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947289-QQ_1762947285877.png 581w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947289-QQ_1762947285877-266x300.png 266w\" sizes=\"auto, (max-width: 581px) 100vw, 581px\" \/><\/figure>\n\n\n\n<p>show\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"699\" height=\"237\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947313-QQ_1762947298911.png\" alt=\"\" class=\"wp-image-184\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947313-QQ_1762947298911.png 699w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947313-QQ_1762947298911-300x102.png 300w\" sizes=\"auto, (max-width: 699px) 100vw, 699px\" \/><\/figure>\n\n\n\n<p>add\uff1aread\u7684\u7b2c\u4e09\u4e2a\u53c2\u6570v2\u7531\u6709\u7b26\u53f7\u6570\u8f6c\u4e3a\u65e0\u7b26\u53f7\u6570\uff0c\u5b58\u5728\u4efb\u610f\u957f\u5ea6\u6ea2\u51fa<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"664\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947401-QQ_1762947397025.png\" alt=\"\" class=\"wp-image-185\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947401-QQ_1762947397025.png 936w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947401-QQ_1762947397025-300x213.png 300w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947401-QQ_1762947397025-768x545.png 768w\" sizes=\"auto, (max-width: 936px) 100vw, 936px\" \/><\/figure>\n\n\n\n<p>edit\uff1aedit\u6ca1\u505anew length\u68c0\u67e5\uff0c\u57fa\u672c\u65e0\u6761\u4ef6\u7684\u4efb\u610f\u957f\u5ea6\u6ea2\u51fa<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"886\" height=\"594\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947493-QQ_1762947488828.png\" alt=\"\" class=\"wp-image-186\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947493-QQ_1762947488828.png 886w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947493-QQ_1762947488828-300x201.png 300w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947493-QQ_1762947488828-768x515.png 768w\" sizes=\"auto, (max-width: 886px) 100vw, 886px\" \/><\/figure>\n\n\n\n<p>delete\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"560\" height=\"562\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947539-QQ_1762947534982.png\" alt=\"\" class=\"wp-image-187\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947539-QQ_1762947534982.png 560w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947539-QQ_1762947534982-300x300.png 300w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947539-QQ_1762947534982-150x150.png 150w\" sizes=\"auto, (max-width: 560px) 100vw, 560px\" \/><\/figure>\n\n\n\n<p>\u5b58\u5728\u540e\u95e8\u51fd\u6570<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"486\" height=\"239\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947568-QQ_1762947563140.png\" alt=\"\" class=\"wp-image-188\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947568-QQ_1762947563140.png 486w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1762947568-QQ_1762947563140-300x148.png 300w\" sizes=\"auto, (max-width: 486px) 100vw, 486px\" \/><\/figure>\n\n\n\n<p>\u56e0\u4e3agoodbye_message\u51fd\u6570\u5728exit\u65f6\u4f1a\u6267\u884c\uff0c\u540c\u65f6\u53c8\u662f\u521d\u59cb\u5316\u65f6malloc\u5b58\u50a8\u5728v4[1]\u7684\u5730\u5740\uff0c\u6ee1\u8db3top chunk\u7684\u76f8\u5bf9\u504f\u79fb\u6761\u4ef6\uff0c\u4e0d\u9700\u8981\u6cc4\u9732\u5806\u5730\u5740\u3002\u6574\u4f53\u601d\u8def\u5c31\u662fedit\u8986\u76d6top chunk\u7684size\uff0c\u63a7\u5236top chunk\u5730\u5740\u5230v4[1]\uff0c\u7136\u540ecreate\u8986\u76d6v4[1]\u5185\u5bb9\u4e3a\u540e\u95e8\u51fd\u6570\u5730\u5740\uff0c\u6700\u540eexit\u89e6\u53d1\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tips<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u5982\u4f55\u8ba1\u7b97\u63a7\u5236top chunk\u79fb\u52a8\u7684offset\uff1f<\/h3>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"532\" height=\"260\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763027392-QQ_1763027389022.png\" alt=\"\" class=\"wp-image-191\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763027392-QQ_1763027389022.png 532w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763027392-QQ_1763027389022-300x147.png 300w\" sizes=\"auto, (max-width: 532px) 100vw, 532px\" \/><\/figure>\n\n\n\n<p>\u5bf9\u4e8e\u56fe\u4e2d\u5185\u5b58\uff0c0x1391a2c0\u662ftop chunk\u7684\u5730\u5740\uff0c\u5e0c\u671b\u5411\u524d\u79fb\u52a8\u52300x1391a250\u3002<\/p>\n\n\n\n<p>\u75310x1391a2c0-0x1391a250=0x70\uff0c\u6b64\u65f6\u9700\u8981top chunk\u5730\u5740\u5411\u524d\u79fb\u52a80x70\uff0c\u800cmalloc\u7533\u8bf7\u5185\u5b58\u7a7a\u95f4\u65f6\u4f1a\u9644\u5e26\u4e0achunk\u5934\u4ee5\u53ca\u8fdb\u884c\u5185\u5b58\u5bf9\u9f50\uff0c\u6240\u4ee5\u9700\u8981malloc(-0x80)\u3002<\/p>\n\n\n\n<p>\u5bf9\u4e8e\u5411\u540e\u79fb\u52a8\uff0c\u5047\u8bbetarget_addr=0x200\uff0ctopchunk_addr=0x100\uff0c\u6b64\u65f6\u5e94malloc((0x200-0x100)-0x10)\uff0c\u5373malloc(0x90)\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9002\u7528libc\u7248\u672c:2.23\u30012.27 \u601d\u8def \u5229\u7528\u6ea2\u51fa\u4fee\u6539top chunk\u7684size\u4e3a-1\uff0c\u5728malloc\u65f6-1\u8f6c\u6362\u4e3a\u65e0\u7b26\u53f7\u6570\u540e\u8f93 &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-180","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/comments?post=180"}],"version-history":[{"count":5,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/180\/revisions"}],"predecessor-version":[{"id":193,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/180\/revisions\/193"}],"wp:attachment":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/media?parent=180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/categories?post=180"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/tags?post=180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}