NCTF2018之homura

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
__int64 __fastcall sub_C7C(__int64 a1, unsigned int a2)
{
  unsigned int i; // [rsp+1Ch] [rbp-4h]

  for ( i = 0; (signed int)i < (signed int)a2; ++i )
  {
    read(0, (void *)((signed int)i + a1), 1uLL);
    if ( *(_BYTE *)((signed int)i + a1) == 10 )
    {
      *(_BYTE *)((signed int)i + a1) = 0;
      return i;
    }
  }
  return a2;
}

int sub_CED()
{
  char nptr; // [rsp+0h] [rbp-20h]
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  sub_C7C(&nptr, 16LL);
  return atoi(&nptr);
}


int add()
{
  void **v1; // rbx
  _QWORD *v2; // rbx
  signed int i; // [rsp+4h] [rbp-1Ch]
  signed int v4; // [rsp+8h] [rbp-18h]
  signed int v5; // [rsp+Ch] [rbp-14h]

  for ( i = 0; i <= 14 && qword_202100[i]; ++i )
    ;
  if ( i > 14 )
    return puts("full!");
  qword_202100[i] = malloc(0x10uLL);
  v1 = (void **)qword_202100[i];
  *v1 = malloc(0x10uLL);
  printf("length of your name:");
  v4 = sub_CED();
  if ( v4 > 15 )
    v4 = 16;
  printf("your name:");
  sub_C7C(*qword_202100[i], (unsigned int)v4);
  printf("size of your message:");
  v5 = sub_CED();
  if ( v5 <= 128 || v5 > 4095 )
    v5 = 128;
  v2 = qword_202100[i];
  v2[1] = malloc(v5 + 16);
  printf("please leave your message:");
  sub_C7C(qword_202100[i][1], (unsigned int)v5);
  return puts("Done!");
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
int delete()
{
  signed int v1; // [rsp+Ch] [rbp-4h]

  printf("index:");
  v1 = sub_CED();
  if ( v1 < 0 || v1 > 14 )
    return puts("invalid");
  free((void *)*qword_202100[v1]);
  free((void *)qword_202100[v1][1]);
  free(qword_202100[v1]);
  qword_202100[v1] = 0LL;
  return puts("Done!");
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
int modify()
{
  int result; // eax
  signed int v1; // [rsp+8h] [rbp-18h]
  signed int v2; // [rsp+Ch] [rbp-14h]

  printf("index:");
  v2 = sub_CED();
  if ( v2 < 0 || v2 > 14 )
    return puts("invalid");
  if ( qword_202100[v2] )
    qword_2020E0 = (__int64)qword_202100[v2];
  result = qword_2020E0;
  if ( qword_2020E0 )
  {
    printf("size:");
    v1 = sub_CED();
    if ( v1 > strlen(*(const char **)(qword_2020E0 + 8)) )
      v1 = 16;
    printf("Hello %s you can modify your message >", *(_QWORD *)qword_2020E0);
    sub_C7C(*(_QWORD *)(qword_2020E0 + 8), (unsigned int)v1);
    result = puts("Done!");
  }
  return result;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
unsigned __int64 sub_1016()
{
  signed int v1; // [rsp+Ch] [rbp-34h]
  char s; // [rsp+10h] [rbp-30h]
  __int64 v3; // [rsp+28h] [rbp-18h]
  unsigned __int64 v4; // [rsp+38h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  if ( dword_202098 == -559038737 )
  {
    dword_202098 = 0;
    printf("index:");
    v1 = sub_CED();
    if ( v1 >= 0 && v1 <= 14 )
    {
      if ( qword_202100[v1] )
        qword_2020E0 = (__int64)qword_202100[v1];
      if ( qword_2020E0 )
      {
        printf("modify your message>");
        memset(&s, 0, 0x28uLL);
        sub_C7C(&s, 8LL);
        printf("Here you can modify once again!>", 8LL);
        sub_C7C(&v3, 8LL);
        memcpy(*(void **)(qword_2020E0 + 8), &s, 0x20uLL);
        puts("Done!");
      }
    }
    else
    {
      puts("invalid");
    }
  }
  return __readfsqword(0x28u) ^ v4;
}

1
2
3
4
5
6
7
8
struct note {  //malloc(0x10)

char *name; // malloc(0x10)

char *message; // malloc(0x90<=mem<=0x100f)

};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
while ((victim = unsorted_chunks(av)->bk) != unsorted_chunks(av)) {
    bck = victim->bk;
    if (__builtin_expect(chunksize_nomask(victim) <= 2 * SIZE_SZ, 0) ||
        __builtin_expect(chunksize_nomask(victim) > av->system_mem, 0))
        malloc_printerr(check_action, "malloc(): memory corruption",
                        chunk2mem(victim), av);
    size = chunksize(victim);

    /*
       If a small request, try to use last remainder if it is the
       only chunk in unsorted bin.  This helps promote locality for
       runs of consecutive small requests. This is the only
       exception to best-fit, and applies only when there is
       no exact fit for a small chunk.
     */
    /* 大小满足small_bin,且为last remainder chunk(很多时候并不满足)*/
    if (in_smallbin_range(nb) && bck == unsorted_chunks(av) &&
        victim == av->last_remainder &&
        (unsigned long) (size) > (unsigned long) (nb + MINSIZE)) {
        ....
    }

    /* remove from unsorted list */
    unsorted_chunks(av)->bk = bck;
    bck->fd = unsorted_chunks(av);
    
    /* 请求的大小刚好为上面从unsorted list尾移除的chunk大小 */
	if (size == nb) {
		set_inuse_bit_at_offset(victim, size);
		if (av != &main_arena)
		victim->size |= NON_MAIN_ARENA;
		check_malloced_chunk(av, victim, nb);
		void *p =  chunk2mem(victim);
		if ( __builtin_expect (perturb_byte, 0))
		alloc_perturb (p, bytes);
		return p;
	}
....