Rooba
/
how2heap
mirror of https://github.com/shellphish/how2heap.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fixed wrong target top size calculation, only relevant for Constants printed at top

This commit is contained in:
gfelber 2024-04-08 13:12:19 +02:00
parent 21fbbb0366
commit 1f2987a134
9 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
glibc_2.23/sysmalloc_int_free.c
View File

@ -58,7 +58,7 @@ int main() {
printf("fencepost size \t\t= 0x%lx\n", FENCEPOST);
printf("freed size \t\t= 0x%lx\n", FREED_SIZE);
printf("target top chunk size \t= 0x%lx\n", CHUNK_FREED_SIZE + FENCEPOST);
printf("target top chunk size \t= 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_FREED_SIZE);
// probe the current size of the top_chunk,
// can be skipped if it is already known or predictable

2
glibc_2.27/house_of_tangerine.c
View File

@ -66,7 +66,7 @@ int main() {
printf("fencepost size = 0x%lx\n", FENCEPOST);
printf("size_1 = 0x%lx\n", SIZE_1);
printf("target tcache top size = 0x%lx\n", CHUNK_SIZE_1 + FENCEPOST);
printf("target tcache top size = 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_SIZE_1);
// target is malloc chunk aligned 0x10 for x86_64
target = ((size_t) win + (MALLOC_ALIGN - 1)) & MALLOC_MASK;

2
glibc_2.27/sysmalloc_int_free.c
View File

@ -58,7 +58,7 @@ int main() {
printf("fencepost size \t\t= 0x%lx\n", FENCEPOST);
printf("freed size \t\t= 0x%lx\n", FREED_SIZE);
printf("target top chunk size \t= 0x%lx\n", CHUNK_FREED_SIZE + FENCEPOST);
printf("target top chunk size \t= 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_FREED_SIZE);
// probe the current size of the top_chunk,
// can be skipped if it is already known or predictable

2
glibc_2.31/house_of_tangerine.c
View File

@ -66,7 +66,7 @@ int main() {
printf("fencepost size = 0x%lx\n", FENCEPOST);
printf("size_1 = 0x%lx\n", SIZE_1);
printf("target tcache top size = 0x%lx\n", CHUNK_SIZE_1 + FENCEPOST);
printf("target tcache top size = 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_SIZE_1);
// target is malloc chunk aligned 0x10 for x86_64
target = ((size_t) win + (MALLOC_ALIGN - 1)) & MALLOC_MASK;

2
glibc_2.31/sysmalloc_int_free.c
View File

@ -58,7 +58,7 @@ int main() {
printf("fencepost size \t\t= 0x%lx\n", FENCEPOST);
printf("freed size \t\t= 0x%lx\n", FREED_SIZE);
printf("target top chunk size \t= 0x%lx\n", CHUNK_FREED_SIZE + FENCEPOST);
printf("target top chunk size \t= 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_FREED_SIZE);
// probe the current size of the top_chunk,
// can be skipped if it is already known or predictable

2
glibc_2.34/house_of_tangerine.c
View File

@ -66,7 +66,7 @@ int main() {
printf("fencepost size = 0x%lx\n", FENCEPOST);
printf("size_1 = 0x%lx\n", SIZE_1);
printf("target tcache top size = 0x%lx\n", CHUNK_SIZE_1 + FENCEPOST);
printf("target tcache top size = 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_SIZE_1);
// target is malloc chunk aligned 0x10 for x86_64
target = ((size_t) win + (MALLOC_ALIGN - 1)) & MALLOC_MASK;

2
glibc_2.34/sysmalloc_int_free.c
View File

@ -58,7 +58,7 @@ int main() {
printf("fencepost size \t\t= 0x%lx\n", FENCEPOST);
printf("freed size \t\t= 0x%lx\n", FREED_SIZE);
printf("target top chunk size \t= 0x%lx\n", CHUNK_FREED_SIZE + FENCEPOST);
printf("target top chunk size \t= 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_FREED_SIZE);
// probe the current size of the top_chunk,
// can be skipped if it is already known or predictable

2
glibc_2.39/house_of_tangerine.c
View File

@ -66,7 +66,7 @@ int main() {
printf("fencepost size = 0x%lx\n", FENCEPOST);
printf("size_1 = 0x%lx\n", SIZE_1);
printf("target tcache top size = 0x%lx\n", CHUNK_SIZE_1 + FENCEPOST);
printf("target tcache top size = 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_SIZE_1);
// target is malloc chunk aligned 0x10 for x86_64
target = ((size_t) win + (MALLOC_ALIGN - 1)) & MALLOC_MASK;

2
glibc_2.39/sysmalloc_int_free.c
View File

@ -58,7 +58,7 @@ int main() {
printf("fencepost size \t\t= 0x%lx\n", FENCEPOST);
printf("freed size \t\t= 0x%lx\n", FREED_SIZE);
printf("target top chunk size \t= 0x%lx\n", CHUNK_FREED_SIZE + FENCEPOST);
printf("target top chunk size \t= 0x%lx\n", CHUNK_HDR_SZ + MALLOC_ALIGN + CHUNK_FREED_SIZE);
// probe the current size of the top_chunk,
// can be skipped if it is already known or predictable