Aggregator

glibc2.23 ptmalloc 原理概述

povcfe
5 years 7 months ago
发表于看雪论坛 linux用户态下的堆溢出利用即是对ptmalloc2安全机制的绕过，只有深入的了解ptmalloc，才能进行精准的堆溢出攻击 malloc __libc_malloc(传入参数:size) 判断 是否定义hook函数 ，如果存在则调用hook函数，否则跳到2 void *(*hook) (size_t, const void *) = atomic_forced_read (__malloc_hook); if (__builtin_expect (hook != NULL, 0)) return (*hook)(bytes, RETURN_ADDRESS (0)); 执行arena_get得到空闲分配区 arena_get (ar_ptr, bytes); 调用_int_malloc()获得内存地址 victim = _int_malloc (ar_ptr, bytes); 如果分配失败，ptmalloc会尝试再去寻找一个可用的arena并进行内存分配 if (!victim && ar_ptr != NULL) { LIBC_PROBE (memory_malloc_retry, 1, bytes); ar_ptr = arena_get_retry (ar_ptr, bytes); victim = _int_malloc (ar_ptr, bytes); } 得到内存地址后解锁分配区 if (ar_ptr != NULL) (void) mutex_unlock (&ar_ptr->mutex); 如果在上面的步骤中获得非mmap得到的chunk，但是chunk对应的分配区与实际的分配区不相符，则程序终止 assert (!victim || chunk_is_mmapped (mem2chunk (victim)) || ar_ptr == arena_for_chunk (mem2chunk (victim))); _int_malloc errout: 打印错误字符串并 return 判断 size是否大于(unsigned long)(-2*MINSIZE) MINSIZE=chunk的最小大小 ，如果是则return，否则将size转换为chunk_size #define checked_request2size(req, sz) \ if (REQUEST_OUT_OF_RANGE (req)) { \ __set_errno (ENOMEM); \ return 0; \ } \ (sz) = request2size (req); 判断 前面是否没有获得空闲分配区 如果是则跳到3，否则跳到4 if (__glibc_unlikely (av == NULL)) 调用sysmalloc尝试获得chunk地址，如果得到则调用alloc_perturb 将清理空间数据，return chunk地址 if (__glibc_unlikely (av == NULL)) { void *p = sysmalloc (nb, av); if (p !

Maximizing Onboarding: Giving managers the skills for success

The Akamai Blog
5 years 7 months ago
Managing teams come with challenges as well as rewards. Managers drive individual and team performance, and the best managers drive employee connection and engagement. Akamai believes that employees are our biggest asset; by effectively and efficiently integrating them into the...
Andrew Heifetz

基于设备指纹零感验证系统 - 我是小三

我是小三
5 years 7 months ago
作者: 我是小三博客: http://www.cnblogs.com/2014asm/由于时间和水平有限，本文会存在诸多不足，希望得到您的及时反馈与指正，多谢! 工具环境: android 4.4.4、IDA Pro 7.0、jeb3、sklearn机器学习库目录 ：为什么是零感验证？验证码的发展史
我是小三

190927 re-某恶作剧APK的分析

NightShadow(奈沙夜影)
5 years 7 months ago
用JEB打开，首先扫一眼AndroidManifest.xml的相关信息 从包名可以看出 [外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-fvszbl92-1569599143824)(https://i.loli.net/2019/09/27/ybnJIaoRwrq3tsX.png)] 是一个androlua项目，稍微搜一下就可以知道是用Lua写android。所以...
whklhhhh

From the Beginning: Internships With Akamai

The Akamai Blog
5 years 7 months ago
At Akamai, our internships are both unique and meaningful. What do we mean by this? Well, we believe an internship should add real, significant value to an intern's skill-set. So, not only do they get to learn on the job...
Akamai

OGEEK 2019 OZero writeup

xmsec(陌小生)
5 years 7 months ago
To Begin With

上周末参加了 OGEEK 网络安全挑战赛决赛，最终在队友的 carry 下躺赢，拿到第三名的成绩。运气比较好，拿到了一

xmsec

What Is SQL Injection?

F5 Labs
5 years 7 months ago
Learn what SQL injection is, how attackers use it to access sensitive data, and how to protect your organization from these attacks.

Managed ad