[原创]WarGame-heap0 解题思路
Heap0伪代码如下：
int win()
{
return system("/bin/sh");
}
int menu()
{
puts("1) Create chunk");
puts("2) Free chunk");
puts("3) Show chunk");
return puts("4) Exit");
}
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
__int64 v3; // rsi@1
const char *v4; // rdi@1
void *v5; // ST08_8@9
signed int v6; // eax@9
int v7; // [sp+4h] [bp-1Ch]@11
int v8; // [sp+14h] [bp-Ch]@6
int v9; // [sp+18h] [bp-8h]@2
signed int v10; // [sp+1Ch] [bp-4h]@1
v3 = 0LL;
v4 = (const char *)stdout;
setvbuf(stdout, 0LL, 2, 0LL);
v10 = 0;
while ( 1 )
{
while ( 1 )
{
menu(v4, v3);
v9 = ((int (*)(void))get_int)();
if ( v9 != 1 )
break;
if ( v10 > 99 )
{
puts("Too many chunks created");
exit(1);
}
puts("Size of the chunk:");
v8 = get_int("Size of the chunk:");
if ( v8 > 0 && v8 <= 4096 )
{
v5 = malloc(v8);
printf("Content: ");
gets(v5);
v3 = (unsigned int)v10;
v4 = "Chunk ID: %d\n";
printf("Chunk ID: %d\n", (unsigned int)v10);
v6 = v10++;
chunks[v6] = v5;
}
else
{
v4 = "Invalid size";
puts("Invalid size");
}
}
if ( v9 == 2 )
{
puts("Chunk id:");
v7 = get_int("Chunk id:");
if ( v7 >= 0 && v7 < v10 && chunks[v7] )
{
v4 = (const char *)chunks[v7];
free((void *)v4);
chunks[v7] = 0LL;
}
else
{
v4 = "No chunk with that id";
puts("No chunk with that id");
}
}
else if ( v9 == 3 )
{
v4 = "Not implemented";
puts("Not implemented");
}
else
{
if ( v9 == 4 )
{
puts("Bye");
exit(0);
}
v4 = "Invalid choice";
puts("Invalid choice");
}
}
}
注意：上传附件及图片大小不得大于30M。
⚠️ 版权声明：
本博客所有内容（含教程、源码、工具）仅供个人技术学习与研究交流使用，严禁商用、倒卖、二次分发及非法用途。
未经作者书面授权，任何组织或个人不得转载、复制或用于其他平台，违者将追究相关责任。
参与讨论
登录后可查看全部回复并参与讨论。
