how2heap libc2.31学习

　　今天是四月十九，想在五月份之前把how2heap中的高版本(2.31)的例子过一遍。所以这个系列目前还是在更新中。如果比较简单就几句话带过了，遇到难一点的会写的详细一点。

fastbin_dup

源代码：

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>

int main()
{
    setbuf(stdout, NULL);

    printf("This file demonstrates a simple double-free attack with fastbins.
");

    printf("Fill up tcache first.
");
    void *ptrs[8];
    for (int i=0; i<8; i++) {
        ptrs[i] = malloc(8);
    }
    for (int i=0; i<7; i++) {
        free(ptrs[i]);
    }

    printf("Allocating 3 buffers.
");
    int *a = calloc(1, 8);
    int *b = calloc(1, 8);
    int *c = calloc(1, 8);

    printf("1st calloc(1, 8): %p
", a);
    printf("2nd calloc(1, 8): %p
", b);
    printf("3rd calloc(1, 8): %p
", c);

    printf("Freeing the first one...
");
    free(a);

    printf("If we free %p again, things will crash because %p is at the top of the free list.
", a, a);
    // free(a);

    printf("So, instead, we'll free %p.
", b);
    free(b);

    printf("Now, we can free %p again, since it's not the head of the free list.
", a);
    free(a);

    printf("Now the free list has [ %p, %p, %p ]. If we malloc 3 times, we'll get %p twice!
", a, b, a, a);
    a = calloc(1, 8);
    b = calloc(1, 8);
    c = calloc(1, 8);
    printf("1st calloc(1, 8): %p
", a);
    printf("2nd calloc(1, 8): %p
", b);
    printf("3rd calloc(1, 8): %p
", c);

    assert(a == c);
}

总结：

　　1.使用calloc申请chunk，并不会从tcache中拿chunk。

　　2.如果存在uaf漏洞，可以先将tcache填充满，再利用free(a)，free(b)，free(a)的操作实现double free，实现任意写。