无      2019-05-08
跟着永博学v8 # 0x01 diff 首先还是看一下`diff`文件,主要修改了这么几个文件: * src/bootstrapper.cc 可以看到,这里添加了一个函数`oob` ``` --- a/src/bootstrapper.cc +++ b/src/bootstrapper.cc @@ -1668,6 +1668,8 @@ void Genesis::InitializeGlob
无      2019-02-18
# 0x02 exp编写 输入长字符串后,直接看报错: ``` goroutine 1 [running]: runtime.systemstack_switch() /usr/lib/go-1.6/src/runtime/asm_amd64.s:245 fp=0xc820037ae0 sp=0xc820037ad8 runtime.mallocgc(0x4138674137674136
无      2019-02-13
http://www.runoob.com/go/go-tutorial.html # 0x01 run ``` Go is a tool for managing Go source code. Usage: go command [arguments] The commands are: build compile packages and dependencies
无      2019-02-14
# 0x01 test 首先写个测试程序,看看在`IDA`下反编译出来是啥样子 ``` package main import ( "fmt" ) const TEST = "test" var hw = "Hello World" type Books struct { title string author string subject string
无      2018-10-11
# 0x01 github 项目地址:https://github.com/googleprojectzero/domato ## 1. 使用方法 生成一个`html`的样本: ``` python generator.py ``` 生成多个样本到某个目录下,他们会被命名为`fuzz-.html`。同时生成多个样本会更快。 ``` python generator.py --output_
无      2018-12-24
# 0x01 poc 首先分析一下所给的`poc` ``` // Copyright 2018 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. //
无      2018-08-01
https://www.hex-rays.com/products/ida/support/idapython_docs/ https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html # 0x01 demo ``` import idaapi class routerEXP(idaapi.plugi
无      2018-11-10
https://www.w0lfzhang.com/2017/03/27/Playing-with-tls-dtor-list/
无      2018-05-25
# 0x01 INSTALL 首先下载一下修复前的源码: ``` git clone https://github.com/Exim/exim.git git checkout 38e3d2dff7982736f1e6833e06d4aab4652f337a ``` 然后安装一些依赖: ``` apt install libdb-dev libpcre3-dev libssl-dev ```
无      2018-04-09
## malloc ``` fastbin: 1. nb <= get_max_fast () 2. fastbin_index (chunksize (victim)) == idx smallbin: 1. in_smallbin_range (nb) 2. victim->bk->fd==victim (victim为smallbin链表上的最后一个) unsortedbin: 1. 前提:victim的size符合要求(2 * SIZE_SZ~av->system_mem) 2. size==nb就会直接分配 3. 如果无法直接分配,直接通过size获得对应的bin_index,然后加入到对应的bins