[LAB5] 312511041

lab5/antiasan.c

@@ -1,5 +1,30 @@
-// TODO:
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/mman.h>
+
+/*
+ *  Overwrite the value of target variable in shadow
+ */
 void antiasan(unsigned long addr)
 {
+    /* calculate memory address of s[0x10] */
+    unsigned long rz = (addr >> 3) + 0x7fff8000;
+
+    /* mprotect need to perform on aligned page address, the page size is x^12 bytes */
+    unsigned long b_addr = ((rz>>12)<<12);
+    // printf("%p\n%p\n", (unsigned long*)rz, (unsigned long*)b_addr);
+
+    /* change the access protection for memory page so that it can be read and write */
+    if(mprotect((void*)b_addr, getpagesize(), PROT_READ | PROT_WRITE) == -1) {
+        fprintf(stderr, "antiasan: failed to mprotect shadow - %s, %d\n", strerror(errno), errno);
+    }
 
+    /* change value in shadow to which s[0x10] map */
+    /* first printf: fafafafafafafafd, second printf: fafafafafafafa00 */
+    // printf("%lx\n", *(unsigned long*)rz);
+    *(char*)rz = 0x0;
+    // printf("%lx\n", *(unsigned long*)rz);
 }
+// 0xc067fff8002: 0xfafafafafafdfdfd

lab5/global_ofb_rw.c

@@ -0,0 +1,18 @@
+#include <stdio.h>
+
+    char str[8] = "Hello";
+
+int main(void)
+{
+    str[8] = '!';
+    putchar(str[8]);
+    return 0;
+}
+
+// gcc -Og -g -o global global_obf_rw.c
+// ./global output error
+// Fatal error: glibc detected an invalid stdio handle
+// Aborted
+
+// gcc -o global global_ofb_rw.c
+// ./global doesn't produce error

lab5/heap_ofb_rw.c

@@ -0,0 +1,12 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(void)
+{
+    char *str = (char*)malloc(sizeof(char)*6);
+    strcpy(str, "Hello");
+    str[6] = '!';
+    putchar(str[7]);
+    return 0;
+}

lab5/skip_rz.c

@@ -0,0 +1,11 @@
+#include <stdio.h>
+
+int main(void)
+{
+    char a[8] = "Hello";
+    char b[8] = "World";
+    a[32] = 'P';
+    printf("a = %p, b = %p\n", a, b);
+    printf("*a = %s, *b = %s\n", a, b);
+    return 0;
+}

lab5/stack_ofb_rw.c

@@ -0,0 +1,17 @@
+#include <stdio.h>
+
+int main(void)
+{
+    char str[8] = "Hello";
+    str[8] = '!';
+    putchar(str[8]);
+    return 0;
+}
+
+// gcc -o stack stack_ofb_rw.c
+// ./stack produce error
+// *** stack smashing detected ***: terminated
+// Aborted
+
+// gcc -Og -g -o stack stack_obf_rw.c
+// ./stack doesn't produce error

lab5/test.c

@@ -0,0 +1,7 @@
+#include <stdio.h>
+
+int main(void)
+{
+	printf("%d\n", sizeof(unsigned long));
+	return 0;
+}