update malloc

SUMMARY.md

@@ -154,6 +154,7 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One
     * [6.1.26 pwn 34C3CTF2017 300](doc/6.1.26_pwn_34c3ctf2017_300.md)
     * [6.1.27 pwn SECCONCTF2016 tinypad](doc/6.1.27_pwn_secconctf2016_tinypad.md)
     * [6.1.28 pwn ASISCTF2016 b00ks](doc/6.1.28_pwn_asisctf2016_b00ks.md)
+    * [6.1.29 pwn Insomni'hack_teaserCTF2017 The_Great_Escape_part-3](doc/6.1.29_pwn_insomnictf2017_the_great_escape3.md)
   * Reverse
     * [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md)
     * [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md)

doc/1.5.11_jemalloc.md

@@ -1 +1,49 @@
 # 1.5.11 jemalloc
+
+- [jemalloc](#jemalloc)
+- [安装](#安装)
+- [CTF 实例](#ctf-实例)
+- [参考资料](#参考资料)
+
+
+## jemalloc
+jemalloc 是 Facebook 推出的一种通用 malloc 实现，在 FreeBSD、firefox 中被广泛使用。比起 ptmalloc2 具有更高的性能。
+
+
+## 安装
+我们来编译一个带调试信息的 jemalloc（注：4.x和5.x之间似乎差别比较大）：
+```
+$ wget https://github.com/jemalloc/jemalloc/releases/download/5.0.1/jemalloc-5.0.1.tar.bz2
+$ tar -xjvf jemalloc-5.0.1.tar.bz2
+$ cd jemalloc-5.0.1
+$ ./configure --prefix=/usr/local/jemalloc --enable-debug
+$ make -j4 && sudo make install
+```
+接下来修改链接信息：
+```
+# echo /usr/local/jemalloc/ >> /etc/ld.so.conf.d/jemalloc.conf
+# ldconfig
+```
+当我们想要在编译程序时指定 jemalloc 时可以像下面这样：
+```
+$ gcc test.c -L/usr/local/jemalloc/lib -Wl,--rpath=/usr/local/jemalloc/lib -ljemalloc 
+$ ldd a.out 
+        linux-vdso.so.1 (0x00007fff69b62000)
+        libjemalloc.so.2 => /usr/local/jemalloc/lib/libjemalloc.so.2 (0x00007f744483b000)
+        libc.so.6 => /usr/lib/libc.so.6 (0x00007f744447f000)
+        libm.so.6 => /usr/lib/libm.so.6 (0x00007f74440ea000)
+        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x00007f7443d61000)
+        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f7443b43000)
+        libdl.so.2 => /usr/lib/libdl.so.2 (0x00007f744393f000)
+        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x00007f7443727000)
+        /lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007f7444f02000)
+```
+可以看到 `libjemalloc.so.2` 已经被链接到程序里了。
+
+
+## CTF 实例
+查看章节 6.1.29。
+
+
+## 参考资料
+- http://jemalloc.net/

doc/1.5.8_glibc_malloc.md

@@ -16,6 +16,55 @@ $ git clone git://sourceware.org/git/glibc.git
 $ cd glibc
 $ git checkout --track -b local_glibc-2.23 origin/release/2.23/master
 ```
+下面来编译它，首先修改配置文件 Makeconfig，将 `-Werror` 注释掉，这样可以避免高版本 GCC（v8.1.0） 将警告当做错误处理：
+```
+$ cat Makeconfig | grep -i werror | grep warn
++gccwarn += #-Werror
+```
+接下来需要打上一个 patch：
+```
+$ cat regexp.patch
+diff --git a/misc/regexp.c b/misc/regexp.c
+index 19d76c0..9017bc1 100644
+--- a/misc/regexp.c
++++ b/misc/regexp.c
+@@ -29,14 +29,17 @@ 
+ 
+ #if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_23)
+ 
+-/* Define the variables used for the interface.  */
+-char *loc1;
+-char *loc2;
++#include <stdlib.h>	/* Get NULL.  */
++
++/* Define the variables used for the interface.  Avoid .symver on common
++   symbol, which just creates a new common symbol, not an alias.  */
++char *loc1 = NULL;
++char *loc2 = NULL;
+ compat_symbol (libc, loc1, loc1, GLIBC_2_0);
+ compat_symbol (libc, loc2, loc2, GLIBC_2_0);
+ 
+ /* Although we do not support the use we define this variable as well.  */
+-char *locs;
++char *locs = NULL;
+ compat_symbol (libc, locs, locs, GLIBC_2_0);
+$ patch misc/regexp.c regexp.patch
+```
+然后就可以编译了：
+```
+$ mkdir build && cd build
+$ ../configure --prefix=/usr/local/glibc-2.23
+$ make -j4 && sudo make install
+```
+
+如果我们想要在编译程序时指定 libc，可以像这样：
+```
+$ gcc test.c -L/usr/local/glibc-2.23/lib -Wl,--rpath=/usr/local/glibc-2.23/lib -Wl,-I/usr/local/glibc-2.23/lib/ld-2.23.so
+$ ldd a.out
+        linux-vdso.so.1 (0x00007ffcc76b0000)
+        libc.so.6 => /usr/local/glibc-2.23/lib/libc.so.6 (0x00007f6abd578000)
+        /usr/local/glibc-2.23/lib/ld-2.23.so => /usr/lib64/ld-linux-x86-64.so.2 (0x00007f6abdb1c000)
+```
 
 
 ## malloc.c

doc/6.1.29_pwn_insomnictf2017_the_great_escape3.md

@@ -0,0 +1,37 @@
+# 6.1.29 pwn Insomni'hack_teaserCTF2017 The_Great_Escape_part-3
+
+- [题目复现](#题目复现)
+- [题目解析](#题目解析)
+- [漏洞利用](#漏洞利用)
+- [参考资料](#参考资料)
+
+
+[下载文件](../src/writeup/6.1.29_pwn_insomnictf2017_the_great_escape3)
+
+## 题目复现
+```
+$ file the_great_escape_part3   
+the_great_escape_part3: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=08df0c3369b497ee8ed8fca10dbb39ae75ebb273, not stripped
+$ checksec -f the_great_escape_part3
+RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
+Partial RELRO   Canary found      NX enabled    No PIE          RPATH      No RUNPATH   Yes     0               6       the_great_escape_part3
+$ ldd the_great_escape_part3
+        linux-vdso.so.1 (0x00007ffe0f1e8000)
+        libjemalloc.so.2 => /usr/lib/libjemalloc.so.2 (0x00007fa5e82dd000)
+        libc.so.6 => /usr/lib/libc.so.6 (0x00007fa5e7f21000)
+        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x00007fa5e7b98000)
+        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007fa5e797a000)
+        libdl.so.2 => /usr/lib/libdl.so.2 (0x00007fa5e7776000)
+        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x00007fa5e755e000)
+        /lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007fa5e875c000)
+        libm.so.6 => /usr/lib/libm.so.6 (0x00007fa5e71c9000)
+```
+64 位动态链接程序，但其使用 jemalloc 替代了 glibc 里的 ptmalloc2，很有意思。关于 jemalloc 的更多内容可以参考章节 1.5.11。
+
+
+## 题目解析
+
+## 漏洞利用
+
+## 参考资料
+- https://ctftime.org/task/3311

doc/6_writeup.md

@@ -29,6 +29,7 @@
   * [6.1.26 pwn 34C3CTF2017 300](6.1.26_pwn_34c3ctf2017_300.md)
   * [6.1.27 pwn SECCONCTF2016 tinypad](6.1.27_pwn_secconctf2016_tinypad.md)
   * [6.1.28 pwn ASISCTF2016 b00ks](6.1.28_pwn_asisctf2016_b00ks.md)
+  * [6.1.29 pwn Insomni'hack_teaserCTF2017 The_Great_Escape_part-3](6.1.29_pwn_insomnictf2017_the_great_escape3.md)
 * Reverse
   * [6.2.1 re XHPCTF2017 dont_panic](6.2.1_re_xhpctf2017_dont_panic.md)
   * [6.2.2 re ECTF2016 tayy](6.2.2_re_ectf2016_tayy.md)

src/others/1.5.8_glibc_malloc/regexp.patch

@@ -0,0 +1,24 @@
+diff --git a/misc/regexp.c b/misc/regexp.c
+index 19d76c0..9017bc1 100644
+--- a/misc/regexp.c
++++ b/misc/regexp.c
+@@ -29,14 +29,17 @@ 
+ 
+ #if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_23)
+ 
+-/* Define the variables used for the interface.  */
+-char *loc1;
+-char *loc2;
++#include <stdlib.h>	/* Get NULL.  */
++
++/* Define the variables used for the interface.  Avoid .symver on common
++   symbol, which just creates a new common symbol, not an alias.  */
++char *loc1 = NULL;
++char *loc2 = NULL;
+ compat_symbol (libc, loc1, loc1, GLIBC_2_0);
+ compat_symbol (libc, loc2, loc2, GLIBC_2_0);
+ 
+ /* Although we do not support the use we define this variable as well.  */
+-char *locs;
++char *locs = NULL;
+ compat_symbol (libc, locs, locs, GLIBC_2_0);