From 6a2bafebf9c4772d1cc18e840f2d5f3265ac5309 Mon Sep 17 00:00:00 2001 From: ascotbe <869335729@qq.com> Date: Mon, 2 Aug 2021 14:44:37 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E5=85=B6=E4=BB=96=E8=BF=9E?= =?UTF-8?q?=E6=8E=A5=E9=94=99=E8=AF=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md | 2 +- .../zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md | 2 +- .../pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md index af69f352a2..4e529e98ee 100644 --- a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md +++ b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md @@ -184,4 +184,4 @@ int main(int argc, char * argv[]){ ## 参考文献 -- [https://github.com/shellphish/how2heap/blob/master/glibc_2.25/house_of_lore.c](https://github.com/shellphish/how2heap/blob/master/glibc_2.25/house_of_lore.c) \ No newline at end of file +- [https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_lore.c](https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_lore.c) \ No newline at end of file diff --git a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md index 48eaa38032..2e277c5fd2 100644 --- a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md +++ b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md @@ -734,7 +734,7 @@ tcache_put (mchunkptr chunk, size_t tc_idx) 因为没有任何检查，所以我们可以对同一个 chunk 多次 free，造成 cycliced list。 -以 how2heap 的 [tcache_dup](https://github.com/shellphish/how2heap/blob/master/glibc_2.26/tcache_dup.c) 为例分析，源码如下： +以 how2heap 的 [tcache_dup](https://github.com/shellphish/how2heap/blob/master/glibc_2.27/tcache_dup.c) 为例分析，源码如下： ```C glibc_2.26 [master●] bat ./tcache_dup.c ───────┬───────────────────────────────────────────────────────────────────────────────── diff --git a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md index 1fdabe2e39..302e5e923b 100644 --- a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md +++ b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md @@ -113,7 +113,7 @@ main_arena_offset = ELF("libc.so.6").symbols["__malloc_hook"] + 0x10 -这里我以 shellphish 的 how2heap 仓库中的 [unsorted_bin_attack.c](https://github.com/shellphish/how2heap/blob/master/unsorted_bin_attack.c) 为例进行介绍，这里我做一些简单的修改，如下 +这里我以 shellphish 的 how2heap 仓库中的 [unsorted_bin_attack.c](https://github.com/shellphish/how2heap/blob/master/glibc_2.27/unsorted_bin_attack.c) 为例进行介绍，这里我做一些简单的修改，如下 ```c #include