第七届强网杯-PWN-【warmup】

warmup libc 2.35

检查

IDA逆向

main

void __fastcall __noreturn main(const char *a1, char **a2, char **a3)
{
   
  int v3; // eax

  pro_set();
  put_warmup_string();
  while ( 1 )
  {
   
    put_menu();
    v3 = input_number();
    if ( v3 == 4 )
      _exit(0);
    if ( v3 > 4 )
    {
   
LABEL_12:
      a1 = "Invalid!";
      puts("Invalid!");
    }
    else
    {
   
      switch ( v3 )
      {
   
        case 3:
          deldelete_note();
          break;
        case 1:
          add_note();
          break;
        case 2:
          首位、
          show_note(a1, a2);
          break;
        default:
          goto LABEL_12;
      }
    }
  }
}

deldelete_note

unsigned __int64 delete_note()
{
   
  unsigned int v1; // [rsp+4h] [rbp-Ch]
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  printf("Index: ");
  v1 = input_number();
  if ( v1 < 0x13 )
  {
   
    if ( chunk_addr_array[v1] )
    {
   
      free(chunk_addr_array[v1]);
      chunk_addr_array[v1] = 0LL;
      puts("Success~");
    }
  }
  else
  {
   
    puts("Error!");
  }
  return v2 - __readfsqword(0x28u);
}

add_note

unsigned __int64 add_note()
{
   
  int i; // [rsp+Ch] [rbp-14h]
  int size; // [rsp+10h] [rbp-10h]
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  for ( i = 0; i <= 18 && chunk_addr_array[i]; ++i )
    ;
  if ( i == 19 )
  {
   
    puts