Skip to content

Commit da02cb0

Browse files
lafreuxpabolafreuxpabo
authored
Merge branch 'shellphish:master' into master
2 parents 5a082a4 + d9c79f5 commit da02cb0

File tree

87 files changed

+7287
-399
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+7287
-399
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- "**"
7+
pull_request:
8+
workflow_dispatch:
9+
10+
jobs:
11+
v2_23:
12+
runs-on: ubuntu-22.04
13+
name: glibc-v2.23
14+
steps:
15+
- name: build how2heap
16+
uses: shellphish/how2heap/ci/build@master
17+
with:
18+
ubuntu: '16.04'
19+
- name: test how2heap
20+
uses: shellphish/how2heap/ci/test@master
21+
with:
22+
ubuntu: '16.04'
23+
glibc: '2.23'
24+
25+
v2_24:
26+
runs-on: ubuntu-22.04
27+
name: glibc-v2.24
28+
steps:
29+
- name: build how2heap
30+
uses: shellphish/how2heap/ci/build@master
31+
with:
32+
ubuntu: '16.04'
33+
- name: test how2heap
34+
uses: shellphish/how2heap/ci/test@master
35+
with:
36+
ubuntu: '16.10'
37+
glibc: '2.24'
38+
v2_27:
39+
runs-on: ubuntu-22.04
40+
name: glibc-v2.27
41+
steps:
42+
- name: build how2heap
43+
uses: shellphish/how2heap/ci/build@master
44+
with:
45+
ubuntu: '18.04'
46+
- name: test how2heap
47+
uses: shellphish/how2heap/ci/test@master
48+
with:
49+
ubuntu: '18.04'
50+
glibc: '2.27'
51+
v2_31:
52+
runs-on: ubuntu-22.04
53+
name: glibc-v2.31
54+
steps:
55+
- name: build how2heap
56+
uses: shellphish/how2heap/ci/build@master
57+
with:
58+
ubuntu: '20.04'
59+
- name: test how2heap
60+
uses: shellphish/how2heap/ci/test@master
61+
with:
62+
ubuntu: '20.04'
63+
glibc: '2.31'
64+
v2_32:
65+
runs-on: ubuntu-22.04
66+
name: glibc-v2.32
67+
steps:
68+
- name: build how2heap
69+
uses: shellphish/how2heap/ci/build@master
70+
with:
71+
ubuntu: '20.04'
72+
- name: test how2heap
73+
uses: shellphish/how2heap/ci/test@master
74+
with:
75+
ubuntu: '20.10'
76+
glibc: '2.32'
77+
v2_33:
78+
runs-on: ubuntu-22.04
79+
name: glibc-v2.33
80+
steps:
81+
- name: build how2heap
82+
uses: shellphish/how2heap/ci/build@master
83+
with:
84+
ubuntu: '20.04'
85+
- name: test how2heap
86+
uses: shellphish/how2heap/ci/test@master
87+
with:
88+
ubuntu: '21.04'
89+
glibc: '2.33'
90+
v2_34:
91+
runs-on: ubuntu-22.04
92+
name: glibc-v2.34
93+
steps:
94+
- name: build how2heap
95+
uses: shellphish/how2heap/ci/build@master
96+
with:
97+
ubuntu: '20.04'
98+
- name: test how2heap
99+
uses: shellphish/how2heap/ci/test@master
100+
with:
101+
ubuntu: '21.10'
102+
glibc: '2.34'
103+
v2_35:
104+
runs-on: ubuntu-22.04
105+
name: glibc-v2.35
106+
steps:
107+
- name: build how2heap
108+
uses: shellphish/how2heap/ci/build@master
109+
with:
110+
ubuntu: '22.04'
111+
- name: test how2heap
112+
uses: shellphish/how2heap/ci/test@master
113+
with:
114+
ubuntu: '22.04'
115+
glibc: '2.35'
116+
v2_36:
117+
runs-on: ubuntu-22.04
118+
name: glibc-v2.36
119+
steps:
120+
- name: build how2heap
121+
uses: shellphish/how2heap/ci/build@master
122+
with:
123+
ubuntu: '22.04'
124+
- name: test how2heap
125+
uses: shellphish/how2heap/ci/test@master
126+
with:
127+
ubuntu: '22.10'
128+
glibc: '2.36'
129+
v2_37:
130+
runs-on: ubuntu-22.04
131+
name: glibc-v2.37
132+
steps:
133+
- name: build how2heap
134+
uses: shellphish/how2heap/ci/build@master
135+
with:
136+
ubuntu: '22.04'
137+
- name: test how2heap
138+
uses: shellphish/how2heap/ci/test@master
139+
with:
140+
ubuntu: '23.04'
141+
glibc: '2.37'
142+
v2_38:
143+
runs-on: ubuntu-22.04
144+
name: glibc-v2.38
145+
steps:
146+
- name: build how2heap
147+
uses: shellphish/how2heap/ci/build@master
148+
with:
149+
ubuntu: '22.04'
150+
- name: test how2heap
151+
uses: shellphish/how2heap/ci/test@master
152+
with:
153+
ubuntu: '23.10'
154+
glibc: '2.38'
155+
v2_39:
156+
runs-on: ubuntu-22.04
157+
name: glibc-v2.39
158+
steps:
159+
- name: build how2heap
160+
uses: shellphish/how2heap/ci/build@master
161+
with:
162+
ubuntu: '24.04'
163+
- name: test how2heap
164+
uses: shellphish/how2heap/ci/test@master
165+
with:
166+
ubuntu: '24.04'
167+
glibc: '2.39'

‎Dockerfile‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
# this is the dockerfile we use for testing techniques used in how2heap
2-
from ubuntu:24.04
1+
from ubuntu:20.04
32

4-
run apt-get update && apt-get -y install binutils git make vim gcc
3+
run apt-get update && apt-get install -y binutils git make vim gcc patchelf python-is-python3 python3-pip
4+
run pip3 install requests
55
run git clone --depth 1 https://github.com/shellphish/how2heap /root/how2heap
6+
run git config --global --add safe.directory "*"
67

78
workdir /root/how2heap
8-
run make
9+
run bash

‎Makefile‎

Lines changed: 74 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,89 @@
1-
BASE = malloc_playground first_fit calc_tcache_idx
2-
V2.23 = fastbin_dup fastbin_dup_consolidate fastbin_dup_consolidate fastbin_dup_into_stack house_of_einherjar house_of_force house_of_gods house_of_lore house_of_mind_fastbin house_of_orange house_of_roman house_of_spirit house_of_storm large_bin_attack mmap_overlapping_chunks overlapping_chunks overlapping_chunks_2 poison_null_byte unsafe_unlink unsorted_bin_attack unsorted_bin_into_stack
3-
V2.24 = fastbin_dup fastbin_dup_consolidate fastbin_dup_consolidate fastbin_dup_into_stack house_of_einherjar house_of_force house_of_gods house_of_lore house_of_mind_fastbin house_of_roman house_of_spirit house_of_storm large_bin_attack mmap_overlapping_chunks overlapping_chunks overlapping_chunks_2 poison_null_byte unsafe_unlink unsorted_bin_attack unsorted_bin_into_stack
4-
V2.27 = fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_force house_of_lore house_of_mind_fastbin house_of_spirit house_of_storm large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink unsorted_bin_attack unsorted_bin_into_stack
5-
V2.31 = fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink
6-
V2.32 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
7-
V2.33 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
8-
V2.34 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
9-
V2.35 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
10-
V2.36 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
11-
V2.37 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
12-
V2.38 = decrypt_safe_linking fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack fastbin_reverse_into_tcache house_of_botcake house_of_einherjar house_of_lore house_of_mind_fastbin house_of_spirit large_bin_attack mmap_overlapping_chunks overlapping_chunks poison_null_byte tcache_house_of_spirit tcache_poisoning tcache_stashing_unlink_attack unsafe_unlink safe_link_double_protect house_of_water
13-
14-
# turn technique names into paths
15-
VV2.23 = $(addprefix glibc_2.23/, $(V2.23))
16-
VV2.24 = $(addprefix glibc_2.24/, $(V2.24))
17-
VV2.27 = $(addprefix glibc_2.27/, $(V2.27))
18-
VV2.31 = $(addprefix glibc_2.31/, $(V2.31))
19-
VV2.32 = $(addprefix glibc_2.32/, $(V2.32))
20-
VV2.33 = $(addprefix glibc_2.33/, $(V2.33))
21-
VV2.34 = $(addprefix glibc_2.34/, $(V2.34))
22-
VV2.35 = $(addprefix glibc_2.35/, $(V2.35))
23-
VV2.36 = $(addprefix glibc_2.36/, $(V2.36))
24-
VV2.37 = $(addprefix glibc_2.37/, $(V2.37))
25-
VV2.38 = $(addprefix glibc_2.38/, $(V2.38))
26-
27-
PROGRAMS = $(BASE) $(VV2.23) $(VV2.24) $(VV2.27) $(VV2.31) $(VV2.32) $(VV2.33) $(VV2.34) $(VV2.35) $(VV2.36) $(VV2.37) $(VV2.38)
1+
.PHONY: help clean distclean all test
2+
3+
VERSIONS := 2.23 2.24 2.27 2.31 2.32 2.33 2.34 2.35 2.36 2.37 2.38 2.39
4+
TECH_BINS := $(patsubst %.c,%,$(wildcard glibc_*/*.c))
5+
BASE_BINS := $(patsubst %.c,%,$(wildcard *.c))
6+
DOWNLOADED := glibc-all-in-one/libs glibc-all-in-one/debs
7+
BINS := $(TECH_BINS) $(BASE_BINS)
8+
ARCH := amd64
9+
10+
ifeq ($(H2H_USE_SYSTEM_LIBC),)
11+
H2H_USE_SYSTEM_LIBC := Y
12+
endif
13+
14+
help:
15+
@echo 'make help - show this message'
16+
@echo 'make base - build all base binaries, namely `malloc_playground`, `first_fit`, `calc_tcache_idx`'
17+
@echo 'make <version> - build all the techniques for a specific version. e.g. `make v2.39`'
18+
@echo 'make clean - remove all built binaries'
19+
@echo 'make distclean - remove all built binaries and downloaded libcs'
20+
@echo 'make all - build all binaries'
21+
@echo 'make test version=<version> - test run all techniques for a specific version. e.g. `make test version=2.39`'
22+
2823
CFLAGS += -std=c99 -g -Wno-unused-result -Wno-free-nonheap-object
2924
LDLIBS += -ldl
3025

31-
# Convenience to auto-call mcheck before the first malloc()
32-
#CFLAGS += -lmcheck
26+
base: $(BASE_BINS)
27+
28+
# initialize glibc-all-in-one
29+
libc_ready:
30+
git submodule update --init --recursive
31+
cd glibc-all-in-one && ./update_list
32+
33+
# populate the download_glibc_<version> rules
34+
$(addprefix download_glibc_, $(VERSIONS)): libc_ready
35+
@echo $@
36+
37+
version=$(patsubst download_glibc_%,%,$@); \
38+
libc=$$(cat glibc-all-in-one/list | grep "$$version" | grep "$(ARCH)" | head -n 1); \
39+
old_libc=$$(cat glibc-all-in-one/old_list | grep "$$version" | grep "$(ARCH)" | head -n 1); \
40+
if [ -z $$libc ]; then libc=$$old_libc; script="download_old"; else libc=$$libc; script="download"; fi; \
41+
cd glibc-all-in-one; \
42+
rm -rf libs/$$libc; \
43+
./$$script $$libc
44+
45+
# populate the make <version> rules
46+
ifeq ($(H2H_USE_SYSTEM_LIBC),Y)
47+
$(foreach version,$(VERSIONS),$(eval v$(version): $(patsubst %.c,%,$(wildcard glibc_$(version)/*.c))))
48+
else
49+
$(foreach version,$(VERSIONS),$(eval v$(version): download_glibc_$(version) $(patsubst %.c,%,$(wildcard glibc_$(version)/*.c)) ))
50+
endif
51+
52+
# the compilation rules
53+
%: %.c
54+
version=$(word 1, $(subst /, ,$(patsubst glibc_%,%,$@))); \
55+
if [ "$(H2H_USE_SYSTEM_LIBC)" = "Y" ]; \
56+
then \
57+
$(CC) $(CFLAGS) $(DIR_CFLAGS_$(@D)) $^ -o $@ $(LDLIBS); \
58+
else \
59+
$(CC) $(CFLAGS) $(DIR_CFLAGS_$(@D)) $^ -o $@ $(LDLIBS) \
60+
-Xlinker -rpath=$$(realpath glibc-all-in-one/libs/$$version*) \
61+
-Xlinker -I$$(realpath glibc-all-in-one/libs/$$version*/ld-linux-x86-64.so.2) \
62+
-Xlinker $$(realpath glibc-all-in-one/libs/$$version*/libc.so.6) \
63+
-Xlinker $$(realpath glibc-all-in-one/libs/$$version*/libdl.so.2); \
64+
fi
65+
66+
all: $(BINS)
3367

34-
all: $(PROGRAMS)
3568
clean:
36-
rm -f $(PROGRAMS)
69+
@rm -f $(BINS)
70+
@echo "all the built binaries are removed."
71+
72+
distclean:
73+
@rm -f $(BINS)
74+
@rm -rf $(DOWNLOADED)
75+
@echo "all the built binaries and all downloaded libcs are removed."
3776

3877
define test_poc =
3978
echo $(poc)
40-
for i in $$(seq 0 4);\
79+
for i in $$(seq 0 20);\
4180
do\
4281
LIBC_FATAL_STDERR_=1 $(poc) 1>/dev/null 2>&1 0>&1;\
4382
if [ "$$?" = "0" ]; then break; fi;\
44-
if [ "$$i" = "4" ]; then exit 1; fi;\
83+
if [ "$$i" = "20" ]; then exit 1; fi;\
4584
done
4685
echo "success"
4786
endef
4887

49-
#if [ "$$i" == "5" ]; then exit 1; fi;\
50-
51-
test: $(PROGRAMS)
52-
@if [ -z "$(target)" ] || [ -z "$(VV$(target))" ];\
53-
then echo "run 'make test target=<target_version>' to test existing techniques"; exit 1; fi;
54-
55-
@$(foreach poc,$(VV$(target)),$(call test_poc,$(poc));)
88+
test: v$(version)
89+
@$(foreach poc,$(patsubst %.c,%,$(wildcard glibc_$(version)/*.c)),$(call test_poc,$(poc));)

0 commit comments

Comments
 (0)