libdislocator原理及afl++的更新

检测原理

申请内存通过mmap实现,最低申请两个页(默认4096一个页)

last page通过mprotest设置为PROT_NONE,无法读写执行

1
mprotect(ret + PG_COUNT(rlen + 8) * PAGE_SIZE, PAGE_SIZE, PROT_NONE)

之后将内存指针向右对齐,前面放len和alloc_canry

1
2
3
4
5
6
7
8
ret += PAGE_SIZE * PG_COUNT(rlen + 8) - rlen - 8;

/* Store allocation metadata. */

ret += 8;

PTR_L(ret) = len;
PTR_C(ret) = alloc_canary;

free的时候是将整个内存设置为PROT_NONE

那么当程序存在堆溢出的时候,就会访问到PROT_NONE内存而出错

free掉的内存因为PROT_NONE也不可访问,可以检测uaf

新增特性

1、增加了对mac和FreeBSD 的兼容

1
2
3
4
5
6
7
#ifdef __APPLE__
#include <mach/vm_statistics.h>
#endif

#ifdef __FreeBSD__
#include <sys/param.h>
#endif

2、 不是C11,重新定义max_align_t

1
2
3
4
5
6
7
8
9
10
11
#if __STDC_VERSION__ < 201112L || \
(defined(__FreeBSD__) && __FreeBSD_version < 1200000)
// use this hack if not C11
typedef struct {

long long __ll;
long double __ld;

} max_align_t;

#endif

3、增加AFL_RANDOM_ALLOC_CANARY选项

随机canary

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
__attribute__((constructor)) void __dislocator_init(void) {

char *tmp = getenv("AFL_LD_LIMIT_MB");

if (tmp) {

char * tok;
unsigned long long mmem = strtoull(tmp, &tok, 10);
if (*tok != '\0' || errno == ERANGE || mmem > SIZE_MAX / 1024 / 1024)
FATAL("Bad value for AFL_LD_LIMIT_MB");
max_mem = mmem * 1024 * 1024;

}

alloc_canary = ALLOC_CANARY;
tmp = getenv("AFL_RANDOM_ALLOC_CANARY");

if (tmp) arc4random_buf(&alloc_canary, sizeof(alloc_canary));

alloc_verbose = !!getenv("AFL_LD_VERBOSE");
hard_fail = !!getenv("AFL_LD_HARD_FAIL");
no_calloc_over = !!getenv("AFL_LD_NO_CALLOC_OVER");
align_allocations = !!getenv("AFL_ALIGNED_ALLOC");

}

4、新增emalloc、ecalloc、erealloc

5、增加TAIL_ALLOC_CANARY(强制对齐的时候)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
 size_t rlen;
if (align_allocations && (len & (ALLOC_ALIGN_SIZE - 1)))
rlen = (len & ~(ALLOC_ALIGN_SIZE - 1)) + ALLOC_ALIGN_SIZE;
else
rlen = len;

......
......
......
if (rlen != len) {

size_t i;
for (i = len; i < rlen; ++i)
ret[i] = TAIL_ALLOC_CANARY;

}

需要开启AFL_ALIGNED_ALLOC

1
align_allocations = !!getenv("AFL_ALIGNED_ALLOC");
自愿打赏专区