# House of Spirit
## Applicable Range
- latest
## Principles
人生中的第一个「house」，当然是从 Spirit 开始～
下面直接拿 [how2heap](https://github.com/shellphish/how2heap) 的 example code 来
学习了，选择的是 [glibc_2.35/house_of_spirit.c](https://github.com/shellphish/ho
w2heap/blob/master/glibc_2.35/house_of_spirit.c)：
```c
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
int main() {
setbuf(stdout, NULL);
puts("This file demonstrates the house of spirit attack.");
puts("This attack adds a non-heap pointer into fastbin, thus leading to "
"(nearly) arbitrary write.");
puts("Required primitives: known target address, ability to set up the "
"start/end of the target memory");
puts("nStep 1: Allocate 7 chunks and free them to fill up tcache");
void *chunks[7];
for (int i = 0; i < 7; i++) {
chunks[i] = malloc(0x30);
}
for (int i = 0; i < 7; i++) {
free(chunks[i]);
}
puts("nStep 2: Prepare the fake chunk");
// This has nothing to do with fastbinsY (do not be fooled by the 10) -
// fake_chunks is just a piece of memory to fulfil allocations (pointed to
// from fastbinsY)
long fake_chunks[10] __attribute__((aligned(0x10)));
printf("The target fake chunk is at %pn", fake_chunks);
printf(
"It contains two chunks. The first starts at %p and the second at %p.n",
&fake_chunks[1], &fake_chunks[9]);
printf("This chunk.size of this region has to be 16 more than the region (to "
"accommodate the chunk data) while still falling into the fastbin "
"category (<= 128 on x64). The PREV_INUSE (lsb) bit is ignored by "
"free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) "
"and NON_MAIN_ARENA (third lsb) bits cause problems.n");
puts("... note that this has to be the size of the next malloc request "
"rounded to the internal size used by the malloc implementation. E.g. "
"on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for "
"the malloc parameter at the end.");
printf("Now set the size of the chunk (%p) to 0x40 so malloc will think it "
"is a valid chunk.n",
&fake_chunks[1]);
fake_chunks[1] = 0x40; // this is the size
printf("The chunk.size of the *next* fake region has to be sane. That is > "
"2*SIZE_SZ (> 16 on x64) && < av->system_mem (< 128kb by default for "
"the main arena) to pass the nextsize integrity checks. No need for "
"fastbin size.n");
printf("Set the size of the chunk (%p) to 0x1234 so freeing the first chunk "
"can succeed.n",
&fake_chunks[9]);
fake_chunks[9] = 0x1234; // nextsize
puts("nStep 3: Free the first fake chunk");
puts("Note that the address of the fake chunk must be 16-byte aligned.n");
void *victim = &fake_chunks[2];
free(victim);
puts("nStep 4: Take out the fake chunk");
printf("Now the next calloc will return our fake chunk at %p!n",
&fake_chunks[2]);
printf(
"malloc can do the trick as well, you just need to do it for 8 times.");
void *allocated = calloc(1, 0x30);
printf("malloc(0x30): %p, fake chunk: %pn", allocated, victim);
assert(allocated == victim);
}
```
先说效果，这个攻击基本上就是可以令我们 malloc 返回一个任意地址，比如返回栈地址，
~_然后就可以竭尽所学，做一些瑟瑟的事情了什么？我说的瑟，可是萧瑟的瑟哦～ chill b
ro_~
上面这个程序不难理解吧？就是先把 tcache 的 0x40 bin 填满，确保我们接下来所做的都
是针对于 fastbin 的 0x40 bin 。接着关键的地方是设置了两个 fake chunk 的 size，一
个是 `0x40`，紧接着它的 nextchunk size 设置为 `0x1234`，这是为了过两个检查：
首先是我们不希望进入 `__libc_free` 中的 `chunk_is_mmapped` 分支执行 `munmap_chun
k`，所以伪造的第一个 chunk size 的 `M (IS_MMAPPED)` 位必须为 0。然后进入 `_int_f
ree` 后我们第一个 chunk 的 size 必须满足 `size > MINSIZE`，否则会抛出 `free(): i
nvalid size`，接着由于我们希望进入 fastbin，所以 size 必须在 fastbin 最大支持大
小范围内，且 `chunk_at_offset(p, size) != av->top`，即紧临着的 nextchunk 不能是
top chunk，这就是为什么需要伪造两个 chunk 的原因。最还还不能满足 `chunksize_noma
sk (chunk_at_offset (p, size)) <= CHUNK_HDR_SZ`，即 nextchunk 的大小不能小于等于
chunk header size 和 `chunksize (chunk_at_offset (p, size)) >= av->system_mem`
，即下一个 chunk 的大小大于不能大于当前 arena 内存池大小这两个检测，否则就抛出 `
free(): invalid next size (fast)`。到此为止检测就绕差不多了，然后它会将这个 chun
k 放到 fastbin 中，就不过多赘述了。
:::important
注意 `NON_MAIN_ARENA` 位也会有影响，得设置成 0 告诉 glibc 这是 main arena 的 chu
nk 。
nextchunk 的大小无关紧要，只要能绕过检测就好了，不一定非得是 fastbin 范围内的大
小。
:::
感觉写了一堆没用的，还不如直接看 example code + glibc source code + 自己 debug
理解的透彻……可能是这块内容确实不好写，因为写详细的话必然得贴 glibc 代码片段，考
虑到以后还有各种各样其它的 house，肯定会有重复的内容，<s>_属于是增加碳排放了，我
可是坚定的环保主义者（_</s>
好麻烦……后面有时间我再研究研究怎么写吧，也可能会直接删掉，只保留部分内容也说不准
？