两个freed chunk不可能相连（会合并），但两个inuse的chunk可以物理彼此相连，此时后一个chunk的prev_size无效，用后一个的prev_size去计算前一个chunk的信息是错误的。

而且我去看了一下原博客指向的源代码，没有发现这几行内容。 https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c

重点是删去了：

/* Size of the chunk below P.  Only valid if prev_inuse (P).  */
\#define prev_size(p) ((p)->mchunk_prev_size)

/* Set the size of the chunk below P.  Only valid if prev_inuse (P).  */
\#define set_prev_size(p, sz) ((p)->mchunk_prev_size = (sz))

/* Ptr to previous physical malloc_chunk.  Only valid if prev_inuse (P).  */
\#define prev_chunk(p) ((mchunkptr)(((char *) (p)) - prev_size(p)))

其他都是修正笔误。

以下是没学过数论、半天尝试搞懂此题的新手的理解

对向下取整的补充： N为奇数，N/2会去尾，但是脚本中终止条件是low == up，而不是P被取唯一可能值，所以返回偶数时P<N/2中等号不是必须的。

数学归纳法中的补充：

发送2C时，返回奇数，即2P mod N 为奇数，这表明2P已经超过了N，并且返回的奇数是2P减去 奇数倍N的结果。此时，由于P显然小于N，故2P<2N，所以必定为减去了1个N 发送4C时，返回偶数，即4P mod N 为偶数，这表明4P减去了 偶数倍N。此时考虑2P>N即4P>2N并且4P<4N，故必定为减去了2个N

解释每次发的数值是上一次的两倍的原因以及k与x的关系：

假设发送第i个包(2C,4C,8C...)时，服务器经计算减去了x个N 那么当发送第i+1个包时， (1)若返回奇数，表明减去了奇数个N，根据上述讨论，至少减去2x个N，小于 2x+2个N，所以一共减去了2x+1个N (2)若返回偶数，表明减去了偶数个N，根据上述讨论，至少减去2x个N，小于 2x+2个N，所以一共减去了2x个N

发送2C时，即2的一次幂，减去1个N 发送4C时，即2的二次幂，减去了2个N 发送二的x次幂乘以C时，减去k个N，结论：k = 2x + 1 (返回奇) k = 2x（返回偶） 事实上此处相当于x1,x2,x3......k为某个x的后一项

this file https://github.com/ctf-wiki/ctf-wiki/blob/master/docs/pwn/linux/kernel/bypass_smep.md said: use extract-vmlinux.sh to get vmlinux from bzImage. but I get the following error:

./extract-vmlinux.sh  bzImage >vmlinux
tr: Illegal byte sequence
tr: Illegal byte sequence
tr: Illegal byte sequence
tr: Illegal byte sequence
tr: Illegal byte sequence
tr: Illegal byte sequence
tr: Illegal byte sequence
extract-vmlinux.sh: Cannot find vmlinux.

Thanks for contributing to CTF Wiki!

Before you submit this pull request, please read

• CONTRIBUTING
• CTF Wiki's Wiki

Please remove these message before PR.

中级rop章节中：

猜测出canary一个字节之后仍然crash，怎么判断这一个字节正确呢 32位下 不应该是2^8 * 2^8 * 2^8 * 2^8 为什么是2^8 * 4=1024呢 :)目前还没有看canary的原理，可能是原理不清楚的锅? 上一章花式rop中有一个 leak canary 通过read末尾不加\0实现，为了防止canary最后一位是\0覆盖了最后一个字节 canary的最后一个字节一定是\0吗？

The main problem is that the sentence 「如果 P 的最后一个字节是 i 的话，那么最后的 padding 就是 0x01」 is wrong, actually it should be 「如果 D_k(Y) 的最后一个字节是 i 的话，那么最后的 padding 就是 0x01」。

Instead of modifying it, I adjust the context to make it more accurate and straightforward. Also I take the aforementioned CBC definition to better illustrate the process.

Moreover, there are several minor fixes are made:

• Fix notations to distinguish the crafted ones from the origin ones, such as P' and P, F' and F.
• The byte range of padding characters should be 1 to n instead of 0 to n.
• Wrap symbols with LaTeX '$' characters to improve readability.

Reference: https://zh.wikipedia.org/zh-tw/%E5%AF%86%E6%96%87%E5%A1%AB%E5%A1%9E%E6%94%BB%E5%87%BB

"制定" in Chinese means "经过一定程序定出法律、规程、政策等" which I think was not fit for this sentense, so I replaced this word with "指定" whose meaning is "指明确定".

该节介绍例子2015 年 CSAW 中的 contacts时，以下论述存在错误

原文中 "其次，我们可以确定栈上存储格式化字符串的地址 0xffffcd2c 相对于格式化字符串的偏移为 6，得到这个是为了构造我们的联系人。 再者，我们可以看出下面的地址保存着上层函数的调用地址，其相对于格式化字符串的偏移为 11，这样我们可以直接修改上层函数存储的 ebp 的值。" 栈上存储格式化字符串的地址 0xffffcd2c 相对于格式化字符串的偏移应该为11， 而栈中保存着上层函数的调用地址的ebp，其相对于格式化字符串的偏移应该为6， 文中将上述两者颠倒了

外链的修改

Thanks for contributing to CTF Wiki!

Before you submit this pull request, please read

• CONTRIBUTING
• CTF Wiki's Wiki

Please remove these message before PR.

Thanks for contributing to CTF Wiki!

Before you submit this pull request, please read

• CONTRIBUTING
• CTF Wiki's Wiki

Please remove these message before PR.

ATT. Just build and serve using lighttpd. Still need to change CDN resource to local. Please create a new issue for me if accepted. And I also created a docker hub organization called ctfwiki (hyphen is not allowed by docker hub), more member need to be added. docker run -d xm1994/ctf-wiki:add-dockerfile and will run it now.

添加漏洞“IDOR”

不安全的直接对象引用 (Insecure Direct Object References, IDOR) 是一种常见的 Web 应用程序漏洞，其允许攻击者访问应该被限制的资源或信息。下面是一些 IDOR 漏洞的例子：

一个在线商店的 URL 包含了商品的编号，攻击者可以通过操纵这个编号来访问限制访问的商品。

一个网站的 URL 包含了用户的用户名，攻击者可以通过操纵这个用户名来访问其他用户的信息。

一个应用程序的 URL 包含了文件的编号，攻击者可以通过操纵这个

您好，我在mkdocs build的时候遇到问题 [root@VM-0-5-centos ctf-wiki]# python3 scripts/docs.py build-all Updating en Updating zh Building docs for: zh Error reading page 'android/basic_operating_mechanism/native_layer/so.md': format() argument must be a formatter instance, not a class Traceback (most recent call last):

File "/usr/local/lib64/python3.6/site-packages/pygments/init.py", line 61, in format formatter.format(tokens, realoutfile)

File "/usr/local/lib64/python3.6/site-packages/pygments/formatter.py", line 94, in format return self.format_unencoded(tokensource, outfile)

File "/usr/local/lib64/python3.6/site-packages/pygments/formatters/html.py", line 981, in format_unencoded source = self.wrap(source)

TypeError: wrap() missing 1 required positional argument: 'outfile'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "scripts/docs.py", line 458, in

File "scripts/docs.py", line 279, in build_all

File "/usr/local/lib/python3.6/site-packages/mkdocs/commands/build.py", line 292, in build _populate_page(file.page, config, files, dirty)

File "/usr/local/lib/python3.6/site-packages/mkdocs/commands/build.py", line 174, in _populate_page page.render(config, files)

File "/usr/local/lib/python3.6/site-packages/mkdocs/structure/pages.py", line 175, in render self.content = md.convert(self.markdown)

File "/usr/local/lib/python3.6/site-packages/markdown/core.py", line 261, in convert self.lines = prep.run(self.lines)

File "/usr/local/lib/python3.6/site-packages/pymdownx/superfences.py", line 863, in run return self.search_nested(lines)

File "/usr/local/lib/python3.6/site-packages/pymdownx/superfences.py", line 697, in search_nested self.eval_quoted(ws, content, quote_level, start, end)

File "/usr/local/lib/python3.6/site-packages/pymdownx/superfences.py", line 450, in eval_quoted self.process_nested_block(ws, content, start, end)

File "/usr/local/lib/python3.6/site-packages/pymdownx/superfences.py", line 471, in process_nested_block attrs=self.attrs if self.attr_list else {}

File "/usr/local/lib/python3.6/site-packages/pymdownx/superfences.py", line 794, in highlight code_block_count=self.highlight_ext.pygments_code_block

File "/usr/local/lib/python3.6/site-packages/pymdownx/highlight.py", line 381, in highlight code = highlight(src, lexer, formatter)

File "/usr/local/lib64/python3.6/site-packages/pygments/init.py", line 82, in highlight return format(lex(code, lexer), formatter, outfile)

File "/usr/local/lib64/python3.6/site-packages/pygments/init.py", line 69, in format raise TypeError('format() argument must be a formatter instance, '

TypeError: format() argument must be a formatter instance, not a class

位置：https://github.com/ctf-wiki/ctf-wiki/blob/master/docs/zh/docs/pwn/linux/user-mode/stackoverflow/x86/basic-rop.md 详情：我跟着ctf-wiki学习rop时发现，gdb运行ret2shellcode文件时，bss段并没有和网上截图一样是可执行的。是我操作有误吗？还是ubuntu更新造成的？

WEB-INF 主要包含一下文件或目录

更新为：

WEB-INF 主要包含以下文件或目录

Thanks for contributing to CTF Wiki!

Before submitting this pull request, please read

• Contribute
• CTF Wiki's Wiki

Please remove these message before PR.