H4niz

AFL_USE_ASAN=1 export CC=afl-gcc 
AFL_USE_ASAN=1 export CXX=afl-g++ 
AFL_USE_ASAN=1 export CFLAGS="-g -O0 -lpthread"
AFL_USE_ASAN=1 export CXXFLAGS="-g -O0 -lpthread"
AFL_USE_ASAN=1 make 
AFL_USE_ASAN=1 make install

H4niz

git clone https://github.com/vim/vim
cd vim

Compile with ASAN: https://aflplus.plus/docs/notes_for_asan/
AFL_USE_ASAN=1 ./configure CC=afl-gcc CXX=afl-g++ CFLAGS="-g -O0" CXXFLAGS="-g -O0"
AFL_USE_ASAN=1 make 
AFL_USE_ASAN=1 make install

H4niz

#python code
import frida
import time

#========= INIT ============
_PACKAGE_ = "owasp.mstg.uncrackable1"
_HOOKINGSCRIPT_ = "hooking_script.js"


def on_message(message, data):

H4niz

#python code
import frida
import time

#========= INIT ============
_PACKAGE_ = "com.product.name"
_HOOKINGSCRIPT_ = "hooking_script.js"


def on_message(message, data):

H4niz

/* Extra data for wide character streams.  */
struct _IO_wide_data
{
  wchar_t *_IO_read_ptr;    /* Current read pointer */
  wchar_t *_IO_read_end;    /* End of get area. */
  wchar_t *_IO_read_base;   /* Start of putback+get area. */
  wchar_t *_IO_write_base;  /* Start of put area. */
  wchar_t *_IO_write_ptr;   /* Current put pointer. */
  wchar_t *_IO_write_end;   /* End of put area. */
  wchar_t *_IO_buf_base;    /* Start of reserve area. */

H4niz

struct _IO_jump_t
{
    JUMP_FIELD(size_t, __dummy);
    JUMP_FIELD(size_t, __dummy2);
    JUMP_FIELD(_IO_finish_t, __finish);
    JUMP_FIELD(_IO_overflow_t, __overflow);
    JUMP_FIELD(_IO_underflow_t, __underflow);
    JUMP_FIELD(_IO_underflow_t, __uflow);
    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);
    /* showmany */

H4niz

struct _IO_FILE {
  int _flags;       /* High-order word is _IO_MAGIC; rest is flags. */
#define _IO_file_flags _flags
 
  /* The following pointers correspond to the C++ streambuf protocol. */
  /* Note:  Tk uses the _IO_read_ptr and _IO_read_end fields directly. */
  char* _IO_read_ptr;   /* Current read pointer */
  char* _IO_read_end;   /* End of get area. */
  char* _IO_read_base;  /* Start of putback+get area. */
  char* _IO_write_base; /* Start of put area. */

H4niz

int
_IO_flush_all_lockp (int do_lock)
{
  int result = 0;
  struct _IO_FILE *fp;
  int last_stamp;
 
#ifdef _IO_MTSAFE_IO
  __libc_cleanup_region_start (do_lock, flush_cleanup, NULL);
  if (do_lock)

H4niz

/*
   If not the first time through, we require old_size to be
   at least MINSIZE and to have prev_inuse set.
 */
 
assert ((old_top == initial_top (av) && old_size == 0) ||
        ((unsigned long) (old_size) >= MINSIZE &&
         prev_inuse (old_top) &&
         ((unsigned long) old_end & (pagesize - 1)) == 0));
 

H4niz

#!/usr/bin/env python


from pwn import *

__DEBUG__ = 0
__FILE__ = "./babystack"
ELF(__FILE__)
__BIN__ = ""
__HOST__ = "chall.pwnable.tw"