1 #include <libcgc.h>
2 #include <stdlib.h>
3 #include <string.h>
4
5 /* Just leak 4 bytes from the flag page, performing a simple mutation on those bytes */
6
main(int secret_page_i)7 int __attribute((fastcall)) main(int secret_page_i)
8 {
9
10 printf("prepare for a challenge\n");
11 int i;
12 int *addrs[20];
13 int *a, *b, *c, *d, *e;
14
15 for(i=0;i<20;i++)
16 {
17 allocate(0x1000, 0, &addrs[i]);
18 printf("%x\n", addrs[i]);
19 }
20
21 printf("deallocating %x\n", addrs[5]);
22 deallocate(addrs[10], 0x8000);
23
24 deallocate(addrs[0], 0x4000);
25
26 allocate(0x2000, 0, &a);
27 printf("a: %x\n", a);
28
29 allocate(0x1000, 0, &b);
30 printf("b: %x\n", b);
31
32 allocate(0x6000, 0, &c);
33 printf("c: %x\n", c);
34
35 allocate(0x1000, 0, &d);
36 printf("d: %x\n", d);
37
38 allocate(0x3000, 0, &e);
39 printf("e: %x\n", e);
40
41 allocate(0x40000, 0, &e);
42 printf("e: %x\n", e);
43
44
45 deallocate(addrs[19], 0x400000);
46
47 allocate(0x2000, 0, &a);
48 printf("a: %x\n", a);
49
50 allocate(0x1000, 0, &b);
51 printf("b: %x\n", b);
52
53 allocate(0x6000, 0, &c);
54 printf("c: %x\n", c);
55
56 allocate(0x1000, 0, &d);
57 printf("d: %x\n", d);
58
59 allocate(0x3000, 0, &e);
60 printf("e: %x\n", e);
61
62 allocate(0x40000, 0, &e);
63 printf("e: %x\n", e);
64
65 printf("allocate: %d\n", allocate(0x0, 0, &e));
66
67 for (i=0;i<20;i++)
68 deallocate(addrs[0], 0x1000);
69
70 allocate(0x3333, 0, &a);
71 printf("a: %x\n", a);
72 }
73