@@ -50,17 +50,17 @@ int main()
50
50
unsigned long long tidx ;
51
51
fprintf (stderr , "This file doesn't demonstrate an attack, but calculates the tcache idx for a given chunk size.\n" );
52
52
fprintf (stderr , "The basic formula is as follows:\n" );
53
- fprintf (stderr , "\t(IDX = CHUNKSIZE - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT\n" );
53
+ fprintf (stderr , "\tIDX = ( CHUNKSIZE - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT\n" );
54
54
fprintf (stderr , "\tOn a 64 bit system the current values are:\n" );
55
55
fprintf (stderr , "\t\tMINSIZE: 0x%lx\n" , MINSIZE );
56
56
fprintf (stderr , "\t\tMALLOC_ALIGNMENT: 0x%lx\n" , MALLOC_ALIGNMENT );
57
57
fprintf (stderr , "\tSo we get the following equation:\n" );
58
- fprintf (stderr , "\t(IDX = CHUNKSIZE - 0x%lx) / 0x%lx\n\n" , MINSIZE - MALLOC_ALIGNMENT + 1 , MALLOC_ALIGNMENT );
58
+ fprintf (stderr , "\tIDX = ( CHUNKSIZE - 0x%lx) / 0x%lx\n\n" , MINSIZE - MALLOC_ALIGNMENT + 1 , MALLOC_ALIGNMENT );
59
59
fprintf (stderr , "BUT be AWARE that CHUNKSIZE is not the x in malloc(x)\n" );
60
60
fprintf (stderr , "It is calculated as follows:\n" );
61
- fprintf (stderr , "\tIF x < MINSIZE(0x%lx) CHUNKSIZE = MINSIZE (0x%lx)\n" , MINSIZE , MINSIZE );
61
+ fprintf (stderr , "\tIF x + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE(0x%lx) CHUNKSIZE = MINSIZE (0x%lx)\n" , MINSIZE , MINSIZE );
62
62
fprintf (stderr , "\tELSE: CHUNKSIZE = (x + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK) \n" );
63
- fprintf (stderr , "\t=> CHUNKSIZE = (x + 0x%lx + 0x%lx) & ~0x%lx) \n\n\n" , SIZE_SZ , MALLOC_ALIGN_MASK , MALLOC_ALIGN_MASK );
63
+ fprintf (stderr , "\t=> CHUNKSIZE = (x + 0x%lx + 0x%lx) & ~0x%lx\n\n\n" , SIZE_SZ , MALLOC_ALIGN_MASK , MALLOC_ALIGN_MASK );
64
64
while (1 ) {
65
65
fprintf (stderr , "[CTRL-C to exit] Please enter a size x (malloc(x)) in hex (e.g. 0x10): " );
66
66
scanf ("%llx" , & req );
@@ -71,4 +71,4 @@ int main()
71
71
fprintf (stderr , "\nTCache Idx: %llu\n" , tidx );
72
72
}
73
73
return 0 ;
74
- }
74
+ }
0 commit comments