feat: merge lab5

.github/workflows/lab-autograding.yml

@@ -45,7 +45,8 @@ jobs:
                       const files = await github.rest.pulls.listFiles({ owner, repo, pull_number: issue_number });
                       const changedFiles = files.data.map((file) => file.filename);
                       const allowedFileRegex = /^lab\d+\/main_test.js$/;
-                      if (!changedFiles.every((file) => allowedFileRegex.test(file))) {
+                      const specialChangedFiles = ["lab5/Answer.md", "lab5/antiasan.c"];
+                      if (!changedFiles.every((file) => (allowedFileRegex.test(file) || specialChangedFiles.includes(file)))) {
                         core.setFailed('The PR contains changes to files other than the allowed files.');
                       }
                       return labNumber;

lab5/Answer.md

@@ -0,0 +1,92 @@
+# Answer
+
+Name: 
+ID: 
+
+## Test Valgrind and ASan
+### Result
+|                      | Valgrind | Asan |
+| -------------------- | -------- | ---- |
+| Heap out-of-bounds   |          |      |
+| Stack out-of-bounds  |          |      |
+| Global out-of-bounds |          |      |
+| Use-after-free       |          |      |
+| Use-after-return     |          |      |
+
+### Heap out-of-bounds
+#### Source code
+```
+
+```
+#### Valgrind Report
+```
+
+```
+### ASan Report
+```
+
+```
+
+### Stack out-of-bounds
+#### Source code
+```
+
+```
+#### Valgrind Report
+```
+
+```
+### ASan Report
+```
+
+```
+
+### Global out-of-bounds
+#### Source code
+```
+
+```
+#### Valgrind Report
+```
+
+```
+### ASan Report
+```
+
+```
+
+### Use-after-free
+#### Source code
+```
+
+```
+#### Valgrind Report
+```
+
+```
+### ASan Report
+```
+
+```
+
+### Use-after-return
+#### Source code
+```
+
+```
+#### Valgrind Report
+```
+
+```
+### ASan Report
+```
+
+```
+
+## ASan Out-of-bound Write bypass Redzone
+### Source code
+```
+
+```
+### Why
+

lab5/Makefile

@@ -0,0 +1,17 @@
+.PHONY: all
+all: uaf_asan
+
+uaf_asan: uaf.c libantiasan.so
+	gcc -fsanitize=address -Og -g -o $@ $< -lantiasan -L.
+
+libantiasan.so: antiasan.c
+	gcc -g -fPIC -c antiasan.c
+	gcc -shared antiasan.o -o libantiasan.so
+
+.PHINY: run
+run:
+	LD_LIBRARY_PATH=. ./uaf_asan
+
+.PHONY: clean
+clean:
+	rm uaf_asan antiasan.o libantiasan.so

lab5/README.md

@@ -0,0 +1,29 @@
+# Lab5
+
+## Introduction
+
+In this lab, you will write a function antoasan to bypass detection of ASan in `antiasan.c` and answer questions of slide in `Answer.md`.
+
+## Preparation (Important!!!)
+
+1. Sync fork your branch (e.g., `SQLab:311XXXXXX`)
+2. `git checkout -b lab5` (**NOT** your student ID !!!)
+
+## Requirement
+
+1. (50%) Test Valgrind and ASan to detect common memory corruption vulns, and then asnwer result, report of Valgrind/ASan and Vulnerable code in `Answer.md`.
+2. (40%) Write a vulnerable code to bypass redzone between 2 int [8] arrays and asnwer reason and code in `Answer.md`.
+
+3. (30%) write a function antoasan to bypass detection of ASan in `antiasan.c`.
+You can run `validate.sh` in your local to test if you satisfy the requirements.
+
+Please note that you must not alter files other than `antiasan.c` and `Answer.md`. You will get 0 points if
+
+1. you modify other files to achieve requirements.
+2. you can't pass all CI on your PR.
+
+## Submission
+
+You need to open a pull request to your branch (e.g. 311XXXXXX, your student number) and contain the code that satisfies the abovementioned requirements.
+
+Moreover, please submit the URL of your PR to E3. Your submission will only be accepted when you present at both places.

lab5/ans

@@ -0,0 +1,3 @@
+LD_LIBRARY_PATH=. ./uaf_asan
+s[0x10] = H
+s[0x10] = H

lab5/antiasan.c

@@ -0,0 +1,5 @@
+// TODO:
+void antiasan(unsigned long addr)
+{
+
+}

lab5/antiasan.h

@@ -0,0 +1,6 @@
+#ifndef HIJACK_H
+#define HIJACK_H
+
+void antiasan(unsigned long);
+
+#endif

lab5/uaf.c

@@ -0,0 +1,15 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "antiasan.h"
+
+int main(void)
+{
+        char *s = (char *)malloc(0x18);
+        strcpy(s, "HAHAHAHAHAHAHAHAHAHAHAH");
+        printf("s[0x10] = %c\n", s[0x10]);
+        free(s);
+        antiasan((unsigned long)&s[0x10]);
+        printf("s[0x10] = %c\n", s[0x10]);
+        return 0;
+}

lab5/validate.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# Check for unwanted files
+for file in *; do
+  if [[ $file != "uaf.c" && $file != "antiasan.c" && $file != "antiasan.h" && $file != "Makefile" && $file != "README.md" && $file != "Answer.md" && $file != "validate.sh" && $file != "ans" ]]; then
+    echo "[!] Unwanted file detected: $file."
+    exit 1
+  fi
+done
+
+test_path="${BASH_SOURCE[0]}"
+solution_path="$(realpath .)"
+tmp_dir=$(mktemp -d -t lab5-XXXXXXXXXX)
+answer=""
+
+cd $tmp_dir
+
+rm -rf *
+cp $solution_path/Makefile .
+cp $solution_path/*.c .
+cp $solution_path/*.h .
+cp $solution_path/ans .
+
+make
+make run > out 2>&1
+result=$(diff ans out)
+if [[ -n $result ]]; then
+  echo "[!] Expected: "
+  cat ans
+  echo ""
+  echo "[!] Actual:   "
+  cat out
+  echo ""
+  exit 1
+else
+  echo "[V] Pass"
+fi
+
+rm -rf $tmp_dir
+
+exit 0
+
+# vim: set fenc=utf8 ff=unix et sw=2 ts=2 sts=2: