Vortex Level 11

Vortex
Posted February 27th, 2008 by arcanum
in
Chunk Corruption
You must corrupt the heap in order to gain arbitrary control of this program. Do recall, the application is using phkmalloc.
Reading Material
BSD Heap Smashing
Once upon a free()
Advanced Doug Lea's malloc exploits
Exploiting the Wilderness

Level 11 Source Code

#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {
        char *p;
        char *q;
        char *r;
        char *s;
        if (argc < 3)
        {
                exit(0);
        }
        p = (char *) malloc(0x800);
        q = (char *) malloc(0x10);
        r = (char *) malloc(0x800);
        strcpy(r , argv[1]);
        s = (char *) malloc(0x10);
        strncpy(s , argv[2], 0xf);
        exit(0);
}

phkmalloc code