设置linux缓冲模式,LinuxBufferMode缓冲模式总结

Linux缓冲模式笔记&＃xff0c;本篇文章已收录进Pwn Notebook Linux OS 部分

Buffer Mode

IntroductionThe three types of buffering available are unbuffered, block buffered, and line buffered.

When an output stream is unbuffered, information appears on the destination file or terminal as soon as written; when it is block buffered many characters are saved up and written as a block; when it is line buffered characters are saved up until a newline is output or input is read from any stream attached to a terminal device (typically stdin).

The function fflush may be used to force the block out early.

Normally all files are block buffered. If a stream refers to a terminal (as stdout normally does), it is line buffered. The standard error stream stderr is always unbuffered by default.

总结一下&＃xff1a;

buffer有三种模式&＃xff1a;unbuffered, block buffered, line buffered

unbuffered - 不缓冲&＃xff0c;输入的字符立即输出

line buffered - 行缓冲&＃xff0c;输入的字符遇到\n再输出

block buffered - 块缓冲&＃xff0c;有时也叫全缓冲(应该是遇到EOF再输出叭)可使用fflush强行输出

stdin和stdout默认line buffered

stderr默认unbuffered

其他文件描述符默认block buffered(打开的文件用的就是块缓冲模式)

stdbuf

IntroductionRun COMMAND, with modified buffering operations for its standard streams.

这是一条linux命令&＃xff0c;可以以指定的标准文件流缓冲模式运行命令

这条命令是我在WPICTF中遇到的(getshell之后dump下来的启动脚本)

脚本内容如下&＃xff1a;

bash1

2

3

4

5

6#!/bin/bash

exec 2> /dev/null

cd /home/ctf/

#sleep 1

./stdbuf -i 0 -o 0 -e 0 ./nanoprint

通过stdbuf命令&＃xff0c;设置stdin,stdout和stderr全部为不缓冲模式&＃xff0c;然后运行题目的程序

Analysis

这条命令很实用啊&＃xff0c;一般的题目是通过setvbuf在程序运行的开头设置缓冲模式&＃xff0c;比如&＃xff1a;

c1setvbuf(stdin,0,2,0); // 设置stdin的缓冲模式

显然程序中的代码越多就越有可能被利用(废话…)

如果程序中有上面这条语句&＃xff0c;那么在程序编译后&＃xff0c;bss段中将存在stdin指针

于是就可能存在如下利用方式&＃xff1a;

heap中变量存在越界读写&＃xff0c;可以读写stdin指针&＃xff0c;然后篡改IO_FILE结构体

从libc中泄漏程序基址(详见由libc泄漏text)

然鹅&＃xff0c;如果使用stdbuf命令启动程序&＃xff0c;可以在程序运行前完成缓冲区模式的设置工作。

这样更加安全~

Conclusion

使用stdbuf启动程序&＃xff0c;可以避免程序因为使用setvbuf造成的相应文件IO指针出现在bss段&＃xff0c;从而减少可被利用的点