Check if that note was freed:
chmod +x bad_memories_v0.9 ./bad_memories_v0.9 It prints:
(gdb) set void *(char *)0x6020a0 = 0x401456 (gdb) call (*(void(*)(char*))0x6020a0)(0x6020a0+8) Output:
Loading memory... [1] Allocate [2] Write [3] Read [4] Free [5] Exit A heap note manager – likely vulnerable to UAF (use-after-free) or double-free.
gdb -c core.dump (gdb) dump memory recovered.bin 0x400000 0x401000 # typical .text section But better: use volatility (if full memory dump) or memdump from /proc/pid/maps style.
But it’s never called normally. The challenge name "Bad Memories" + -recreation- hints we need to force a UAF to redirect execution to this function. Examine heap chunks in the core dump.
[0x00401234]> afl | grep secret 0x00401456 sym.secret_function Disassemble secret_function :
(gdb) x/10gx 0x6020a0 Shows 0x401456 in the vtable slot – that’s the secret function address!
Bad Memories -v0.9- -recreation- May 2026
Check if that note was freed:
chmod +x bad_memories_v0.9 ./bad_memories_v0.9 It prints:
(gdb) set void *(char *)0x6020a0 = 0x401456 (gdb) call (*(void(*)(char*))0x6020a0)(0x6020a0+8) Output: Bad Memories -v0.9- -recreation-
Loading memory... [1] Allocate [2] Write [3] Read [4] Free [5] Exit A heap note manager – likely vulnerable to UAF (use-after-free) or double-free.
gdb -c core.dump (gdb) dump memory recovered.bin 0x400000 0x401000 # typical .text section But better: use volatility (if full memory dump) or memdump from /proc/pid/maps style. Check if that note was freed:
chmod +x bad_memories_v0
But it’s never called normally. The challenge name "Bad Memories" + -recreation- hints we need to force a UAF to redirect execution to this function. Examine heap chunks in the core dump.
[0x00401234]> afl | grep secret 0x00401456 sym.secret_function Disassemble secret_function : But it’s never called normally
(gdb) x/10gx 0x6020a0 Shows 0x401456 in the vtable slot – that’s the secret function address!