From b3b82a8093cf8179e54a68d47b6bb5226054376d Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Tue, 25 Aug 2026 15:35:28 +0800 Subject: [PATCH] =?UTF-8?q?feat(tpc):=20[DET]=20=E8=AF=BB=E5=8F=96?= =?UTF-8?q?=E6=82=AC=E7=A9=BA=E6=89=93=E5=8D=B0=20cargs=20=E6=8C=87?= =?UTF-8?q?=E5=90=91=E5=9D=97=E5=A4=B4=20-=20is=5Falive=20=E6=8B=A6?= =?UTF-8?q?=E6=88=AA=E6=97=B6=E8=BE=93=E5=87=BA=20cargs/block/hdr=EF=BC=88?= =?UTF-8?q?0=3D=E5=B7=B2free=20UAF=E5=AE=9E=E9=94=A4=20=E5=A5=87=E6=95=B0?= =?UTF-8?q?=3D=E6=B4=BB=E8=B7=83=E4=BD=86=E8=AE=B0=E5=BD=95=E8=A1=A8?= =?UTF-8?q?=E5=BC=82=E5=B8=B8=20=E5=85=B6=E5=AE=83=3D=E9=9D=9Epool?= =?UTF-8?q?=E5=9D=97=EF=BC=89=EF=BC=8C=E5=AE=9A=E4=BD=8D=20KwEntry=20cl.ar?= =?UTF-8?q?gs=20=E6=82=AC=E7=A9=BA=E6=BA=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- TransPyV/App/lib/core/Gen/CallGenCtor.vp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/TransPyV/App/lib/core/Gen/CallGenCtor.vp b/TransPyV/App/lib/core/Gen/CallGenCtor.vp index 14a4cc2..24dde76 100644 --- a/TransPyV/App/lib/core/Gen/CallGenCtor.vp +++ b/TransPyV/App/lib/core/Gen/CallGenCtor.vp @@ -133,8 +133,12 @@ class CallGenCtor(CallGenBase.CallGenBase): # 默认关闭无开销。补 _det_probe 写入侧检测的盲区。 if cargs is not None and pool is not None: if pool.is_alive(cargs) == 0: - stdio.printf("[DET] 读取悬空: struct-ctor cargs=%llu 不在存活记录（cl.args 悬空 = use-after-free 读取）\n", - t.CUInt64T(cargs)) + # 打印 cargs 指向的块头：0=已 free（UAF 实锤） 奇数=活跃（记录表 + # 异常） 其它=非 pool 块（stdlib.malloc/垃圾指针）——定位悬空源 + blk_c: t.CUInt64T = t.CUInt64T(cargs) - 2 - 8 + hdr_c: t.CUInt64T = t.CUInt64T(c.Deref(t.CUInt64T(blk_c, t.CPtr))) + stdio.printf("[DET] 读取悬空: struct-ctor cargs=%llu block=%llu hdr=0x%llX（0=free 奇数=活跃 其它=非pool块）\n", + t.CUInt64T(cargs), blk_c, hdr_c) stdlib.exit(1) # 创建临时 alloca # 确保跨模块结构体的完整定义在当前模块中可用（供 alloca 分配空间）