1 #include <stdio.h> 2 3 // gcc -shared -o libdemo.so demo-so.c -w target_func(char * buf,int size)4int target_func(char *buf, int size) { 5 6 printf("buffer:%p, size:%p\n", buf, size); 7 switch (buf[0]) { 8 9 case 1: 10 puts("222"); 11 if (buf[1] == '\x44') { 12 13 puts("null ptr deference"); 14 *(char *)(0) = 1; 15 16 } 17 18 break; 19 case 0xff: 20 if (buf[2] == '\xff') { 21 22 if (buf[1] == '\x44') { 23 24 puts("crash...."); 25 *(char *)(0xdeadbeef) = 1; 26 27 } 28 29 } 30 31 break; 32 default: 33 puts("default action"); 34 break; 35 36 } 37 38 return 1; 39 40 } 41 42