HackTricks
Bins & Memory Allocations
Tip
AWSใใใญใณใฐใๅญฆใณใๅฎ่ทตใใ๏ผ
HackTricks Training AWS Red Team Expert (ARTE)
GCPใใใญใณใฐใๅญฆใณใๅฎ่ทตใใ๏ผHackTricks Training GCP Red Team Expert (GRTE)
HackTricks Training Azure Red Team Expert (AzRTE)
HackTricksใใตใใผใใใ
- ใตใในใฏใชใใทใงใณใใฉใณใ็ขบ่ชใใฆใใ ใใ๏ผ
- **๐ฌ Discordใฐใซใผใใพใใฏใใฌใฐใฉใ ใฐใซใผใใซๅๅ ใใใใTwitter ๐ฆ @hacktricks_liveใใใฉใญใผใใฆใใ ใใใ
- HackTricksใใใณHackTricks CloudใฎGitHubใชใใธใใชใซPRใๆๅบใใฆใใใญใณใฐใใชใใฏใๅ ฑๆใใฆใใ ใใใ
ๅบๆฌๆ ๅ ฑ
ใใฃใณใฏใฎไฟๅญๅน็ใๅไธใใใใใใซใๅใใฃใณใฏใฏๅไธใฎใชใณใฏใชในใใซใ ใๅญๅจใใใฎใงใฏใชใใใใใคใใฎใฟใคใใใใใพใใใใใใใณใงใใใ5็จฎ้กใฎใใณใใใใพใ: 62 ๅฐใใณใ63 ๅคงใใณใ1 ๆชๆด็ใใณใ10 ้ซ้ใใณใในใฌใใใใจใซ64 tcacheใใณใงใใ
ๆชๆด็ใๅฐใใณใๅคงใใณใฎๅใใณใธใฎๅๆใขใใฌในใฏๅใ้ ๅๅ ใซใใใพใใใคใณใใใฏใน0ใฏๆชไฝฟ็จใ1ใฏๆชๆด็ใใณใใใณ2-64ใฏๅฐใใณใใใณ65-127ใฏๅคงใใณใงใใ
Tcache (ในใฌใใใใจใฎใญใฃใใทใฅ) ใใณ
ในใฌใใใฏใใใใ็ฌ่ชใฎใใผใใๆใจใใจใใพใใ๏ผใขใชใผใใใใณใตใใใผใใๅ็ ง๏ผใๅคใใฎในใฌใใใๆใคใใญใปใน๏ผใฆใงใใตใผใใผใฎใใใช๏ผใฏไปใฎในใฌใใใจใใผใใๅ ฑๆใใๅฏ่ฝๆงใใใใพใใใใฎๅ ดๅใไธปใช่งฃๆฑบ็ญใฏใญใใซใผใฎไฝฟ็จใงใใใใใใซใใในใฌใใใๅคงๅน ใซ้ ใใชใๅฏ่ฝๆงใใใใพใใ
ใใใใฃใฆใtcacheใฏในใฌใใใใจใฎ้ซ้ใใณใซไผผใฆใใใใใฃใณใฏใใใผใธใใชใๅไธใฎใชใณใฏใชในใใงใใๅในใฌใใใซใฏ64ใฎๅไธใชใณใฏtcacheใใณใใใใพใใๅใใณใฏใ64ใใใใทในใใ ใง24ใใ1032Bใ32ใใใใทในใใ ใง12ใใ516Bใฎ็ฏๅฒใฎ ๅใตใคใบใฎใใฃใณใฏใๆๅคง7ใคๆใคใใจใใงใใพใใ
ในใฌใใใใใฃใณใฏใ่งฃๆพใใใจใใtcacheใซๅฒใๅฝใฆใใซใฏๅคงใใใใชใๅ ดๅใใใใณ่ฉฒๅฝใใtcacheใใณใๆบๆฏใงใชใๅ ดๅ๏ผใใงใซ7ใคใฎใใฃใณใฏใใใๅ ดๅ๏ผใใใใซๅฒใๅฝใฆใใใพใใtcacheใซ่กใใชใๅ ดๅใใฐใญใผใใซใซ่งฃๆพๆไฝใๅฎ่กใใใใใซใใผใใญใใฏใๅพ ใคๅฟ ่ฆใใใใพใใ
ใใฃใณใฏใๅฒใๅฝใฆใใใใจใใๅฟ
่ฆใชใตใคใบใฎ็ฉบใใใฃใณใฏใTcacheใซใใใฐใใใไฝฟ็จใใใใใงใชใใใฐใใฐใญใผใใซใใณใง่ฆใคใใใๆฐใใใใฎใไฝๆใใใใใซใใผใใญใใฏใๅพ
ใคๅฟ
่ฆใใใใพใใ
ใพใใๆ้ฉๅใใใใใใฎๅ ดๅใใใผใใญใใฏใไฟๆใใฆใใ้ใในใฌใใใฏ่ฆๆฑใใใใตใคใบใฎใใผใใใฃใณใฏ๏ผ7๏ผใงTcacheใๆบใใใพใใฎใงใใใใซๅฟ
่ฆใชๅ ดๅใฏTcacheใง่ฆใคใใใใจใใงใใพใใ
Tcacheใใฃใณใฏใฎไพใ่ฟฝๅ
```c #includeint main(void) { char *chunk; chunk = malloc(24); printf(โAddress of the chunk: %p\nโ, (void *)chunk); gets(chunk); free(chunk); return 0; }
ใณใณใใคใซใใฆใmain้ขๆฐใฎretใชใใณใผใใซใใฌใผใฏใใคใณใใ่จญๅฎใใพใใๆฌกใซใgefใไฝฟ็จใใใจใไฝฟ็จไธญใฎtcache binใ่ฆใใใจใใงใใพใ:
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=0, size=0x20, count=1] โ Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
Tcache ๆง้ ไฝใจ้ขๆฐ
ไปฅไธใฎใณใผใใงใฏใmax bins ใจ chunks per indexใใใใซใใชใผใ้ฟใใใใใซไฝๆใใใ tcache_entry ๆง้ ไฝใๅในใฌใใใใใณใฎๅใคใณใใใฏในใธใฎใขใใฌในใๆ ผ็ดใใใใใซไฝฟ็จใใ tcache_perthread_struct ๆง้ ไฝใ่ฆใใใจใใงใใพใใ
tcache_entry ใจ tcache_perthread_struct
```c
// From https://github.com/bminor/glibc/blob/f942a732d37a96217ef828116ebe64a644db18d7/malloc/malloc.c
/* We want 64 entries. This is an arbitrary limit, which tunables can reduce. */
define TCACHE_MAX_BINS 64
define MAX_TCACHE_SIZE tidx2usize (TCACHE_MAX_BINS-1)
/* Only used to pre-fill the tunables. */
define tidx2usize(idx) (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ)
/* When โxโ is from chunksize(). */
define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
/* When โxโ is a user-provided size. */
define usize2tidx(x) csize2tidx (request2size (x))
/* With rounding and alignment, the bins areโฆ idx 0 bytes 0..24 (64-bit) or 0..12 (32-bit) idx 1 bytes 25..40 or 13..20 idx 2 bytes 41..56 or 21..28 etc. */
/* This is another arbitrary limit, which tunables can change. Each tcache bin will hold at most this number of chunks. */
define TCACHE_FILL_COUNT 7
/* Maximum chunks in tcache bins for tunables. This value must fit the range of tcache->counts[] entries, else they may overflow. */
define MAX_TCACHE_COUNT UINT16_MAX
[โฆ]
typedef struct tcache_entry { struct tcache_entry next; / This field exists to detect double frees. */ uintptr_t key; } tcache_entry;
/* There is one of these for each thread, which contains the per-thread cache (hence โtcache_perthread_structโ). Keeping overall size low is mildly important. Note that COUNTS and ENTRIES are redundant (we could have just counted the linked list each time), this is for performance reasons. */ typedef struct tcache_perthread_struct { uint16_t counts[TCACHE_MAX_BINS]; tcache_entry *entries[TCACHE_MAX_BINS]; } tcache_perthread_struct;
</details>
้ขๆฐ `__tcache_init` ใฏ `tcache_perthread_struct` ใชใใธใงใฏใใฎใใใฎในใใผในใไฝๆใใๅฒใๅฝใฆใ้ขๆฐใงใใ
<details>
<summary>tcache_init ใณใผใ</summary>
```c
// From https://github.com/bminor/glibc/blob/f942a732d37a96217ef828116ebe64a644db18d7/malloc/malloc.c#L3241C1-L3274C2
static void
tcache_init(void)
{
mstate ar_ptr;
void *victim = 0;
const size_t bytes = sizeof (tcache_perthread_struct);
if (tcache_shutting_down)
return;
arena_get (ar_ptr, bytes);
victim = _int_malloc (ar_ptr, bytes);
if (!victim && ar_ptr != NULL)
{
ar_ptr = arena_get_retry (ar_ptr, bytes);
victim = _int_malloc (ar_ptr, bytes);
}
if (ar_ptr != NULL)
__libc_lock_unlock (ar_ptr->mutex);
/* In a low memory situation, we may not be able to allocate memory
- in which case, we just keep trying later. However, we
typically do this very early, so either there is sufficient
memory, or there isn't enough memory to do non-trivial
allocations anyway. */
if (victim)
{
tcache = (tcache_perthread_struct *) victim;
memset (tcache, 0, sizeof (tcache_perthread_struct));
}
}
Tcache ใคใณใใใฏใน
Tcache ใซใฏใใตใคใบใซๅฟใใ่คๆฐใฎใใณใใใใๅใคใณใใใฏในใฎๆๅใฎใใฃใณใฏใธใฎใใคใณใฟใจใคใณใใใฏในใใจใฎใใฃใณใฏใฎ้ใฏใใฃใณใฏๅ ใซใใใพใใใใใฏใใใฎๆ ๅ ฑใๆใคใใฃใณใฏ๏ผ้ๅธธใฏๆๅใฎใใฎ๏ผใ็นๅฎใใใใจใงใใในใฆใฎ tcache ๅๆใใคใณใใจ Tcache ใใฃใณใฏใฎ้ใ่ฆใคใใใใจใใงใใใใจใๆๅณใใพใใ
ใใกในใใใณ
ใใกในใใใณใฏใๅฐใใชใใฃใณใฏใฎใกใขใชๅฒใๅฝใฆใ้ซ้ๅใใใใใซ่จญ่จใใใฆใใพใใๆ่ฟ่งฃๆพใใใใใฃใณใฏใ่ฟ ้ใซใขใฏใปในใงใใๆง้ ใซไฟๆใใพใใใใใใฎใใณใฏใๅพๅ ฅใๅ ๅบใ๏ผLIFO๏ผใขใใญใผใใไฝฟ็จใใฆใใใๆใๆ่ฟ่งฃๆพใใใใใฃใณใฏใๆๅใซๅๅฉ็จใใใพใใใใใฏใในใฟใใฏใฎไธ้จใใใฎๆฟๅ ฅใจๅ้คใใญใฅใผ๏ผFIFO๏ผใจๆฏ่ผใใฆ้ใใใใ้ๅบฆใซใจใฃใฆๆๅฉใงใใ
ใใใซใใใกในใใใณใฏๅๆนๅใชใณใฏใชในใใไฝฟ็จใใฆใใใๅๆนๅใชใณใฏใงใฏใชใใใใ้ๅบฆใใใใซๅไธใใพใใใใกในใใใณใฎใใฃใณใฏใฏ้ฃๆฅใใใใฃใณใฏใจใใผใธใใใชใใใใไธญ้ใใใฎๅ้คใๅฏ่ฝใซใใ่ค้ใชๆง้ ใฏๅฟ ่ฆใใใพใใใๅๆนๅใชใณใฏใชในใใฏใใใใใฎๆไฝใซๅฏพใใฆใใใทใณใใซใง่ฟ ้ใงใใ
ๅบๆฌ็ใซใใใใง่ตทใใใใจใฏใใใใใผ๏ผๆๅใฎใใฃใณใฏใใใงใใฏใใใใใฎใใคใณใฟ๏ผใๅธธใซใใฎใตใคใบใฎๆๆฐใฎ่งฃๆพใใใใใฃใณใฏใๆใใฆใใใจใใใใจใงใใใใใใฃใฆ๏ผ
- ใใฎใตใคใบใฎๆฐใใใใฃใณใฏใๅฒใๅฝใฆใใใใจใใใใใผใฏไฝฟ็จใใใใใฎ็ฉบใใใฃใณใฏใๆใใฆใใพใใใใฎ็ฉบใใใฃใณใฏใๆฌกใซไฝฟ็จใใใใฃใณใฏใๆใใฆใใใใใใใฎใขใใฌในใฏใใใใผใซไฟๅญใใใๆฌกใฎๅฒใๅฝใฆใๅฉ็จๅฏ่ฝใชใใฃใณใฏใๅๅพใใๅ ดๆใ็ฅใใใจใใงใใพใใ
- ใใฃใณใฏใ่งฃๆพใใใใจใ็ฉบใใใฃใณใฏใฏ็พๅจใฎๅฉ็จๅฏ่ฝใชใใฃใณใฏใธใฎใขใใฌในใไฟๅญใใใใฎๆฐใใ่งฃๆพใใใใใฃใณใฏใธใฎใขใใฌในใใใใใผใซ็ฝฎใใใพใใ
ใชใณใฏใชในใใฎๆๅคงใตใคใบใฏ 0x80 ใงใใใใตใคใบ 0x20 ใฎใใฃใณใฏใฏใคใณใใใฏใน 0 ใซใใตใคใบ 0x30 ใฎใใฃใณใฏใฏใคใณใใใฏใน 1 ใซ้
็ฝฎใใใพใโฆ
Caution
ใใกในใใใณใฎใใฃใณใฏใฏๅฉ็จๅฏ่ฝใจใใฆ่จญๅฎใใใฆใใชใใใใๅจๅฒใฎไปใฎ็ฉบใใใฃใณใฏใจใใผใธใงใใไปฃใใใซใใใฐใใใฎ้ใใกในใใใณใใฃใณใฏใจใใฆไฟๆใใใพใใ
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
/*
Fastbins
An array of lists holding recently freed small chunks. Fastbins
are not doubly linked. It is faster to single-link them, and
since chunks are never removed from the middles of these lists,
double linking is not necessary. Also, unlike regular bins, they
are not even processed in FIFO order (they use faster LIFO) since
ordering doesn't much matter in the transient contexts in which
fastbins are normally used.
Chunks in fastbins keep their inuse bit set, so they cannot
be consolidated with other free chunks. malloc_consolidate
releases all chunks in fastbins and consolidates them with
other free chunks.
*/
typedef struct malloc_chunk *mfastbinptr;
#define fastbin(ar_ptr, idx) ((ar_ptr)->fastbinsY[idx])
/* offset 2 to use otherwise unindexable first 2 bins */
#define fastbin_index(sz) \
((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)
/* The maximum fastbin request size we support */
#define MAX_FAST_SIZE (80 * SIZE_SZ / 4)
#define NFASTBINS (fastbin_index (request2size (MAX_FAST_SIZE)) + 1)
ใใกในใใใณใใฃใณใฏใฎไพใ่ฟฝๅ
```c #includeint main(void) { char *chunks[8]; int i;
// Loop to allocate memory 8 times for (i = 0; i < 8; i++) { chunks[i] = malloc(24); if (chunks[i] == NULL) { // Check if malloc failed fprintf(stderr, โMemory allocation failed at iteration %d\nโ, i); return 1; } printf(โAddress of chunk %d: %p\nโ, i, (void *)chunks[i]); }
// Loop to free the allocated memory for (i = 0; i < 8; i++) { free(chunks[i]); }
return 0; }
8ใคใฎๅใใตใคใบใฎใใฃใณใฏใๅฒใๅฝใฆใฆ่งฃๆพใใๆนๆณใซๆณจๆใใฆใใ ใใใใใใซใใtcacheใๆบใใใใ8ใค็ฎใฎใใฃใณใฏใใใกในใใใฃใณใฏใซๆ ผ็ดใใใพใใ
ใณใณใใคใซใใฆใ`main`้ขๆฐใฎ`ret`ใชใใณใผใใซใใฌใผใฏใใคใณใใ่จญๅฎใใฆใใใใฐใใพใใๆฌกใซใ`gef`ใไฝฟ็จใใใจใtcacheใใณใๆบๆฏใงใ1ใคใฎใใฃใณใฏใใใกในใใใณใซใใใใจใใใใใพใใ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=0, size=0x20, count=7] โ Chunk(addr=0xaaaaaaac1770, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1750, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1730, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1710, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac16f0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac16d0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] โ Chunk(addr=0xaaaaaaac1790, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
Fastbins[idx=1, size=0x30] 0x00
ๆชๆด็ใใณ
ๆชๆด็ใใณใฏใใใผใใใใผใธใฃใผใซใใฃใฆใกใขใชๅฒใๅฝใฆใ่ฟ ้ใซ่กใใใใซไฝฟ็จใใใใญใฃใใทใฅใงใใๅไฝใฏๆฌกใฎใจใใใงใ๏ผใใญใฐใฉใ ใใใฃใณใฏใ่งฃๆพใใใจใใใฎใใฃใณใฏใtcacheใใใกในใใใณใซๅฒใๅฝใฆใใใใใใใใใฃใณใฏใจ่ก็ชใใชใๅ ดๅใใใผใใใใผใธใฃใผใฏใใใซ็นๅฎใฎๅฐใใชใใณใๅคงใใชใใณใซๅ ฅใใพใใใไปฃใใใซใใพใ้ฃๆฅใใ็ฉบใใใฃใณใฏใจใใผใธใใใใจใใพใใใใใซใใใใใๅคงใใช็ฉบใใกใขใชใใญใใฏใไฝๆใใใพใใใใฎๅพใใใฎๆฐใใใใฃใณใฏใฏใๆชๆด็ใใณใใจๅผใฐใใไธ่ฌ็ใชใใณใซ้ ็ฝฎใใใพใใ
ใใญใฐใฉใ ใใกใขใชใ่ฆๆฑใใใจใใใผใใใใผใธใฃใผใฏๆชๆด็ใใณใใใงใใฏใใฆใๅๅใชใตใคใบใฎใใฃใณใฏใใใใใฉใใใ็ขบ่ชใใพใใ่ฆใคใใใฐใใใใซใใใไฝฟ็จใใพใใๆชๆด็ใใณใซ้ฉๅใชใใฃใณใฏใ่ฆใคใใใชใๅ ดๅใฏใใใฎใชในใๅ ใฎใในใฆใฎใใฃใณใฏใใตใคใบใซๅบใฅใใฆๅฏพๅฟใใใใณ๏ผๅฐใพใใฏๅคง๏ผใซ็งปๅใใพใใ
ๆณจๆใในใใฏใใใๅคงใใชใใฃใณใฏใ2ใคใฎๅๅใซๅๅฒใใใๆฎใใMINSIZEใใๅคงใใๅ ดๅใใใใฏๆชๆด็ใใณใซๆปใใใใจใใใใจใงใใ
ใใใใฃใฆใๆชๆด็ใใณใฏใๆ่ฟ่งฃๆพใใใใกใขใชใ่ฟ ้ใซๅๅฉ็จใใใใจใซใใฃใฆใกใขใชๅฒใๅฝใฆใๅ ้ใใๆ้ใฎใใใๆค็ดขใใใผใธใฎๅฟ ่ฆๆงใๆธใใๆนๆณใงใใ
Caution
ใใฃใณใฏใ็ฐใชใใซใใดใชใงใใฃใฆใใๅฉ็จๅฏ่ฝใชใใฃใณใฏใๅฅใฎๅฉ็จๅฏ่ฝใชใใฃใณใฏใจ่ก็ชใใฆใใๅ ดๅ๏ผใใจใๅ ใ ็ฐใชใใใณใซๅฑใใฆใใฆใ๏ผใใใใใฏใใผใธใใใใใจใซๆณจๆใใฆใใ ใใใ
ๆชๆด็ใใฃใณใฏใฎไพใ่ฟฝๅ
```c #includeint main(void) { char *chunks[9]; int i;
// Loop to allocate memory 8 times for (i = 0; i < 9; i++) { chunks[i] = malloc(0x100); if (chunks[i] == NULL) { // Check if malloc failed fprintf(stderr, โMemory allocation failed at iteration %d\nโ, i); return 1; } printf(โAddress of chunk %d: %p\nโ, i, (void *)chunks[i]); }
// Loop to free the allocated memory for (i = 0; i < 8; i++) { free(chunks[i]); }
return 0; }
9ใคใฎๅใใตใคใบใฎใใฃใณใฏใๅฒใๅฝใฆใฆ่งฃๆพใใๆนๆณใซๆณจๆใใฆใใ ใใใใใใซใใใ**tcacheใๆบใใใ**ใ8ใค็ฎใฏ**fastbinใซใฏๅคงใใใใ**ใใใๆชใฝใผใใฎใใณใซๆ ผ็ดใใใพใใใใใฆ9ใค็ฎใฏ่งฃๆพใใใฆใใชใใใใ9ใค็ฎใจ8ใค็ฎใฏ**ใใใใใฃใณใฏใจใใผใธใใใพใใ**ใ
ใใใใณใณใใคใซใใ`main`้ขๆฐใฎ`ret`ใชใใณใผใใซใใฌใผใฏใใคใณใใ่จญๅฎใใฆใใใใฐใใพใใๆฌกใซใ`gef`ใไฝฟ็จใใใจใtcacheใใณใๆบๆฏใงใใใ1ใคใฎใใฃใณใฏใๆชใฝใผใใฎใใณใซใใใใจใใใใใพใใ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=15, size=0x110, count=7] โ Chunk(addr=0xaaaaaaac1d10, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1c00, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1af0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac19e0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac18d0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac17c0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac12a0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Unsorted Bin for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] unsorted_bins[0]: fw=0xaaaaaaac1e10, bk=0xaaaaaaac1e10
โ Chunk(addr=0xaaaaaaac1e20, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in unsorted bin.
ในใขใผใซใใณ
ในใขใผใซใใณใฏใฉใผใธใใณใใใ้ใใงใใใใใกในใใใณใใใฏ้ ใใงใใ
62ใฎๅใใณใฏๅใใตใคใบใฎใใฃใณใฏใๆใกใพใ๏ผ16ใ24ใโฆ๏ผ32ใใใใงๆๅคง504ใใคใใ64ใใใใงๆๅคง1024ใใคใ๏ผใใใใฏใในใใผในใๅฒใๅฝใฆใในใใใณใ่ฆใคใใ้ๅบฆใใใใใใฎใชในใใธใฎใจใณใใชใฎๆฟๅ ฅใจๅ้คใๅฉใใพใใ
ในใขใผใซใใณใฎใตใคใบใฏใใณใฎใคใณใใใฏในใซๅฟใใฆๆฌกใฎใใใซ่จ็ฎใใใพใ๏ผ
- ๆๅฐใตใคใบ๏ผ2*4*index๏ผไพ๏ผใคใณใใใฏใน5 -> 40๏ผ
- ๆๅคงใตใคใบ๏ผ2*8*index๏ผไพ๏ผใคใณใใใฏใน5 -> 80๏ผ
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
#define NSMALLBINS 64
#define SMALLBIN_WIDTH MALLOC_ALIGNMENT
#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > CHUNK_HDR_SZ)
#define MIN_LARGE_SIZE ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH)
#define in_smallbin_range(sz) \
((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE)
#define smallbin_index(sz) \
((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\
+ SMALLBIN_CORRECTION)
ๅฐใใชใใณใจๅคงใใชใใณใ้ธๆใใใใใฎ้ขๆฐ:
#define bin_index(sz) \
((in_smallbin_range (sz)) ? smallbin_index (sz) : largebin_index (sz))
ๅฐใใชใใฃใณใฏใฎไพใ่ฟฝๅ
```c #includeint main(void) { char *chunks[10]; int i;
// Loop to allocate memory 8 times for (i = 0; i < 9; i++) { chunks[i] = malloc(0x100); if (chunks[i] == NULL) { // Check if malloc failed fprintf(stderr, โMemory allocation failed at iteration %d\nโ, i); return 1; } printf(โAddress of chunk %d: %p\nโ, i, (void *)chunks[i]); }
// Loop to free the allocated memory for (i = 0; i < 8; i++) { free(chunks[i]); }
chunks[9] = malloc(0x110);
return 0; }
9ใคใฎๅใใตใคใบใฎใใฃใณใฏใๅฒใๅฝใฆใฆ่งฃๆพใใๆนๆณใซๆณจๆใใฆใใ ใใใใใใซใใใ**tcacheใๆบใใใ**ใ8ใค็ฎใฏ**fastbinใซใฏๅคงใใใใ**ใใใๆชใฝใผใใฎใใณใซๆ ผ็ดใใใพใใใใใฆ9ใค็ฎใฏ่งฃๆพใใใฆใใชใใใใ9ใค็ฎใจ8ใค็ฎใฏ**ใใใใใฃใณใฏใจใใผใธใใใพใใ**ใๆฌกใซใ0x110ใฎใใๅคงใใชใใฃใณใฏใๅฒใๅฝใฆใใจใ**ๆชใฝใผใใฎใใณใฎใใฃใณใฏใๅฐใใชใใณใซ็งปๅใใพใ**ใ
ใใใใณใณใใคใซใใ`main`้ขๆฐใฎ`ret`ใชใใณใผใใซใใฌใผใฏใใคใณใใ่จญๅฎใใฆใใใใฐใใพใใๆฌกใซใ`gef`ใไฝฟ็จใใใจใtcacheใใณใๆบๆฏใงใ1ใคใฎใใฃใณใฏใๅฐใใชใใณใซใใใใจใใใใใพใใ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=15, size=0x110, count=7] โ Chunk(addr=0xaaaaaaac1d10, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1c00, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1af0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac19e0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac18d0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac17c0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac12a0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Unsorted Bin for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] Found 0 chunks in unsorted bin.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Small Bins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] small_bins[16]: fw=0xaaaaaaac1e10, bk=0xaaaaaaac1e10
โ Chunk(addr=0xaaaaaaac1e20, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in 1 small non-empty bins.
ๅคงใใชใใณ
ๅฐใใชใใณใๅบๅฎใตใคใบใฎใใฃใณใฏใ็ฎก็ใใใฎใซๅฏพใใๅๅคงใใชใใณใฏใใฃใณใฏใตใคใบใฎ็ฏๅฒใๆฑใใพใใใใใฏใใๆ่ปใงใใทในใใ ใใใพใใพใชใตใคใบใๅฅใ ใฎใใณใๅฟ ่ฆใจใใใซๅฏพๅฟใงใใใใใซใใพใใ
ใกใขใชใขใญใฑใผใฟใงใฏใๅคงใใชใใณใฏๅฐใใชใใณใ็ตใใใจใใใใๅงใพใใพใใๅคงใใชใใณใฎ็ฏๅฒใฏๅพใ ใซๅคงใใใชใใๆๅใฎใใณใฏ512ใใคใใใ576ใใคใใฎใใฃใณใฏใใซใใผใใๆฌกใฎใใณใฏ576ใใคใใใ640ใใคใใใซใใผใใพใใใใฎใใฟใผใณใฏ็ถใใๆใๅคงใใชใใณใฏ1MBใ่ถ ใใใในใฆใฎใใฃใณใฏใๅซใฟใพใใ
ๅคงใใชใใณใฏใๅฐใใชใใณใซๆฏในใฆๆไฝใ้ ใใชใใพใใใชใใชใใๆ้ฉใชใใฃใใใ่ฆใคใใใใใซใใพใใพใชใใฃใณใฏใตใคใบใฎใชในใใใฝใผใใใๆค็ดขใใชใใใฐใชใใชใใใใงใใใใฃใณใฏใๅคงใใชใใณใซๆฟๅ ฅใใใใจใใใใฏใฝใผใใใใชใใใฐใชใใใใกใขใชใๅฒใๅฝใฆใใใใจใใใทในใใ ใฏ้ฉๅใชใใฃใณใฏใ่ฆใคใใชใใใฐใชใใพใใใใใฎ่ฟฝๅ ใฎไฝๆฅญใซใใใ้ ใใชใใพใใใๅคงใใชๅฒใๅฝใฆใฏๅฐใใชใใฎใใใไธ่ฌ็ใงใฏใชใใใใ่จฑๅฎนใงใใใใฌใผใใชใใงใใ
ไปฅไธใใใใพใ๏ผ
- 64B็ฏๅฒใฎใใณใ32ๅ๏ผๅฐใใชใใณใจ่ก็ช๏ผ
- 512B็ฏๅฒใฎใใณใ16ๅ๏ผๅฐใใชใใณใจ่ก็ช๏ผ
- 4096B็ฏๅฒใฎใใณใ8ๅ๏ผ้จๅ็ใซๅฐใใชใใณใจ่ก็ช๏ผ
- 32768B็ฏๅฒใฎใใณใ4ๅ
- 262144B็ฏๅฒใฎใใณใ2ๅ
- ๆฎใใฎใตใคใบ็จใฎใใณใ1ๅ
ๅคงใใชใใณใตใคใบใฎใณใผใ
```c // From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711#define largebin_index_32(sz)
(((((unsigned long) (sz)) >> 6) <= 38) ? 56 + (((unsigned long) (sz)) >> 6) :
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :
126)
#define largebin_index_32_big(sz)
(((((unsigned long) (sz)) >> 6) <= 45) ? 49 + (((unsigned long) (sz)) >> 6) :
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :
126)
// XXX It remains to be seen whether it is good to keep the widths of
// XXX the buckets the same or whether it should be scaled by a factor
// XXX of two as well.
#define largebin_index_64(sz)
(((((unsigned long) (sz)) >> 6) <= 48) ? 48 + (((unsigned long) (sz)) >> 6) :
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :
126)
- #define largebin_index(sz)
(SIZE_SZ == 8 ? largebin_index_64 (sz) \ - MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz) \
- largebin_index_32 (sz))
</details>
<details>
<summary>ๅคงใใชใใฃใณใฏใฎไพใ่ฟฝๅ </summary>
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunks[2];
chunks[0] = malloc(0x1500);
chunks[1] = malloc(0x1500);
free(chunks[0]);
chunks[0] = malloc(0x2000);
return 0;
}
2ใคใฎๅคงใใชใขใญใฑใผใทใงใณใ่กใใใใใฎๅพ1ใคใ่งฃๆพใใ๏ผๆชใฝใผใใใณใซๅ ฅใ๏ผใใใๅคงใใชใขใญใฑใผใทใงใณใ่กใใใพใ๏ผๆชใฝใผใใใณใใๅคงใใชใใณใซ่งฃๆพใใใใใฎใ็งปๅใใพใ๏ผใ
ใใใใณใณใใคใซใใmain้ขๆฐใฎretใชใใณใผใใซใใฌใผใฏใใคใณใใ่จญๅฎใใฆใใใใฐใใพใใๆฌกใซใgefใไฝฟ็จใใใจใtcacheใใณใๆบๆฏใงใใใ1ใคใฎใใฃใณใฏใๅคงใใชใใณใซใใใใจใใใใใพใใ
gefโค heap bin
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
All tcachebins are empty
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Unsorted Bin for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] Found 0 chunks in unsorted bin.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Small Bins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] Found 0 chunks in 0 small non-empty bins.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Large Bins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] large_bins[100]: fw=0xaaaaaaac1290, bk=0xaaaaaaac1290
โ Chunk(addr=0xaaaaaaac12a0, size=0x1510, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in 1 large non-empty bins.
ใใใใใฃใณใฏ
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
/*
Top
The top-most available chunk (i.e., the one bordering the end of
available memory) is treated specially. It is never included in
any bin, is used only if no other chunk is available, and is
released back to the system if it is very large (see
M_TRIM_THRESHOLD). Because top initially
points to its own bin with initial zero size, thus forcing
extension on the first malloc request, we avoid having any special
code in malloc to check whether it even exists yet. But we still
need to do so when getting memory from system, so we make
initial_top treat the bin as a legal but unusable chunk during the
interval between initialization and the first call to
sysmalloc. (This is somewhat delicate, since it relies on
the 2 preceding words to be zero during this interval as well.)
*/
/* Conveniently, the unsorted bin can be used as dummy top on first call */
#define initial_top(M) (unsorted_chunks (M))
ๅบๆฌ็ใซใใใใฏ็พๅจๅฉ็จๅฏ่ฝใชใใผใใๅซใใใฃใณใฏใงใใmallocใๅฎ่กใใใใจใไฝฟ็จใใใใใฎๅฉ็จๅฏ่ฝใชใใชใผใใฃใณใฏใใชใๅ ดๅใใใฎใใใใใฃใณใฏใฏใตใคใบใๆธๅฐใใใฆๅฟ
่ฆใชในใใผในใ็ขบไฟใใพใใ
ใใใใใฃใณใฏใธใฎใใคใณใฟใฏmalloc_stateๆง้ ไฝใซๆ ผ็ดใใใฆใใพใใ
ใใใซใๆๅใฏใๆชใฝใผใใใฃใณใฏใใใใใใฃใณใฏใจใใฆไฝฟ็จใใใใจใๅฏ่ฝใงใใ
ใใใใใฃใณใฏใฎไพใ่ฆณๅฏใใ
```c #includeint main(void) { char *chunk; chunk = malloc(24); printf(โAddress of the chunk: %p\nโ, (void *)chunk); gets(chunk); return 0; }
`main`ใฎ`ret`ใชใใณใผใใซใใฌใผใฏใใคใณใใ่จญๅฎใใฆใณใณใใคใซใใใณใใใใฐใใๅพใmallocใใขใใฌใน`0xaaaaaaac12a0`ใ่ฟใใใใใใฎใใฃใณใฏใ่กจ็คบใใใพใใ:
```bash
gefโค heap chunks
Chunk(addr=0xaaaaaaac1010, size=0x290, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac1010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................]
Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac12a0 41 41 41 41 41 41 41 00 00 00 00 00 00 00 00 00 AAAAAAA.........]
Chunk(addr=0xaaaaaaac12c0, size=0x410, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac12c0 41 64 64 72 65 73 73 20 6f 66 20 74 68 65 20 63 Address of the c]
Chunk(addr=0xaaaaaaac16d0, size=0x410, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac16d0 41 41 41 41 41 41 41 0a 00 00 00 00 00 00 00 00 AAAAAAA.........]
Chunk(addr=0xaaaaaaac1ae0, size=0x20530, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ top chunk
ใใใใใฃใณใฏใใขใใฌใน 0xaaaaaaac1ae0 ใซใใใใจใ็ขบ่ชใงใใพใใใใใฏ้ฉใในใใใจใงใฏใชใใๆๅพใซๅฒใๅฝใฆใใใใใฃใณใฏใฏ 0xaaaaaaac12a0 ใซใใใใตใคใบใฏ 0x410 ใงใ0xaaaaaaac12a0 + 0x410 = 0xaaaaaaac1ae0 ใงใใ
ใพใใใใฃใณใฏใใใใผใซใใใใใใใฃใณใฏใฎ้ทใใ็ขบ่ชใงใใพใ:
gefโค x/8wx 0xaaaaaaac1ae0 - 16
0xaaaaaaac1ad0: 0x00000000 0x00000000 0x00020531 0x00000000
0xaaaaaaac1ae0: 0x00000000 0x00000000 0x00000000 0x00000000
ๆๅพใฎๆฎใ
mallocใไฝฟ็จใใใใใฃใณใฏใๅๅฒใใใใจ๏ผไพใใฐใๆชๆดๅใใณใพใใฏใใใใใฃใณใฏใใ๏ผใๅๅฒใใใใใฃใณใฏใฎๆฎใใใไฝๆใใใใใฃใณใฏใฏใๆๅพใฎๆฎใใใจๅผใฐใใใใฎใใคใณใฟใฏmalloc_stateๆง้ ไฝใซๆ ผ็ดใใใพใใ
ๅฒใๅฝใฆใใญใผ
ใใงใใฏใใฆใใ ใใ:
่งฃๆพใใญใผ
ใใงใใฏใใฆใใ ใใ:
ใใผใ้ขๆฐใฎใปใญใฅใชใใฃใใงใใฏ
ใใผใใงๅบใไฝฟ็จใใใ้ขๆฐใซใใฃใฆๅฎ่กใใใใปใญใฅใชใใฃใใงใใฏใ็ขบ่ชใใฆใใ ใใ:
Heap Functions Security Checks
ๅ่ๆ็ฎ
- https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/
- https://azeria-labs.com/heap-exploitation-part-2-glibc-heap-free-bins/
- https://heap-exploitation.dhavalkapil.com/diving_into_glibc_heap/core_functions
- https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/implementation/tcache/
Tip
AWSใใใญใณใฐใๅญฆใณใๅฎ่ทตใใ๏ผ
GCPใใใญใณใฐใๅญฆใณใๅฎ่ทตใใ๏ผHackTricksใใตใใผใใใ
- ใตใในใฏใชใใทใงใณใใฉใณใ็ขบ่ชใใฆใใ ใใ๏ผ
- **๐ฌ Discordใฐใซใผใใพใใฏใใฌใฐใฉใ ใฐใซใผใใซๅๅ ใใใใTwitter ๐ฆ @hacktricks_liveใใใฉใญใผใใฆใใ ใใใ
- HackTricksใใใณHackTricks CloudใฎGitHubใชใใธใใชใซPRใๆๅบใใฆใใใญใณใฐใใชใใฏใๅ ฑๆใใฆใใ ใใใ