HackTricks
Bins & Memory Allocations
Tip
ๅญฆไน ๅๅฎ่ทต AWS ้ปๅฎขๆๆฏ๏ผ
HackTricks Training AWS Red Team Expert (ARTE)
ๅญฆไน ๅๅฎ่ทต GCP ้ปๅฎขๆๆฏ๏ผHackTricks Training GCP Red Team Expert (GRTE)
HackTricks Training Azure Red Team Expert (AzRTE)
ๆฏๆ HackTricks
- ๆฅ็ ่ฎข้ ่ฎกๅ!
- ๅ ๅ ฅ ๐ฌ Discord ็พค็ป ๆ Telegram ็พค็ป ๆ ๅจ Twitter ๐ฆ ไธๅ ณๆณจๆไปฌ @hacktricks_live.
- ้่ฟๅ HackTricks ๅ HackTricks Cloud GitHub ไปๅบๆไบค PR ๆฅๅไบซ้ปๅฎขๆๅทงใ
ๅบๆฌไฟกๆฏ
ไธบไบๆ้ซๅๅญๅจ็ๆ็๏ผๆฏไธชๅไธไป ๅจไธไธช้พ่กจไธญ๏ผ่ๆฏๆๅ ็ง็ฑปๅใ่ฟไบๆฏ bins๏ผๆ 5 ็ง็ฑปๅ็ bins๏ผ62 ๅฐ bins๏ผ63 ๅคง bins๏ผ1 ไธชๆชๆๅบ bin๏ผ10 ไธชๅฟซ้ bins ๅๆฏไธช็บฟ็จ 64 ไธช tcache binsใ
ๆฏไธชๆชๆๅบใๅฐๅๅๅคงๅ bins ็ๅๅงๅฐๅๅจๅไธไธชๆฐ็ปๅ ใ็ดขๅผ 0 ๆชไฝฟ็จ๏ผ1 ๆฏๆชๆๅบ bin๏ผbins 2-64 ๆฏๅฐ bins๏ผbins 65-127 ๆฏๅคง binsใ
Tcache๏ผๆฏ็บฟ็จ็ผๅญ๏ผBins
ๅฐฝ็ฎก็บฟ็จๅฐ่ฏๆฅๆ่ชๅทฑ็ๅ ๏ผๅ่ง Arenas ๅ Subheaps๏ผ๏ผไฝๆๅฏ่ฝไธไธชๆๅพๅค็บฟ็จ็่ฟ็จ๏ผๅฆ web ๆๅกๅจ๏ผไผไธๅ ถไป็บฟ็จๅ ฑไบซๅ ใๅจ่ฟ็งๆ ๅตไธ๏ผไธป่ฆ่งฃๅณๆนๆกๆฏไฝฟ็จ ้๏ผ่ฟๅฏ่ฝไผ ๆพ่ๅๆ ข็บฟ็จ็้ๅบฆใ
ๅ ๆญค๏ผtcache ็ฑปไผผไบๆฏไธช็บฟ็จ็ๅฟซ้ bin๏ผๅ ไธบๅฎๆฏไธไธช ๅ้พ่กจ๏ผไธๅๅนถๅใๆฏไธช็บฟ็จๆ 64 ไธชๅ้พ่กจ tcache binsใๆฏไธช bin ๆๅคๅฏไปฅๆ 7 ไธช็ธๅๅคงๅฐ็ๅ๏ผๅคงๅฐ่ๅดไธบ 24 ๅฐ 1032B ๅจ 64 ไฝ็ณป็ปไธๅ 12 ๅฐ 516B ๅจ 32 ไฝ็ณป็ปไธใ
ๅฝไธไธช็บฟ็จ้ๆพไธไธชๅๆถ๏ผๅฆๆๅฎไธๅคชๅคงไปฅ่ณไบๆ ๆณๅจ tcache ไธญๅ้ ๏ผๅนถไธ็ธๅบ็ tcache bin ๆฒกๆๆปก๏ผๅทฒ็ปๆ 7 ไธชๅ๏ผ๏ผๅฎๅฐ่ขซๅ้ ๅฐ้ฃ้ใๅฆๆๆ ๆณ่ฟๅ ฅ tcache๏ผๅฎๅฐ้่ฆ็ญๅพ ๅ ้ๆ่ฝๅจๅ จๅฑ่ๅดๅ ๆง่ก้ๆพๆไฝใ
ๅฝ ๅ้
ไธไธชๅๆถ๏ผๅฆๆๅจ Tcache ไธญๆไธไธชๆ้ๅคงๅฐ็็ฉบ้ฒๅ๏ผๅฎๅฐไฝฟ็จๅฎ๏ผๅฆๆๆฒกๆ๏ผๅฎๅฐ้่ฆ็ญๅพ
ๅ ้ๆ่ฝๅจๅ
จๅฑ bins ไธญๆพๅฐไธไธชๆๅๅปบไธไธชๆฐ็ใ
่ฟๆไธไธชไผๅ๏ผๅจ่ฟ็งๆ
ๅตไธ๏ผๅฝๆฅๆๅ ้ๆถ๏ผ็บฟ็จ ๅฐ็จ่ฏทๆฑๅคงๅฐ็ๅ ๅๅกซๅ
ไป็ Tcache๏ผ7 ไธช๏ผ๏ผไปฅไพฟๅจ้่ฆๆดๅคๆถ๏ผๅฏไปฅๅจ Tcache ไธญๆพๅฐๅฎไปฌใ
ๆทปๅ ไธไธช tcache ๅ็คบไพ
```c #includeint main(void) { char *chunk; chunk = malloc(24); printf(โAddress of the chunk: %p\nโ, (void *)chunk); gets(chunk); free(chunk); return 0; }
ๅฐๅ
ถ็ผ่ฏๅนถๅจไธปๅฝๆฐ็ ret ๆไฝ็ ๅค่ฎพ็ฝฎๆญ็น่ฟ่ก่ฐ่ฏใ็ถๅไฝฟ็จ gef๏ผๆจๅฏไปฅ็ๅฐๆญฃๅจไฝฟ็จ็ tcache bin๏ผ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=0, size=0x20, count=1] โ Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
Tcache ็ปๆๅๅฝๆฐ
ๅจไปฅไธไปฃ็ ไธญ๏ผๅฏไปฅ็ๅฐ max bins ๅ chunks per index๏ผไธบไบ้ฟๅ
ๅ้้ๆพ่ๅๅปบ็ tcache_entry ็ปๆ๏ผไปฅๅๆฏไธช็บฟ็จ็จๆฅๅญๅจๆฏไธช bin ็ดขๅผๅฐๅ็ tcache_perthread_struct ็ปๆใ
tcache_entry ๅ tcache_perthread_struct
```c
// From https://github.com/bminor/glibc/blob/f942a732d37a96217ef828116ebe64a644db18d7/malloc/malloc.c
/* We want 64 entries. This is an arbitrary limit, which tunables can reduce. */
define TCACHE_MAX_BINS 64
define MAX_TCACHE_SIZE tidx2usize (TCACHE_MAX_BINS-1)
/* Only used to pre-fill the tunables. */
define tidx2usize(idx) (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ)
/* When โxโ is from chunksize(). */
define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
/* When โxโ is a user-provided size. */
define usize2tidx(x) csize2tidx (request2size (x))
/* With rounding and alignment, the bins areโฆ idx 0 bytes 0..24 (64-bit) or 0..12 (32-bit) idx 1 bytes 25..40 or 13..20 idx 2 bytes 41..56 or 21..28 etc. */
/* This is another arbitrary limit, which tunables can change. Each tcache bin will hold at most this number of chunks. */
define TCACHE_FILL_COUNT 7
/* Maximum chunks in tcache bins for tunables. This value must fit the range of tcache->counts[] entries, else they may overflow. */
define MAX_TCACHE_COUNT UINT16_MAX
[โฆ]
typedef struct tcache_entry { struct tcache_entry next; / This field exists to detect double frees. */ uintptr_t key; } tcache_entry;
/* There is one of these for each thread, which contains the per-thread cache (hence โtcache_perthread_structโ). Keeping overall size low is mildly important. Note that COUNTS and ENTRIES are redundant (we could have just counted the linked list each time), this is for performance reasons. */ typedef struct tcache_perthread_struct { uint16_t counts[TCACHE_MAX_BINS]; tcache_entry *entries[TCACHE_MAX_BINS]; } tcache_perthread_struct;
</details>
ๅฝๆฐ `__tcache_init` ๆฏๅๅปบๅๅ้
`tcache_perthread_struct` ๅฏน่ฑก็ฉบ้ด็ๅฝๆฐใ
<details>
<summary>tcache_init ไปฃ็ </summary>
```c
// From https://github.com/bminor/glibc/blob/f942a732d37a96217ef828116ebe64a644db18d7/malloc/malloc.c#L3241C1-L3274C2
static void
tcache_init(void)
{
mstate ar_ptr;
void *victim = 0;
const size_t bytes = sizeof (tcache_perthread_struct);
if (tcache_shutting_down)
return;
arena_get (ar_ptr, bytes);
victim = _int_malloc (ar_ptr, bytes);
if (!victim && ar_ptr != NULL)
{
ar_ptr = arena_get_retry (ar_ptr, bytes);
victim = _int_malloc (ar_ptr, bytes);
}
if (ar_ptr != NULL)
__libc_lock_unlock (ar_ptr->mutex);
/* In a low memory situation, we may not be able to allocate memory
- in which case, we just keep trying later. However, we
typically do this very early, so either there is sufficient
memory, or there isn't enough memory to do non-trivial
allocations anyway. */
if (victim)
{
tcache = (tcache_perthread_struct *) victim;
memset (tcache, 0, sizeof (tcache_perthread_struct));
}
}
Tcache ็ดขๅผ
Tcache ๆๅ ไธช bins๏ผๅ ทไฝๅๅณไบๅคงๅฐๅๆๅ ๆฏไธช็ดขๅผ็ฌฌไธไธชๅ็ๅๅงๆ้ไปฅๅๆฏไธช็ดขๅผ็ๅๆฐ้ไฝไบไธไธชๅๅ ้จใ่ฟๆๅณ็้่ฟๅฎไฝๅ ๅซ่ฟไบไฟกๆฏ็ๅ๏ผ้ๅธธๆฏ็ฌฌไธไธช๏ผ๏ผๅฏไปฅๆพๅฐๆๆ tcache ๅๅง็นๅ Tcache ๅ็ๆฐ้ใ
ๅฟซ้ bins
ๅฟซ้ bins ๆจๅจ ๅ ้ๅฐๅ็ๅ ๅญๅ้ ๏ผ้่ฟๅฐๆ่ฟ้ๆพ็ๅไฟๅญๅจๅฟซ้่ฎฟ้ฎ็ปๆไธญใ่ฟไบ bins ไฝฟ็จๅ่ฟๅ ๅบ๏ผLIFO๏ผๆนๆณ๏ผ่ฟๆๅณ็ ๆ่ฟ้ๆพ็ๅๆฏ็ฌฌไธไธช ๅจๆๆฐ็ๅ้ ่ฏทๆฑๆถ่ขซ้็จใ่ฟ็ง่กไธบๅจ้ๅบฆไธๆฏๆๅฉ็๏ผๅ ไธบไปๆ ้กถ๏ผLIFO๏ผๆๅ ฅๅ็งป้คๆฏไป้ๅ๏ผFIFO๏ผๆดๅฟซใ
ๆญคๅค๏ผๅฟซ้ bins ไฝฟ็จๅ้พ่กจ๏ผ่ไธๆฏๅ้พ่กจ๏ผ่ฟ่ฟไธๆญฅๆ้ซไบ้ๅบฆใ็ฑไบๅฟซ้ bins ไธญ็ๅไธไผไธ้ปๅฑ ๅๅนถ๏ผๅ ๆญคไธ้่ฆๅคๆ็็ปๆๆฅๅ ่ฎธไปไธญ้ด็งป้คใๅ้พ่กจๅจ่ฟไบๆไฝไธญๆด็ฎๅใๆดๅฟซใ
ๅบๆฌไธ๏ผ่ฟ้ๅ็็ไบๆ ๆฏ๏ผๅคด้จ๏ผๆๅ็ฌฌไธไธชๅ็ๆ้๏ผๅง็ปๆๅ่ฏฅๅคงๅฐ็ๆๆฐ้ๆพๅใๅ ๆญค๏ผ
- ๅฝๅ้ ไธไธช่ฏฅๅคงๅฐ็ๆฐๅๆถ๏ผๅคด้จๆๅไธไธชๅฏ็จ็็ฉบ้ฒๅใ็ฑไบ่ฟไธช็ฉบ้ฒๅๆๅไธไธไธชๅฏ็จๅ๏ผ่ฟไธชๅฐๅ่ขซๅญๅจๅจๅคด้จ๏ผไปฅไพฟไธไธไธชๅ้ ็ฅ้ๅจๅช้่ทๅๅฏ็จๅ
- ๅฝไธไธชๅ่ขซ้ๆพๆถ๏ผ็ฉบ้ฒๅๅฐไฟๅญๅฝๅๅฏ็จๅ็ๅฐๅ๏ผ่่ฟไธชๆฐ้ๆพๅ็ๅฐๅๅฐๆพๅ ฅๅคด้จ
้พ่กจ็ๆๅคงๅคงๅฐไธบ 0x80๏ผๅฎไปฌ็็ป็ปๆนๅผๆฏ๏ผๅคงๅฐไธบ 0x20 ็ๅๅฐไฝไบ็ดขๅผ 0๏ผๅคงๅฐไธบ 0x30 ็ๅๅฐไฝไบ็ดขๅผ 1โฆ
Caution
ๅฟซ้ bins ไธญ็ๅๆช่ฎพ็ฝฎไธบๅฏ็จ๏ผๅ ๆญคๅฎไปฌไผๅจไธๆฎตๆถ้ดๅ ไฟๆไธบๅฟซ้ bin ๅ๏ผ่ไธๆฏ่ฝๅคไธๅจๅด็ๅ ถไป็ฉบ้ฒๅๅๅนถใ
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
/*
Fastbins
An array of lists holding recently freed small chunks. Fastbins
are not doubly linked. It is faster to single-link them, and
since chunks are never removed from the middles of these lists,
double linking is not necessary. Also, unlike regular bins, they
are not even processed in FIFO order (they use faster LIFO) since
ordering doesn't much matter in the transient contexts in which
fastbins are normally used.
Chunks in fastbins keep their inuse bit set, so they cannot
be consolidated with other free chunks. malloc_consolidate
releases all chunks in fastbins and consolidates them with
other free chunks.
*/
typedef struct malloc_chunk *mfastbinptr;
#define fastbin(ar_ptr, idx) ((ar_ptr)->fastbinsY[idx])
/* offset 2 to use otherwise unindexable first 2 bins */
#define fastbin_index(sz) \
((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)
/* The maximum fastbin request size we support */
#define MAX_FAST_SIZE (80 * SIZE_SZ / 4)
#define NFASTBINS (fastbin_index (request2size (MAX_FAST_SIZE)) + 1)
ๆทปๅ ไธไธช fastbin ๅ็คบไพ
```c #includeint main(void) { char *chunks[8]; int i;
// Loop to allocate memory 8 times for (i = 0; i < 8; i++) { chunks[i] = malloc(24); if (chunks[i] == NULL) { // Check if malloc failed fprintf(stderr, โMemory allocation failed at iteration %d\nโ, i); return 1; } printf(โAddress of chunk %d: %p\nโ, i, (void *)chunks[i]); }
// Loop to free the allocated memory for (i = 0; i < 8; i++) { free(chunks[i]); }
return 0; }
ๆณจๆๆไปฌๅฆไฝๅ้
ๅ้ๆพ8ไธช็ธๅๅคงๅฐ็ๅ๏ผไปฅไพฟๅฎไปฌๅกซๆปกtcache๏ผ็ฌฌๅ
ซไธชๅๅญๅจๅจๅฟซ้ๅไธญใ
็ผ่ฏๅฎๅนถๅจ`main`ๅฝๆฐ็`ret`ๆไฝ็ ๅค่ฎพ็ฝฎๆญ็น่ฟ่ก่ฐ่ฏใ็ถๅไฝฟ็จ`gef`๏ผไฝ ๅฏไปฅ็ๅฐtcache binๅทฒๆปก๏ผไธไธชๅๅจๅฟซ้binไธญ๏ผ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=0, size=0x20, count=7] โ Chunk(addr=0xaaaaaaac1770, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1750, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1730, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1710, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac16f0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac16d0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] โ Chunk(addr=0xaaaaaaac1790, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
Fastbins[idx=1, size=0x30] 0x00
ๆชๆๅบ็ๅ
ๆชๆๅบ็ๅ ๆฏไธไธช็ผๅญ๏ผ็ฑๅ ็ฎก็ๅจ็จไบๅ ๅฟซๅ ๅญๅ้ ใๅฎ็ๅทฅไฝๅ็ๅฆไธ๏ผๅฝ็จๅบ้ๆพไธไธชๅๆถ๏ผๅฆๆ่ฟไธชๅไธ่ฝๅจtcacheๆๅฟซ้ๅ ไธญๅ้ ๏ผๅนถไธๆฒกๆไธ้กถ้จๅๅ็ๅฒ็ช๏ผๅ ็ฎก็ๅจไธไผ็ซๅณๅฐๅ ถๆพๅ ฅ็นๅฎ็ๅฐๆๅคงๅ ไธญใ็ธๅ๏ผๅฎ้ฆๅ ๅฐ่ฏไธไปปไฝ็ธ้ป็็ฉบ้ฒๅๅๅนถ๏ผไปฅๅๅปบไธไธชๆดๅคง็็ฉบ้ฒๅ ๅญๅใ็ถๅ๏ผๅฎๅฐ่ฟไธชๆฐๅๆพๅ ฅไธไธช็งฐไธบโๆชๆๅบๅ โ็้็จๅ ไธญใ
ๅฝ็จๅบ่ฏทๆฑๅ ๅญๆถ๏ผๅ ็ฎก็ๅจๆฃๆฅๆชๆๅบๅ ไปฅๆฅ็ๆฏๅฆๆ่ถณๅคๅคงๅฐ็ๅใๅฆๆๆพๅฐไธไธช๏ผๅฎไผ็ซๅณไฝฟ็จใๅฆๆๅจๆชๆๅบๅ ไธญๆพไธๅฐๅ้็ๅ๏ผๅฎไผๅฐๆญคๅ่กจไธญ็ๆๆๅ็งปๅจๅฐๅ ถๅฏนๅบ็ๅ ไธญ๏ผไพๆฎๅฎไปฌ็ๅคงๅฐๅไธบๅฐๅ ๆๅคงๅ ใ
่ฏทๆณจๆ๏ผๅฆๆไธไธช่พๅคง็ๅ่ขซๅๆไธคๅ๏ผๅนถไธๅ ถไฝ้จๅๅคงไบMINSIZE๏ผๅฎๅฐ่ขซๆพๅๆชๆๅบๅ ไธญใ
ๅ ๆญค๏ผๆชๆๅบๅ ๆฏไธ็ง้่ฟๅฟซ้้็จๆ่ฟ้ๆพ็ๅ ๅญๆฅๅ ้ๅ ๅญๅ้ ็ๆนๆณ๏ผไป่ๅๅฐ่ๆถ็ๆ็ดขๅๅๅนถ็้่ฆใ
Caution
่ฏทๆณจๆ๏ผๅณไฝฟๅๅฑไบไธๅ็ฑปๅซ๏ผๅฆๆไธไธชๅฏ็จๅไธๅฆไธไธชๅฏ็จๅๅ็ๅฒ็ช๏ผๅณไฝฟๅฎไปฌๆๅๅฑไบไธๅ็ๅ ๏ผ๏ผๅฎไปฌไนไผ่ขซๅๅนถใ
ๆทปๅ ไธไธชๆชๆๅบๅ็คบไพ
```c #includeint main(void) { char *chunks[9]; int i;
// Loop to allocate memory 8 times for (i = 0; i < 9; i++) { chunks[i] = malloc(0x100); if (chunks[i] == NULL) { // Check if malloc failed fprintf(stderr, โMemory allocation failed at iteration %d\nโ, i); return 1; } printf(โAddress of chunk %d: %p\nโ, i, (void *)chunks[i]); }
// Loop to free the allocated memory for (i = 0; i < 8; i++) { free(chunks[i]); }
return 0; }
ๆณจๆๆไปฌๅฆไฝๅ้
ๅ้ๆพ9ไธช็ธๅๅคงๅฐ็ๅ๏ผไปฅไพฟๅฎไปฌ**ๅกซๅ
tcache**๏ผ็ฌฌๅ
ซไธชๅๅญๅจๅจๆชๆๅบ็binไธญ๏ผๅ ไธบๅฎ**ๅฏนไบfastbinๆฅ่ฏดๅคชๅคง**๏ผ่็ฌฌไนไธชๅๆฒกๆ่ขซ้ๆพ๏ผๅ ๆญค็ฌฌไนไธชๅ็ฌฌๅ
ซไธช**ไธไผไธ้กถ้จๅๅๅนถ**ใ
็ผ่ฏๅนถๅจ`main`ๅฝๆฐ็`ret`ๆไฝ็ ๅค่ฎพ็ฝฎๆญ็น่ฟ่ก่ฐ่ฏใ็ถๅไฝฟ็จ`gef`๏ผไฝ ๅฏไปฅ็ๅฐtcache binๅทฒๆปก๏ผไธไธชๅๅจๆชๆๅบ็binไธญ๏ผ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=15, size=0x110, count=7] โ Chunk(addr=0xaaaaaaac1d10, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1c00, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1af0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac19e0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac18d0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac17c0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac12a0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Unsorted Bin for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] unsorted_bins[0]: fw=0xaaaaaaac1e10, bk=0xaaaaaaac1e10
โ Chunk(addr=0xaaaaaaac1e20, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in unsorted bin.
ๅฐๅๆกถ
ๅฐๅๆกถๆฏๅคงๅๆกถๅฟซ๏ผไฝๆฏๅฟซ้ๆกถๆ ขใ
62ไธชๆกถไธญ็ๆฏไธชๆกถๅฐๅ ทๆ็ธๅๅคงๅฐ็ๅ๏ผ16ใ24๏ผโฆ(ๅจ32ไฝไธญๆๅคงไธบ504ๅญ่๏ผๅจ64ไฝไธญๆๅคงไธบ1024ๅญ่)ใ่ฟๆๅฉไบๅ ๅฟซๆฅๆพๅบๅ้ ็ฉบ้ด็ๆกถไปฅๅๅจ่ฟไบๅ่กจไธญๆๅ ฅๅๅ ้คๆก็ฎ็้ๅบฆใ
ๅฐๅๆกถ็ๅคงๅฐๆฏๆ นๆฎๆกถ็็ดขๅผ่ฎก็ฎ็๏ผ
- ๆๅฐๅคงๅฐ๏ผ2*4*index๏ผไพๅฆ๏ผ็ดขๅผ5 -> 40๏ผ
- ๆๅคงๅคงๅฐ๏ผ2*8*index๏ผไพๅฆ๏ผ็ดขๅผ5 -> 80๏ผ
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
#define NSMALLBINS 64
#define SMALLBIN_WIDTH MALLOC_ALIGNMENT
#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > CHUNK_HDR_SZ)
#define MIN_LARGE_SIZE ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH)
#define in_smallbin_range(sz) \
((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE)
#define smallbin_index(sz) \
((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\
+ SMALLBIN_CORRECTION)
้ๆฉๅฐๅๅๅคงๅๅ ๅญๆฑ ็ๅฝๆฐ๏ผ
#define bin_index(sz) \
((in_smallbin_range (sz)) ? smallbin_index (sz) : largebin_index (sz))
ๆทปๅ ไธไธชๅฐๅ็คบไพ
```c #includeint main(void) { char *chunks[10]; int i;
// Loop to allocate memory 8 times for (i = 0; i < 9; i++) { chunks[i] = malloc(0x100); if (chunks[i] == NULL) { // Check if malloc failed fprintf(stderr, โMemory allocation failed at iteration %d\nโ, i); return 1; } printf(โAddress of chunk %d: %p\nโ, i, (void *)chunks[i]); }
// Loop to free the allocated memory for (i = 0; i < 8; i++) { free(chunks[i]); }
chunks[9] = malloc(0x110);
return 0; }
ๆณจๆๆไปฌๅฆไฝๅ้
ๅ้ๆพ9ไธช็ธๅๅคงๅฐ็ๅ๏ผไปฅไพฟๅฎไปฌ**ๅกซๆปกtcache**๏ผ่็ฌฌๅ
ซไธชๅๅญๅจๅจๆชๆๅบ็binไธญ๏ผๅ ไธบๅฎ**ๅฏนไบfastbinๆฅ่ฏดๅคชๅคง**๏ผ่็ฌฌไนไธชๅๆฒกๆ่ขซ้ๆพ๏ผๅ ๆญค็ฌฌไนไธชๅ็ฌฌๅ
ซไธชๅ**ไธไผไธ้กถ้จๅๅๅนถ**ใ็ถๅๆไปฌๅ้
ไธไธชๆดๅคง็ๅ0x110๏ผ่ฟไฝฟๅพ**ๆชๆๅบbinไธญ็ๅ่ฟๅ
ฅๅฐbin**ใ
็ผ่ฏๅนถๅจ`main`ๅฝๆฐ็`ret`ๆไฝ็ ๅค่ฎพ็ฝฎๆญ็น่ฟ่ก่ฐ่ฏใ็ถๅไฝฟ็จ`gef`๏ผไฝ ๅฏไปฅ็ๅฐtcache binๅทฒๆปก๏ผไธไธไธชๅๅจๅฐbinไธญ๏ผ
```bash
gefโค heap bins
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Tcachebins[idx=15, size=0x110, count=7] โ Chunk(addr=0xaaaaaaac1d10, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1c00, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac1af0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac19e0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac18d0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac17c0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ Chunk(addr=0xaaaaaaac12a0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Unsorted Bin for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] Found 0 chunks in unsorted bin.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Small Bins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] small_bins[16]: fw=0xaaaaaaac1e10, bk=0xaaaaaaac1e10
โ Chunk(addr=0xaaaaaaac1e20, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in 1 small non-empty bins.
ๅคงๅๅ ๅญๅ
ไธ็ฎก็ๅบๅฎๅคงๅฐๅ็ๅฐๅๅ ๅญๅไธๅ๏ผๆฏไธชๅคงๅๅ ๅญๅๅค็ไธ็ณปๅๅๅคงๅฐใ่ฟๆด็ตๆดป๏ผๅ ่ฎธ็ณป็ปๅฎน็บณๅ็งๅคงๅฐ๏ผ่ๆ ้ไธบๆฏ็งๅคงๅฐๅ็ฌ่ฎพ็ฝฎไธไธชๅ ๅญๅใ
ๅจๅ ๅญๅ้ ๅจไธญ๏ผๅคงๅๅ ๅญๅไปๅฐๅๅ ๅญๅ็ปๆ็ๅฐๆนๅผๅงใๅคงๅๅ ๅญๅ็่ๅด้ๆธๅขๅคง๏ผ่ฟๆๅณ็็ฌฌไธไธชๅ ๅญๅๅฏ่ฝ่ฆ็ไป512ๅฐ576ๅญ่็ๅ๏ผ่ไธไธไธชๅ่ฆ็576ๅฐ640ๅญ่ใ่ฟไธชๆจกๅผๆ็ปญไธๅป๏ผๆๅคง็ๅ ๅญๅๅ ๅซๆๆ่ถ ่ฟ1MB็ๅใ
ไธๅฐๅๅ ๅญๅ็ธๆฏ๏ผๅคงๅๅ ๅญๅ็ๆไฝ้ๅบฆ่พๆ ข๏ผๅ ไธบๅฎไปฌๅฟ ้กปๅฏนไธๅๅๅคงๅฐ็ๅ่กจ่ฟ่กๆๅบๅๆ็ดข๏ผไปฅๆพๅฐๆไฝณ้้ ่ฟ่กๅ้ ใๅฝไธไธชๅ่ขซๆๅ ฅๅฐๅคงๅๅ ๅญๅๆถ๏ผๅฎๅฟ ้กป่ขซๆๅบ๏ผ่ๅฝๅ ๅญ่ขซๅ้ ๆถ๏ผ็ณป็ปๅฟ ้กปๆพๅฐๅ้็ๅใ่ฟ้ขๅค็ๅทฅไฝไฝฟๅฎไปฌ้ๅบฆ่พๆ ข๏ผไฝ็ฑไบๅคงๅๅ้ ๆฏๅฐๅๅ้ ๅฐ๏ผๅ ๆญค่ฟๆฏไธไธชๅฏไปฅๆฅๅ็ๆ่กกใ
ๆ๏ผ
- 32ไธช64B่ๅด็ๅ ๅญๅ๏ผไธๅฐๅๅ ๅญๅๅฒ็ช๏ผ
- 16ไธช512B่ๅด็ๅ ๅญๅ๏ผไธๅฐๅๅ ๅญๅๅฒ็ช๏ผ
- 8ไธช4096B่ๅด็ๅ ๅญๅ๏ผ้จๅไธๅฐๅๅ ๅญๅๅฒ็ช๏ผ
- 4ไธช32768B่ๅด็ๅ ๅญๅ
- 2ไธช262144B่ๅด็ๅ ๅญๅ
- 1ไธช็จไบๅฉไฝๅคงๅฐ็ๅ ๅญๅ
ๅคงๅๅ ๅญๅๅคงๅฐไปฃ็
```c // From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711#define largebin_index_32(sz)
(((((unsigned long) (sz)) >> 6) <= 38) ? 56 + (((unsigned long) (sz)) >> 6) :
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :
126)
#define largebin_index_32_big(sz)
(((((unsigned long) (sz)) >> 6) <= 45) ? 49 + (((unsigned long) (sz)) >> 6) :
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :
126)
// XXX It remains to be seen whether it is good to keep the widths of
// XXX the buckets the same or whether it should be scaled by a factor
// XXX of two as well.
#define largebin_index_64(sz)
(((((unsigned long) (sz)) >> 6) <= 48) ? 48 + (((unsigned long) (sz)) >> 6) :
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :
126)
- #define largebin_index(sz)
(SIZE_SZ == 8 ? largebin_index_64 (sz) \ - MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz) \
- largebin_index_32 (sz))
</details>
<details>
<summary>ๆทปๅ ไธไธชๅคงๅ็คบไพ</summary>
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunks[2];
chunks[0] = malloc(0x1500);
chunks[1] = malloc(0x1500);
free(chunks[0]);
chunks[0] = malloc(0x2000);
return 0;
}
2 ไธชๅคงๅ้ ่ขซๆง่ก๏ผ็ถๅไธไธช่ขซ้ๆพ๏ผๅฐๅ ถๆพๅ ฅๆชๆๅบ็ๆกถไธญ๏ผ๏ผๅนถไธ่ฟ่กๆดๅคง็ๅ้ ๏ผๅฐ้ๆพ็ไปๆชๆๅบ็ๆกถ็งปๅจๅฐๅคงๆกถไธญ๏ผใ
็ผ่ฏๅนถๅจ main ๅฝๆฐ็ ret ๆไฝ็ ๅค่ฎพ็ฝฎๆญ็น่ฟ่ก่ฐ่ฏใ็ถๅไฝฟ็จ gef๏ผไฝ ๅฏไปฅ็ๅฐ tcache ๆกถๅทฒๆปก๏ผๅนถไธไธไธชๅๅจๅคงๆกถไธญ๏ผ
gefโค heap bin
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Tcachebins for thread 1 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
All tcachebins are empty
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Fastbins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Unsorted Bin for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] Found 0 chunks in unsorted bin.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Small Bins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] Found 0 chunks in 0 small non-empty bins.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ Large Bins for arena at 0xfffff7f90b00 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[+] large_bins[100]: fw=0xaaaaaaac1290, bk=0xaaaaaaac1290
โ Chunk(addr=0xaaaaaaac12a0, size=0x1510, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in 1 large non-empty bins.
้กถ้จๅ
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
/*
Top
The top-most available chunk (i.e., the one bordering the end of
available memory) is treated specially. It is never included in
any bin, is used only if no other chunk is available, and is
released back to the system if it is very large (see
M_TRIM_THRESHOLD). Because top initially
points to its own bin with initial zero size, thus forcing
extension on the first malloc request, we avoid having any special
code in malloc to check whether it even exists yet. But we still
need to do so when getting memory from system, so we make
initial_top treat the bin as a legal but unusable chunk during the
interval between initialization and the first call to
sysmalloc. (This is somewhat delicate, since it relies on
the 2 preceding words to be zero during this interval as well.)
*/
/* Conveniently, the unsorted bin can be used as dummy top on first call */
#define initial_top(M) (unsorted_chunks (M))
ๅบๆฌไธ๏ผ่ฟๆฏไธไธชๅ
ๅซๆๆๅฝๅๅฏ็จๅ ็ๅใๅฝๆง่ก malloc ๆถ๏ผๅฆๆๆฒกๆๅฏ็จ็็ฉบ้ฒๅๅฏ็จ๏ผ่ฟไธช้กถๅๅฐไผๅๅฐๅ
ถๅคงๅฐไปฅๆไพๅฟ
่ฆ็็ฉบ้ดใ
ๆๅ้กถๅ็ๆ้ๅญๅจๅจ malloc_state ็ปๆไธญใ
ๆญคๅค๏ผๅจๅผๅงๆถ๏ผๅฏไปฅๅฐๆชๆๅบๅ็จไฝ้กถๅใ
่งๅฏ้กถๅ็คบไพ
```c #includeint main(void) { char *chunk; chunk = malloc(24); printf(โAddress of the chunk: %p\nโ, (void *)chunk); gets(chunk); return 0; }
ๅจ็ผ่ฏๅนถๅจ `main` ็ `ret` ๆไฝ็ ๅค่ฐ่ฏๆถ๏ผๆ็ๅฐ malloc ่ฟๅไบๅฐๅ `0xaaaaaaac12a0`๏ผ่ฟไบๆฏๅ๏ผ
```bash
gefโค heap chunks
Chunk(addr=0xaaaaaaac1010, size=0x290, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac1010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................]
Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac12a0 41 41 41 41 41 41 41 00 00 00 00 00 00 00 00 00 AAAAAAA.........]
Chunk(addr=0xaaaaaaac12c0, size=0x410, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac12c0 41 64 64 72 65 73 73 20 6f 66 20 74 68 65 20 63 Address of the c]
Chunk(addr=0xaaaaaaac16d0, size=0x410, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac16d0 41 41 41 41 41 41 41 0a 00 00 00 00 00 00 00 00 AAAAAAA.........]
Chunk(addr=0xaaaaaaac1ae0, size=0x20530, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) โ top chunk
ๅฏไปฅ็ๅฐ้กถ้จๅไฝไบๅฐๅ 0xaaaaaaac1ae0ใ่ฟๅนถไธๅฅๆช๏ผๅ ไธบๆๅๅ้
็ๅๅจ 0xaaaaaaac12a0๏ผๅคงๅฐไธบ 0x410๏ผๅนถไธ 0xaaaaaaac12a0 + 0x410 = 0xaaaaaaac1ae0ใ
่ฟๅฏไปฅๅจๅ
ถๅๅคดไธญ็ๅฐ้กถ้จๅ็้ฟๅบฆ๏ผ
gefโค x/8wx 0xaaaaaaac1ae0 - 16
0xaaaaaaac1ad0: 0x00000000 0x00000000 0x00020531 0x00000000
0xaaaaaaac1ae0: 0x00000000 0x00000000 0x00000000 0x00000000
ๆๅๅฉไฝ
ๅฝไฝฟ็จ malloc ๅนถไธไธไธชๅ่ขซๅๅฒ๏ผไพๅฆ๏ผไปๆชๆๅบ็ๆกถๆไป้กถ้จๅ๏ผ๏ผไปๅๅฒๅ็ๅ
ถไฝ้จๅๅๅปบ็ๅ็งฐไธบๆๅๅฉไฝ๏ผๅ
ถๆ้ๅญๅจๅจ malloc_state ็ปๆไธญใ
ๅ้ ๆต็จ
ๆฅ็๏ผ
้ๆพๆต็จ
ๆฅ็๏ผ
ๅ ๅฝๆฐๅฎๅ จๆฃๆฅ
ๆฃๆฅๅ ไธญๅธธ็จๅฝๆฐๆง่ก็ๅฎๅ จๆฃๆฅ๏ผ
Heap Functions Security Checks
ๅ่ๆ็ฎ
- https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/
- https://azeria-labs.com/heap-exploitation-part-2-glibc-heap-free-bins/
- https://heap-exploitation.dhavalkapil.com/diving_into_glibc_heap/core_functions
- https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/implementation/tcache/
Tip
ๅญฆไน ๅๅฎ่ทต AWS ้ปๅฎขๆๆฏ๏ผ
ๅญฆไน ๅๅฎ่ทต GCP ้ปๅฎขๆๆฏ๏ผๆฏๆ HackTricks
- ๆฅ็ ่ฎข้ ่ฎกๅ!
- ๅ ๅ ฅ ๐ฌ Discord ็พค็ป ๆ Telegram ็พค็ป ๆ ๅจ Twitter ๐ฆ ไธๅ ณๆณจๆไปฌ @hacktricks_live.
- ้่ฟๅ HackTricks ๅ HackTricks Cloud GitHub ไปๅบๆไบค PR ๆฅๅไบซ้ปๅฎขๆๅทงใ