An IDA Pro plugin to examine the heap, focused on exploit development.
Currently supports the glibc malloc implementation (ptmalloc2).
- IDA Pro >= 7.0
- glibc 2.23 <= 2.29 (x86, x64)
- Heap tracer (malloc/free/calloc/realloc)
- Detection of overlaps and double-frees
- Visualization using villoc
- Malloc chunk info
- Chunk editor
- Multi-arena info (chunks, top, last-remainder)
- Bins info (fastbins, unsortedbin, smallbins y largebins)
- Tcache info (glibc >= 2.26)
- GraphView for linked lists (bins/tcache)
- Structs view (malloc_state / malloc_par / tcache_perthread)
- Magic utils:
- Unlink merge info
- Freeable/merge info
- Fake fastbin finder
- House of force helper
- Useful libc offsets
- Calc chunk size (request2size)
- IO_FILE structs
Just drop the
heap_viewer.py file and the
heap_viewer folder into IDA's plugin directory.
To install just for the current user, copy the files into one of these directories:
Currently the plugin does not require to be configured, since it tries to obtain automatically the necessary offsets to analyze the heap.
However, in case the plugin fails, it is possible to set the different offsets in the configuration tab. To obtain these offsets, you can use any of the tools located in the
If you find any inconsistency, let me know :)
Arena & chunk info
Find fake fastbin
Unlink merge info
Useful libc offsets
I'd recommend the following resources alongside this tool for learning heap exploiting.
- Daniel García Gutiérrez - @danigargu
Special mention to my colleagues soez, wagiro and DiaLluvioso for give me some ideas during the development of the plugin. And of course, the @pwndbg project, from which I picked up some things about heap parsing.
Bugs / Feedback / PRs
Any comment, issue or pull request will be highly appreciated :-)