An IDA Pro plugin to examine the glibc heap, focused on exploit development
Switch branches/tags
Nothing to show
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
heap_viewer small fix Oct 4, 2018
utils some fixes Sep 13, 2018
LICENSE Create LICENSE May 8, 2018
README.md Update README.md Oct 15, 2018
heap_viewer.py Fix - action_handler_t doesn't work with super in old versions of IDA Nov 28, 2018

README.md

HeapViewer

An IDA Pro plugin to examine the heap, focused on exploit development.

Currently supports the glibc malloc implementation (ptmalloc2).

3rd place winner of the 2018 Hex-Rays Plugin Contest

Requirements

  • IDA Pro >= 6.9

Tested on

  • glibc <= 2.27 (x86, x64)

Features

  • Heap tracer (malloc/free/calloc/realloc)
  • Malloc chunk info
  • Multi-arena info (chunks, top, last-remainder)
  • Bins info (fastbins, unsortedbin, smallbins y largebins)
  • Tcache info (glibc >= 2.26)
  • GraphView for linked lists (bins/tcache)
  • Magic utils:
    • Unlink merge info
    • Fake fastbin finder
    • House of force helper
    • Useful libc offsets
    • Calc chunk size (request2size)
    • IO_FILE structs

Install

Just drop the heap_viewer.py file and the heap_viewer folder into IDA's plugin directory.

Because IDA not load libc-dbg symbols in the debug session, is necesary generate a config file before using the plugin. To make this, simply install the libc6-dbg package in the remote linux machine and execute the script utils\get_config.py. Then, paste the content in the heap_viewer\files\config.json file.

get_config.py

$ python get_config.py
[*] config.json:

{
  "libc_offsets": {
    "32": {
      "mp_": 1921312,
      "main_arena": 1922976,
    },
    "64": {
      "mp_": 3883648,
      "main_arena": 3886144,
    }
  },
  "libc_version": "2.27"
}

If you not have the dbg symbols for given libc (ex: CTFs ;D), you can use the get_main_arena tool, and get the main_arena offset for that libc. This is enough so the plugin works correctly. Simply put the main_arena offset in the config.json file.

Examples:

$ ./main_arena_offset
[*] libc version:       2.27
[*] libc file:          /lib/i386-linux-gnu/libc-2.27.so
[*] libc address:       0xf7ceb000
[*] main_arena:         0xf7ec07a0
[*] main_arena offset:  0x1d57a0

$ LD_PRELOAD=./libc_64.so.6 ./main_arena_offset
...

Screenshots

Tracer

Tracer

Arena & chunk info

Arena-Chunk

Tcache entries

Tcache entries

Bins

Bins

Bin graph

BinGraph

Fastbin graph

fastbin graph

Tcache graph

tcache graph

Find fake fastbin

Find fake fastbin

Unlink merge info

Unlink merge info

Useful libc offsets

Useful libc offsets

Learning Resources

I'd recommend the following resources alongside this tool for learning heap exploiting.

Author

  • Daniel García Gutiérrez - @danigargu

Contribuitors 🍺

Special mention to my colleagues soez, wagiro and DiaLluvioso for give me some ideas during the development of the plugin. And of course, the @pwndbg project, from which I picked up some things about heap parsing.

Contributors

Bugs / Feedback / PRs

Any comment, issue or pull request will be highly appreciated :-)