Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add capability to glibc heap commands for bruteforcing the main_arena #932

Merged
merged 13 commits into from
Mar 21, 2023
22 changes: 22 additions & 0 deletions docs/commands/heap.md
Expand Up @@ -9,6 +9,28 @@ for `malloc` structure information). Syntax to the subcommands is straight forwa
gef➤ heap <sub_commands>
```

## `main_arena` symbol ###

If the linked glibc of the target program does not have debugging symbols it
might be tricky for GEF to find the address of the `main_arena` which is needed
for most of the `heap` subcommands. If you know the offset of this symbol from
the glibc base address you can use GEF's config to provide said value:

```
gef➤ gef config gef.main_arena_offset <offset>
```

If you do not know this offset and you want GEF to try and find it via bruteforce
when executing a `heap` command the next time, you can try this instead:

```
gef➤ gef config gef.bruteforce_main_arena True
```

Note that this might take a few seconds to complete. If GEF does find the symbol
you can then calculate the offset to the libc base address and save it in the config.


### `heap chunks` command ###

Displays all the chunks from the `heap` section of the current arena.
Expand Down