-
Notifications
You must be signed in to change notification settings - Fork 865
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
display chain bk and fd if corrupted #537
Conversation
@@ -393,6 +393,7 @@ def fastbin_index(self, size): | |||
|
|||
|
|||
def fastbins(self, arena_addr=None): | |||
"""Returns: chain or None""" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Might be good to add when None
might be returned (same for the ones below)
pwndbg/heap/ptmalloc.py
Outdated
|
||
is_chain_corrupted = False | ||
chain_fd = pwndbg.chain.get(int(front), offset=fd_offset, hard_stop=current_base, limit=heap_chain_limit, include_start=True) | ||
chain_bk = pwndbg.chain.get(int(back), offset=bk_offset, hard_stop=current_base, limit=heap_chain_limit, include_start=True) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe:
get_chain = lambda bin: pwndbg.chain.get(int(bin), offset=fd_offset, hard_stop=current_base, limit=heap_chain_limit, include_start=True)
chain_fd = get_chain(front)
chain_bk = get_chain(back)
pwndbg/heap/ptmalloc.py
Outdated
chain_bk = pwndbg.chain.get(int(back), offset=bk_offset, hard_stop=current_base, limit=heap_chain_limit, include_start=True) | ||
|
||
# check if bin[index] points to itself (is empty) | ||
if len(chain_fd) == 2 and len(chain_bk) == 2 and chain_fd[0] == chain_bk[0]: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
as its Python it can be written as if len(chain_fd) == len(chain_bk) == 2 and ...
I don't mind leaving it as it is; it's up to you
@@ -449,6 +451,8 @@ def bin_at(self, index, arena_addr=None): | |||
Bin 1 - Unsorted BiN | |||
Bin 2 to 63 - Smallbins | |||
Bin 64 to 126 - Largebins | |||
|
|||
Returns: tuple(chain_from_bin_fd, chain_from_bin_bk, is_chain_corrupted) or None |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Does it detect all cases of corrupted chains? What if there is a loop in the linked list pointers (I guess there might be one).
Might be good to add some docs about it
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i think all cases. Can't get into loop, because pwndbg.chain.get
stops when loop is detected.
Docs seems unnecesary, as the check is simple.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The docs could document examples how those commands behave when heap is corrupted (with examples)
Below results before and after changes, a bit adjusted by adding newlines after each command result. Result before the changes:
After changes:
|
count, is_chain_corrupted = None, False | ||
if len(b) == 1: # fastbin: | ||
chain_fd = b | ||
elif len(b) == 2: # tcachebin: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is this dictated by?
Can we add a comment with link to some documentation or glibc source code? Or explain this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
fixes #507
Adds check for doubly linked bins corruption.
It's WIP, as idk how we want to print the corruption, currently its:
File to test: