2

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it and see how it is being modified.

So far I've tried:

  1. Insert a unique string e.g. r00tr00tr00tr00t...r00t via the binary**
  2. Go to Memory View (ALT+M)
  3. Search (CTRL+B) for ASCII: r00t

I always fail to locate it. I'm new to this so is the steps I took the right direction? If no how can I locate the string in the heap?

** this is injected with normal flow of the program, it accepts data from user. Let's say it's a serial number to be entered for instanc, which is placed in the heap using HeapAlloc

2

There is two ollydbg plugins that can help you to see the heap data.

1- Heap Vis by Pedram Amini
You may have noticed the ghosted 'Heap' option under the 'View' menu in OllyDBG. The feature is available only under Windows 95 based OSes and is supposed to display a list of allocated memory blocks. The Olly Heap Vis plug-in was written to provide this functionality and more on all modern Windows OSes such as Windows 2000, XP and 2003. The OllyDbg Heap Vis plug-in exposes the following functionality:

  • View Heaps
  • Search Heaps
  • Jump to Heap Chunk
  • Create Heap Visualization

enter image description here http://www.openrce.org/downloads/details/1/Heap_Vis

2- OllyHeapTrace by Stephen Fewer
OllyHeapTrace (Written in 2008) is a plugin for OllyDbg (version 1.10) to trace the heap operations being performed by a process. It will monitor heap allocations and frees for multiple heaps, as well as operations such as creating or destroying heaps and reallocations. All parameters as well as return values are recorded and the trace is highlighted with a unique colour for each heap being traced.

The primary purpose of this plugin is to aid in the debugging of heap overflows where you wish to be able to control the heap layout to overwrite a specific structure such as a chunk header, critical section structure or some application specific data. By tracing the heap operations performed during actions you can control (for example opening a connection, sending a packet, closing a connection) you can begin to predict the heap operations and thus control the heap layout.

enter image description here https://github.com/stephenfewer/OllyHeapTrace

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.