I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of
Can I check that information offline?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
You can check if the libc.so uses tcache and determine the value of arena_max by using a reverse engineering tool such as gdb. The following steps can be used to check for tcache:
gdb -q libc.so
set environment LD_PRELOAD=
Run the following commands in gdb:
break main run p ((struct malloc_state*)main_arena)->tcache_bins
To determine the value of arena_max, use the following command in gdb:
p ((struct malloc_state*)main_arena)->top
This will give you the address of the current top of the main arena, which you can use to determine its size. Keep in mind that these commands are for GLIBC, and the exact values and structure of the main arena may differ for different implementations of the libc.
Note: The above steps are contingent on the presence of debugging symbols in the target libc.so. In the absence of these symbols, alternative reverse engineering methods, such as BA, may be required to establish the usage of tcache and determine the value of arena_max.