1

As part of an assignment, dealing with the operation aurora vulnerability, I am supposed to determine the size of C++ classes allocated on the heap.

I used:

0:017> !heap -p -a <address of the class I am researching>

And got:

address 047dcf08 found in
  _DPH_HEAP_ROOT @ 12d1000
  in busy allocation (DPH_HEAP_BLOCK:     UserAddr     UserSize -    VirtAddr   VirtSize)
                             4501270:      47dcf08           f8 -     47dc000       2000

According to the user size, the object is 0xf8 in size, but are there any header/trailer bytes that need to be subtracted to get the actual size of the class in this allocation block ?

2

No, UserSize is the size that was sent to the allocator.

malloc(0x100); // usersize 100

The obvious exception to this would be if you're using a custom heap allocator built on top of the standard heap allocator.

2

This is not a direct answer but windbg has a nice command that lets you "decipher" the answer to most of these question by yourself the name of the command is .ocommand

an example showing how you can ascertain what usersize points to using this command

#include <stdio.h>
#include <windows.h>

void dbg (PCHAR cmdstr , PVOID value) {
    char buff[0x300] = {0};
    sprintf_s(buff,cmdstr,value);
    OutputDebugStringA(buff);
    return ;
}
int main(void) {
    printf (
        "This is a windbg .ocommand Example\n"
        "This command can be leveraged to execute windbg commands \n"
        "For example command !heap -p -a is performed on allocated heap\n"
        "Output of !heap -p -a <address> can be viewed in windbg \n"
        "issue .ocommand myjick in windbg prior to running this exe\n"
        "or run this exe with windbg -c \".ocommand myjick\" ocommand.exe\n"
        );
    HANDLE hHeap = NULL;   
    if((hHeap = GetProcessHeap() ) != NULL)     {
        for (int i = 1 ; i< 6; i++)  {
            PCHAR mem[6] = {0};
            if (( mem[i] = (PCHAR)HeapAlloc(hHeap,0,0x101*i) ) != NULL)   {
                dbg("myjick !heap -p -a %x ;g;\n\n",mem[i]);
            }
        }
    }
    return 0; //all the allocated heaps need to be freed
}

output for the above code

cdb -c ".ocommand myjick ;g;q" ocommand.exe

0:000> cdb: Reading initial command '.ocommand myjick ;g;q'
Treat output prefixed with 'myjick ' as a command

This is a windbg .ocommand Example
This command can be leveraged to execute windbg commands
For example command !heap -p -a is performed on allocated heap
Output of !heap -p -a <address> can be viewed in windbg
issue .ocommand myjick in windbg prior to running this exe
or run this exe with windbg -c ".ocommand myjick" ocommand.exe 

    address 001537e8 found in
    _HEAP @ 150000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        001537e0 0024 0000  [07]   001537e8    00101 - (busy)    
    address 00153908 found in
    _HEAP @ 150000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        00153900 0044 0000  [07]   00153908    00202 - (busy)    
    address 00153b28 found in
    _HEAP @ 150000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        00153b20 0064 0000  [07]   00153b28    00303 - (busy)    
    address 00153e48 found in
    _HEAP @ 150000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        00153e40 0084 0000  [07]   00153e48    00404 - (busy)    
    address 00154268 found in
    _HEAP @ 150000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        00154260 00a4 0000  [07]   00154268    00505 - (busy)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.