0

What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or volatility under Linux, and have found no commands that just do this. The purpose is to parse the results for various corruptions / inadvisable practices.

Do any exist? It seems like something a lot of people might use.

So far I think I would need to chain what I learned from https://unix.stackexchange.com/questions/73627/how-to-find-heap-memory-of-a-running-process (using /maps to find the heap address) with either volatility of GDB, but I am very surprised that there isn't a command that does this out of the box.

3

This is so easy to do using nothing but the shell, and probably so specific (since most people want to check more than the heap), that there's probably no real reason to write a command for it.

I'd do something like

for pid in <whatever you need to get a pid list>; do
    heap=$(fgrep '[heap]' /proc/$pid/maps)
    addrs=$(echo $heap | cut -d' ' -f1)
    start=$(echo $addrs | cut -d'-' -f1)
    end=$(echo $addrs | cut -d'-' -f2)
    echo "dump binary memory heap.$pid $start $end" | gdb -p$pid
done

to have gdb attach to each process in the list, dump its heap to a file, and detach (implicit as standard input reaches EOF).

You can probably use shell builtin substitution to parse the [heap] line a bit better; i learned shell programming when 'shell' meant sh, not bash or ksh, and tend to stick to how to do stuff with the old bourne shell.

Note that, when gdb attaches to your process, the process may be in the middle of malloc() and updating the internal heap structures, which might result in your program returning a false positive 'heap corrupt' result. If this is an issue, append something like break memcpy\ncont\n in front of the dump command. This will still be a problem if, in a multithreaded program, one thread hits memcpy while another does a malloc, and your memcpy might never be called if the compiler inlines it everywhere, so you might need to get quite fancy here to get a good result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.