Questions tagged [heap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
38 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
2
votes
1answer
107 views

Explanation of heap shaping technique and how it is different from heap spraying

Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique. Can anyone please explain in details what is actually involved in using this tactic. Thanks
1
vote
2answers
153 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
4
votes
1answer
290 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
0answers
57 views

Challenges to learn jemalloc exploitation on FreeBSD [closed]

I'm studying this phrack article: http://www.phrack.org/issues/68/10.html Very interesting but the only valid way to be confident with an exploitation technique is an hands-on. I'm searching for ...
2
votes
1answer
762 views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
9
votes
1answer
813 views

Split view radare2 print heap

I recently start to use radare2 and I have a question How can I print info about the heap with dmhb dmhf etc. while debugging ? I would like to have the heap informations on the right and the ...
1
vote
0answers
104 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
2
votes
1answer
790 views

PE file format: How can I find the heap memory space in a running WinNT program?

I've been researching the Portable Executable format and one great work I've been reading is "ARTeam PE file format Tutorial" which is a collection of research from Michael J'OLeary, Randy Kath, Matt ...
0
votes
2answers
410 views

Heap address Calculation

I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process: 0:000> dt nt!_PEB 0106c000 ntdll!_PEB +0x000 InheritedAddressSpace : ...
0
votes
0answers
69 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
0
votes
1answer
964 views

Can either volatility or GDB dump only the heap memory of a process under Linux?

What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or ...