Hot answers tagged

10

You can use | or = in Visual Mode to split horizontally and vertically respectively. Open your file in debug mode and go to Visual Mode by pressing V, then press p until you reach the assembly view: $ r2 -d program [0xf7799b30]> V Then press | and you'll be able to configure cmd.cprompt. Write the command that you wish to see in the right pane of the ...


9

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap chunk looks like. Source: https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/ Lets take the following code to demonstrate this. #include <...


3

Short answer: The heap, stack and other PE loader related tasks are not part of the PE standard or definition. General Information the PE file does not describe the entire memory space of an executable. It only contains the data required to execute a program, and the OS keeps the right to add additional regions without the user's awareness. Things such as ...


3

This is so easy to do using nothing but the shell, and probably so specific (since most people want to check more than the heap), that there's probably no real reason to write a command for it. I'd do something like for pid in <whatever you need to get a pid list>; do heap=$(fgrep '[heap]' /proc/$pid/maps) addrs=$(echo $heap | cut -d' ' -f1) ...


2

this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the same 0:000> !heap -s @$proc->ProcessHeap **************************************************************************** ...


2

There is two ollydbg plugins that can help you to see the heap data. 1- Heap Vis by Pedram Amini You may have noticed the ghosted 'Heap' option under the 'View' menu in OllyDBG. The feature is available only under Windows 95 based OSes and is supposed to display a list of allocated memory blocks. The Olly Heap Vis plug-in was written to provide this ...


2

Heap shaping (also called heap grooming, for a more passive approach) is the slightly more intelligent sibling of heap spraying while developing exploits. Therefore, to properly explain heap shaping one must first be familiar with heap spraying. heap spraying Heap spraying is the act of intentionally filling (spraying) a target process's heap space with ...


1

Tracing memory allocations Tracing is when instead of stopping when a function is called a tool will simply write a log line (usually with some additional data). Tracing is often a lot faster than interrupting the execution and yielding control to a user to handle the break point. This is probably the simplest solution for you. You could trace all ...


1

Great tool to achieve this in Windows is Application Verifier. The general idea is that you run your program with different heap inspections, using the verifier. For example - each allocation made on a separate memory page, Freed memory is not just returned to the pool but marked as freed, and any later access to it will cause an excpetion and so on. This ...


1

Check out the memory map in the virtual file /proc/[pid]/maps (replace [pid] by the process ID of your target). Usually it mentions memory ranges belonging to heap and stack. E.g.: address perms offset dev inode pathname 00400000-00452000 r-xp 00000000 08:02 173521 /usr/bin/dbus-daemon 00651000-00652000 r--p 00051000 08:02 173521 ...


1

If you want to find out statically, you have to inspect the call site to your function and see where the buffer argument comes from. You may have to go back multiple layers until you either clearly see it's on the stack (if the address of a local memory area is passed in), or it comes from a call like VirtualAlloc, malloc, new, HeapAlloc (VirtualAlloc and ...


1

If it's address is above or equal to the stack pointer (esp/rsp), it's on the stack otherwise, it's on the heap or was on a previous stack-frame (and now is out of scope and should not be used) If you want to know but just looking at the address: if the address starts with 0x7f, it's on the stack. That might not always be right though, a program can control ...


1

The problem was due to the Page Heap verification, enabled by Gflags. I forgot about that, and the heap verifier was messing with the heap handles. When i disabled it, the handle at the PEB became valid.


Only top voted, non community-wiki answers of a minimum length are eligible