🔍Heap analysis tool for CTF pwn.
Pwnning is an art.
HeapInspect
is designed to make heap
much more prettier.
Now this tool is a plugin of nadbg. Try it!
HeapShower
(detailed)PrettyPrinter
(colorful, summary)A quick use of this tool.
You can also use it as a gdb plugin, very useful when pwndbg
or other plugins failed to analysis heap.
sed -i "1i source `pwd`/gdbscript.py" ~/.gdbinit # alternatively, you can add that line manually
Note
Pretty easy to use. I will make it a package later.
from heapinspect.core import *
hi = HeapInspector(1234) #pid here
hs = HeapShower(hi)
print(hs.fastbins)
print(hs.smallbins)
print(hs.largebins)
print(hs.unsortedbins)
print(hs.tcache_chunks)
hs.relative = 1 #relative mode, check Quick shot
print(hs.fastbins)
sleep(10)
#now assume that the heap state has changed
hs.update() #use this to refresh
pp = PrettyPrinter(hi)
print(pp.all) #pretty printer
pp.update() #use this to update
There are some testcases.
heapinspect/tests/ $ python test.py #this will run all test cases for you to check this tool.
......
......
test case unsortedbins64 at test/testcases/libc-2.27/64bit
pid:6704
========================= fastbins =========================
========================= unsortedbins =========================
chunk(0x7f9aae2e6720): prev_size=0x0 size=0xb1 fd=0x7f9aacdfbca0 bk=0x7f9aae2e6880
chunk(0x7f9aae2e6880): prev_size=0x0 size=0xb1 fd=0x7f9aae2e6720 bk=0x7f9aacdfbca0
========================= smallbins =========================
========================= largebins =========================
========================= tcache =========================
tcache[9]:
chunk(0x7f9aae2e6670): prev_size=0x0 size=0xb1 fd=0x7f9aae2e65d0 bk=0x0
chunk(0x7f9aae2e65c0): prev_size=0x0 size=0xb1 fd=0x7f9aae2e6520 bk=0x0
chunk(0x7f9aae2e6510): prev_size=0x0 size=0xb1 fd=0x7f9aae2e6470 bk=0x0
chunk(0x7f9aae2e6460): prev_size=0x0 size=0xb1 fd=0x7f9aae2e63c0 bk=0x0
chunk(0x7f9aae2e63b0): prev_size=0x0 size=0xb1 fd=0x7f9aae2e6310 bk=0x0
chunk(0x7f9aae2e6300): prev_size=0x0 size=0xb1 fd=0x7f9aae2e6260 bk=0x0
chunk(0x7f9aae2e6250): prev_size=0x0 size=0xb1 fd=0x0 bk=0x0
Detailed docstrings have been written into the source code.
I have built a sphinx doc in docs
. Just open docs/build/html/index.html
with your browser.
docs update.
not a functional update.
first release
next version will be a release.
this is not a stable version. im trying to fix bugs due to different glibc. i need help to test this.
next version will add multi libc support. heapdiff and heap check will be added later.
HeapShower
bins
now search from bk
instead of fd
, as the manner of glibcHeapRecoder
, I will make a heapdiffsmallbins
and largebins
fastbin
prototypeunsortedbin
prototypebins
prototypetcache
prototypeC_Struct
to handle c structureclass HeapInspector
arena
class Proc
in proc_util
test.py