muslheap is a simple GDB plug-in for inspecting mallocng.
This plugin provides additional GDB commands to explore mallocng global states and internal data structures (slot, group, meta and so on).
mallocng is a new dynamic memory allocator in musl libc v1.2.1+, aiming to provide strong hardening against common memory usage errors such as overflows, double-free, and use-after-free.
The High-level design
(from mallocng-draft)
-
Memory organized dynamically into small slab-style groups of up to 32 identical-size allocation units with status controlled by bitmasks.
-
Utilize a mix of in-band and out-of-band metadata to isolate sensitive state from regions easily accessible through out-of-bounds writes.
-
Smalle allocations come from groups of one of 48 size classes, while large allocations are made individually by mmap treated as special one-member groups.
-
The first 8 size classes are spaced linearly up to 128, then roughly geometrically with four steps per doubling adjusted to divide powers of two with minimal remainder (waste).
-
Base allocation granularity and alignment is 16 bytes.
echo "source /path/to/muslheap.py" >> ~/.gdbinit
Requirements:
- Python 2.7.15+ (Python 3.5.2+ is recommended)
- GDB 7.11.1+ with python support
- musl libc 1.2.1+ with debug symbols
(Older versions of Python / GDB are untested and may not work as expected)
musl libc debug symbols can be installed from system repository:
- Ubuntu: Enable dbgsym repository, then
apt install musl-dbgsym - Alpine Linux:
apk add musl-dbg
-
mchunkinfo: Examine a mallocng-allocated memory (slot) -
mfindslot: Find out the slot where the given memory is inside -
mheapinfo: Display mallocng allocator internal information -
mmagic: Display the location of important functions and sensitive variables in musl libc
mchunkinfois used to inspect a mallocng-allocated memory (slot). The memory address given must be the starting address of user data area (user_data) inside an in-use slot. In most cases, it should be a pointer returned frommalloc().
mchunkinfo can validate the parsed data (such as in-band meta, meta and overflow bytes) and highlight if one of these validations failed.
mfindslotis used to find out which slot the given memory address is inside. It's useful to inspect a freed slot (which has nouser_data) or if you don't know the location of slot'suser_data.
If the slot is in-use, mfindslot will try to determine the address of user_data.
-
mheapinfo: Display mallocng allocator internal information (such as secret cookie,activechains andmeta_areachain). These data are parsed from__malloc_ctx. -
mmagic: Display the location (in offset) of important functions (such assystem) and sensitive variables (such as__stack_chk_guard) in musl libc. Useful for binary exploitation and CTF games.
- Detailed documentation for mallocng
- Check compatibility on 32-bit and non-x86/x64 (aarch64, MIPS etc.) architecture
- Add command to display slot usage (
usage_by_classes) and bounce status (is_bouncing) of a sizeclass
The MIT License (MIT)
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent