Here's a few examples of outliers that cause the binary to hang or otherwise act weird/broken:

forbes.com
39.net
github.io
nydailynews.com
therichest.com
canalplus.fr
abola.pt
local.com

I used ./heartleech <insert_domain> -a to test them.

I've compiled openssl, and am trying to build the tool, but I receive the following:

╭─<root@drop1>-<~/openssl>-<master●>-<11:15AM>-◇
╰─➤ gcc ../heartleech/heartleech.c libcrypto.a libssl.a -ldl -o heartleech
../heartleech/heartleech.c:64:25: fatal error: openssl/ssl.h: No such file or directory
compilation terminated.

I've tried modifying the path to go to where I can find ssl.h.. but that doesn't fix anything, and just causes more fatal errors.

For randomization of size is not working?
It asks me for aditional parameter.
Shouldn't randomization just pick randomly from reasonable range?

I'm compiling on archlinux with:
gcc -lssl -lssl3 -lcrypto heartleech.c -o heartleech

inet_ntop function does not exist on Windows XP. I patched your code as the following. (sorry for the formatting, I don't know how to format code in this editor)

const char* inet_ntop2(int af, const void* src, char* dst, int cnt)
{

struct sockaddr_in srcaddr;

memset(&srcaddr, 0, sizeof(struct sockaddr_in));
memcpy(&(srcaddr.sin_addr), src, sizeof(srcaddr.sin_addr));

srcaddr.sin_family = af;
if (WSAAddressToString((struct sockaddr*) &srcaddr, sizeof(struct sockaddr_in), 0, dst, (LPDWORD) &cnt) != 0) {
    DWORD rv = WSAGetLastError();
    printf("WSAAddressToString() : %d\n",rv);
    return NULL;
}
return dst;

}

static const char *my_inet_ntop(int family, struct sockaddr *sa, char *dst, size_t sizeof_dst)
{
switch (family) {
case AF_INET:
inet_ntop2(AF_INET, &(((struct sockaddr_in *)sa)->sin_addr),
dst, sizeof_dst);
break;
case AF_INET6:
inet_ntop2(AF_INET6, &(((struct sockaddr_in6 *)sa)->sin6_addr),
dst, sizeof_dst);
break;
default:
dst[0] = '\0';
}

return dst;

}

If you don't pass any parameters the only suggested parameters are for host, filename and port. I think it is worth adding the autopwn and other options there as well to remind people they exist.

./heartleech -d --scan -v 4 github.com -p 443

--- heartleech/1.0.0f ---
from https://github.com/robertdavidgraham/heartleech
PCRE library: 8.30 2012-02-04

[ ] resolving "github.com"
[+]  192.30.252.131
[+]  192.30.252.131
[+]  192.30.252.131
[ ] 192.30.252.131: connecting...
[+] 192.30.252.131: connected
[ ] SSL handshake started...
[+] SSL handshake complete [ECDHE-RSA-AES128-GCM-SHA256]
[+] servername = github.com
[+] RSA public-key length = 2048-bits
[ ] transmitting requests
[ ] waiting for response
[-] timeout waiting for response
[ ] transmitting requests
[ ] waiting for response
[-] timeout waiting for response
[ ] probing with good heartbeat
[ ] transmitting requests
[ ] waiting for response
[+]    37-bytes bleed received
github.com:443: VULNERABLE

For unfixed servers it receives much more than 37 bytes. For fixed servers it is always 37 (if hearbeat extension is supported). Is it bug in heartleech or servers around are actually not completely fixed?

Hi,
Since loop_count is defined as unsigned the following while statement loops forever:

while (args.loop_count) {

I changed the type of loop_count to "int" and the while statement as the following line:

while (args.loop_count >= 0) {

As you have noticed ssl3_write_bytes() is internal to openssl and is thus not exported in openssl iibrary provided by Debian and Kali Linux. Your workaround works well but doesn't allow for proper packaging. Linking with static libraries is frowned upon in the Debian policy and downloading openssl during the build of heartleech is also forbidden (but I did that for Kali Linux anyway)...

Would it be possible to duplicace just ssl3_write_bytes in the heartleech source code and otherwise dynamically link with OpenSSL ?

Thanks for considering.

OS: Archlinux

I followed your instructions from the readme, but I got:

undefined reference to symbol 'ENGINE_get_ssl_client_cert_function'

from ld, and

error adding symbols: DSO missing from command line

from libcryptio.so.1.0.0

The following line blocks for a long time if the server is patched.

x = BIO_read(bio, buf, sizeof(buf) - 1);

Is there a way to define a timeout for the BIO_read function?

While packaging your application for Kali linux, I noticed that heartleech needs "libpcre.so" to work properly. That file is only available if you have installed libpcre-dev and not if you have only libpcre3 (which provides libpcre.so.3). The reason why that file is needed is because you dlopen that library... but I see no reason why heartleech would need to dlopen() that library instead of using the symbols directly and linking against libpcre at build time (gcc -lpcre).

My request is thus to update heartleech to link against that library at bulld time to avoid the need of libpcre-dev at runtime and also to ensure we have proper dependencies generated automatically.

I tried compiling on Fedora 20 but it won't work for some reason. I compiled open ssl from source before trying to compile heartleech.

 ~/D/P/heartleech (master)> gcc -I ../openssl-1.0.1f/include -L ../openssl-1.0.1f/out32 -lssleay32 -leay32 -o heartleech heartleech.c
/usr/bin/ld: cannot find -lssleay32
/usr/bin/ld: cannot find -leay32
 ~/D/P/heartleech (master) [1]> 

how to resolve it can u help me

[0;1;32m ^
�[0m�[1m/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.9.sdk/usr/include/openssl/crypto.h:382:13: �[0m�[0;1;30mnote: �[0m
'SSLeay_version' declared here�[0m
const char *SSLeay_version(int type) DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER;
�[0;1;32m ^
�[0m85 warnings and 6 errors generated.
jamesk@HOME~/Downloads/openssl-> exit
exit

Openssl build was successful with no errors. I get this error when i try to run gcc ../heartleech/heartleech.c libssl.a libcrypto.a -ldl -lpthread -o heartleech -I./include

root@kali:~/openssl# gcc ../heartleech/heartleech.c libssl.a libcrypto.a -ldl -lpthread -o heartleech -I./include
../heartleech/heartleech.c:111:2: error: #error You are using the wrong version of OpenSSL headers.
#error You are using the wrong version of OpenSSL headers.
^
../heartleech/heartleech.c:263:12: error: field ‘n’ has incomplete type
BIGNUM n;
^
../heartleech/heartleech.c:264:12: error: field ‘e’ has incomplete type
BIGNUM e;
^
../heartleech/heartleech.c: In function ‘receive_heartbeat’:
../heartleech/heartleech.c:562:10: error: ‘TLS1_RT_HEARTBEAT’ undeclared (first use in this function)
case TLS1_RT_HEARTBEAT:
^
../heartleech/heartleech.c:562:10: note: each undeclared identifier is reported only once for each function it appears in
../heartleech/heartleech.c: In function ‘rsa_gen’:
../heartleech/heartleech.c:762:12: error: array type has incomplete element type
BIGNUM p1[1], q1[1], r[1];
^
../heartleech/heartleech.c:762:19: error: array type has incomplete element type
BIGNUM p1[1], q1[1], r[1];
^
../heartleech/heartleech.c:762:26: error: array type has incomplete element type
BIGNUM p1[1], q1[1], r[1];
^
../heartleech/heartleech.c:768:8: error: dereferencing pointer to incomplete type
rsa->p = BN_new();
^
../heartleech/heartleech.c:769:16: error: dereferencing pointer to incomplete type
BN_copy(rsa->p, p);
^
../heartleech/heartleech.c:770:8: error: dereferencing pointer to incomplete type
rsa->q = BN_new();
^
../heartleech/heartleech.c:771:16: error: dereferencing pointer to incomplete type
BN_copy(rsa->q, q);
^
../heartleech/heartleech.c:772:8: error: dereferencing pointer to incomplete type
rsa->e = BN_new();
^
../heartleech/heartleech.c:773:16: error: dereferencing pointer to incomplete type
BN_copy(rsa->e, e);
^
../heartleech/heartleech.c:779:8: error: dereferencing pointer to incomplete type
rsa->n = BN_new();
^
../heartleech/heartleech.c:780:15: error: dereferencing pointer to incomplete type
BN_mul(rsa->n, rsa->p, rsa->q, ctx);
^
../heartleech/heartleech.c:780:23: error: dereferencing pointer to incomplete type
BN_mul(rsa->n, rsa->p, rsa->q, ctx);
^
../heartleech/heartleech.c:780:31: error: dereferencing pointer to incomplete type
BN_mul(rsa->n, rsa->p, rsa->q, ctx);
^
../heartleech/heartleech.c:785:8: error: dereferencing pointer to incomplete type
rsa->d = BN_new();
^
../heartleech/heartleech.c:786:19: error: dereferencing pointer to incomplete type
BN_sub(p1, rsa->p, BN_value_one());
^
../heartleech/heartleech.c:787:19: error: dereferencing pointer to incomplete type
BN_sub(q1, rsa->q, BN_value_one());
^
../heartleech/heartleech.c:789:23: error: dereferencing pointer to incomplete type
BN_mod_inverse(rsa->d, rsa->e, r, ctx);
^
../heartleech/heartleech.c:789:31: error: dereferencing pointer to incomplete type
BN_mod_inverse(rsa->d, rsa->e, r, ctx);
^
../heartleech/heartleech.c:792:8: error: dereferencing pointer to incomplete type
rsa->dmp1 = BN_new();
^
In file included from ./include/openssl/asn1.h:72:0,
from ./include/openssl/objects.h:964,
from ./include/openssl/evp.h:75,
from ./include/openssl/x509.h:70,
from ./include/openssl/ssl.h:150,
from ../heartleech/heartleech.c:98:
../heartleech/heartleech.c:793:15: error: dereferencing pointer to incomplete type
BN_mod(rsa->dmp1, rsa->d, p1, ctx);
^
./include/openssl/bn.h:297:43: note: in definition of macro ‘BN_mod’

define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))

                                       ^

../heartleech/heartleech.c:793:26: error: dereferencing pointer to incomplete type
BN_mod(rsa->dmp1, rsa->d, p1, ctx);
^
./include/openssl/bn.h:297:49: note: in definition of macro ‘BN_mod’

define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))

                                             ^

../heartleech/heartleech.c:796:8: error: dereferencing pointer to incomplete type
rsa->dmq1 = BN_new();
^
In file included from ./include/openssl/asn1.h:72:0,
from ./include/openssl/objects.h:964,
from ./include/openssl/evp.h:75,
from ./include/openssl/x509.h:70,
from ./include/openssl/ssl.h:150,
from ../heartleech/heartleech.c:98:
../heartleech/heartleech.c:797:15: error: dereferencing pointer to incomplete type
BN_mod(rsa->dmq1, rsa->d, q1, ctx);
^
./include/openssl/bn.h:297:43: note: in definition of macro ‘BN_mod’

define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))

                                       ^

../heartleech/heartleech.c:797:26: error: dereferencing pointer to incomplete type
BN_mod(rsa->dmq1, rsa->d, q1, ctx);
^
./include/openssl/bn.h:297:49: note: in definition of macro ‘BN_mod’

define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))

                                             ^

../heartleech/heartleech.c:800:8: error: dereferencing pointer to incomplete type
rsa->iqmp = BN_new();
^
../heartleech/heartleech.c:801:23: error: dereferencing pointer to incomplete type
BN_mod_inverse(rsa->iqmp, rsa->q, rsa->p, ctx);
^
../heartleech/heartleech.c:801:34: error: dereferencing pointer to incomplete type
BN_mod_inverse(rsa->iqmp, rsa->q, rsa->p, ctx);
^
../heartleech/heartleech.c:801:42: error: dereferencing pointer to incomplete type
BN_mod_inverse(rsa->iqmp, rsa->q, rsa->p, ctx);
^
../heartleech/heartleech.c: At top level:
../heartleech/heartleech.c:819:31: error: parameter 1 (‘n’) has incomplete type
find_private_key(const BIGNUM n, const BIGNUM e,
^
../heartleech/heartleech.c:819:47: error: parameter 2 (‘e’) has incomplete type
find_private_key(const BIGNUM n, const BIGNUM e,
^
../heartleech/heartleech.c: In function ‘find_private_key’:
../heartleech/heartleech.c:825:12: error: storage size of ‘p’ isn’t known
BIGNUM p;
^
../heartleech/heartleech.c:826:12: error: storage size of ‘q’ isn’t known
BIGNUM q;
^
../heartleech/heartleech.c:827:12: error: storage size of ‘remainder’ isn’t known
BIGNUM remainder;
^
../heartleech/heartleech.c: At top level:
../heartleech/heartleech.c:906:22: error: parameter 4 (‘n’) has incomplete type
BIGNUM n, BIGNUM e)
^
../heartleech/heartleech.c:906:32: error: parameter 5 (‘e’) has incomplete type
BIGNUM n, BIGNUM e)
^
../heartleech/heartleech.c: In function ‘parse_cert’:
../heartleech/heartleech.c:973:25: error: dereferencing pointer to incomplete type
if (rsakey && rsakey->type == 6) {
^
../heartleech/heartleech.c:974:27: error: dereferencing pointer to incomplete type
BIGNUM _n = rsakey->pkey.rsa->n;
^
../heartleech/heartleech.c:975:35: error: dereferencing pointer to incomplete type
memcpy(modulus, n, sizeof(_modulus));
^
../heartleech/heartleech.c:976:25: error: dereferencing pointer to incomplete type
memcpy(e, rsakey->pkey.rsa->e, sizeof(_e));
^
../heartleech/heartleech.c:976:47: error: dereferencing pointer to incomplete type
memcpy(e, rsakey->pkey.rsa->e, sizeof(_e));
^
../heartleech/heartleech.c:978:38: error: dereferencing pointer to incomplete type
n->top * sizeof(BN_ULONG) * 8);
^
../heartleech/heartleech.c: In function ‘ssl_thread’:
../heartleech/heartleech.c:2057:12: error: dereferencing pointer to incomplete type
if (ssl->tlsext_heartbeat != 1) {
^
../heartleech/heartleech.c:2154:31: error: ‘TLS1_RT_HEARTBEAT’ undeclared (first use in this function)
ssl3_write_bytes(ssl, TLS1_RT_HEARTBEAT,
^
../heartleech/heartleech.c: In function ‘process_offline_file’:
../heartleech/heartleech.c:2344:12: error: storage size of ‘n’ isn’t known
BIGNUM n;
^
../heartleech/heartleech.c:2345:12: error: storage size of ‘e’ isn’t known
BIGNUM e;

Currently uses the heartbeat bytes \x18\x03\x03\x00\x03\x01\x40\x00. Should be \x18\x03\x02 for TLS1.1 or \x18\x03\x01 for TLS1.0.

BTW, the \x40\x00 bytes at the end specify the length of data that the server should return - you can set this to \xff\xff if you want the maximum amount per heartbeat.

I just followed your build instructions, OpenSSL built fine, stayed in the directory and ran gcc but got the following error:

robin@bt openssl $ gcc ../heartleech/heartleech.c libssl.a libcrypto.a -ldl -lpthread -o ../heartleech/heartleech
../heartleech/heartleech.c:111:2: error: #error You are using the wrong version of OpenSSL headers.
../heartleech/heartleech.c: In function ‘receive_heartbeat’:
../heartleech/heartleech.c:562: error: ‘TLS1_RT_HEARTBEAT’ undeclared (first use in this function)
../heartleech/heartleech.c:562: error: (Each undeclared identifier is reported only once
../heartleech/heartleech.c:562: error: for each function it appears in.)
../heartleech/heartleech.c: In function ‘ssl_thread’:
../heartleech/heartleech.c:2057: error: ‘SSL’ has no member named ‘tlsext_heartbeat’
../heartleech/heartleech.c:2154: error: ‘TLS1_RT_HEARTBEAT’ undeclared (first use in this function)
../heartleech/heartleech.c: In function ‘main’:
../heartleech/heartleech.c:3178: warning: passing argument 3 of ‘pthread_create’ from incompatible pointer type
/usr/include/pthread.h:227: note: expected ‘void * ()(void *)’ but argument is of type ‘void ()(void *)’

Free software projects tend to provide source tarballs to make it easy to distribute the software at known points of the history. With github you can easily do that just by creating a tag of the version that you want to release. eg "1.0", "1.1", etc.

It would be nice if you could start doing that as I had to invent a version for heartleech when I packaged it for Kali Linux.

I also noticed that you provide ready-to use binaries in the "bin" sub-directory. Those should not be part of such "source releases" and should ideally be moved to some other place (another git repository if you want).

Thank you!

I am trying to build the heartbleech using the same instructions given in readme.md but it gives me errors. There were no errors while building openssl libraries, but while compiling heartbleech.c it gave me errors. I understand they're linking errors, but don't know how to solve them.

My System Configuration:

• OS: Ubuntu 10.10 - the Maverick Meerkat
• gcc : 4.4.5
• Machine Architecture : i686

Errors:

libssl.a(s3_pkt.o): In function `ssl3_do_compress':
s3_pkt.c:(.text+0x3bb): undefined reference to `COMP_compress_block'
libssl.a(s3_pkt.o): In function `ssl3_do_uncompress':
s3_pkt.c:(.text+0x42b): undefined reference to `COMP_expand_block'
libssl.a(s3_pkt.o): In function `do_ssl3_write':
s3_pkt.c:(.text+0x98a): undefined reference to `COMP_compress_block'
libssl.a(s3_pkt.o): In function `ssl3_read_bytes':
s3_pkt.c:(.text+0x171b): undefined reference to `COMP_expand_block'
libssl.a(s3_both.o): In function `ssl_cert_type':
s3_both.c:(.text+0x24a): undefined reference to `X509_certificate_type'
libssl.a(t1_lib.o): In function `ssl_get_auto_dh':
t1_lib.c:(.text+0x48f): undefined reference to `get_rfc3526_prime_8192'
t1_lib.c:(.text+0x4b8): undefined reference to `get_rfc3526_prime_3072'
libssl.a(t1_lib.o): In function `tls12_get_hash':
t1_lib.c:(.text+0xe81): undefined reference to `FIPS_mode'
libssl.a(t1_lib.o): In function `tls1_process_sigalgs':
t1_lib.c:(.text+0x4521): undefined reference to `FIPS_mode'
libssl.a(t1_lib.o): In function `tls12_check_peer_sigalg':
t1_lib.c:(.text+0x59e9): undefined reference to `FIPS_mode'
libssl.a(t1_lib.o): In function `tls1_check_chain':
t1_lib.c:(.text+0x63d6): undefined reference to `X509_certificate_type'
libssl.a(t1_enc.o): In function `tls1_change_cipher_state':
t1_enc.c:(.text+0x138a): undefined reference to `COMP_CTX_free'
t1_enc.c:(.text+0x13a7): undefined reference to `COMP_CTX_new'
t1_enc.c:(.text+0x146c): undefined reference to `COMP_CTX_free'
t1_enc.c:(.text+0x1485): undefined reference to `COMP_CTX_new'
libssl.a(ssl_lib.o): In function `ssl_clear_cipher_ctx':
ssl_lib.c:(.text+0x153a): undefined reference to `COMP_CTX_free'
ssl_lib.c:(.text+0x1556): undefined reference to `COMP_CTX_free'
libssl.a(ssl_lib.o): In function `SSL_set_fd':
ssl_lib.c:(.text+0x539a): undefined reference to `BIO_s_socket'
libssl.a(ssl_lib.o): In function `SSL_set_wfd':
ssl_lib.c:(.text+0x5489): undefined reference to `BIO_s_socket'
libssl.a(ssl_lib.o): In function `SSL_set_rfd':
ssl_lib.c:(.text+0x55c9): undefined reference to `BIO_s_socket'
libssl.a(ssl_lib.o): In function `SSL_CTX_load_verify_locations':
ssl_lib.c:(.text+0x12d2): undefined reference to `X509_STORE_load_locations'
libssl.a(ssl_lib.o): In function `SSL_CTX_set_default_verify_paths':
ssl_lib.c:(.text+0x12f2): undefined reference to `X509_STORE_set_default_paths'
libssl.a(ssl_err2.o): In function `SSL_load_error_strings':
ssl_err2.c:(.text+0x4): undefined reference to `ERR_load_crypto_strings'
libssl.a(ssl_cert.o): In function `ssl_build_cert_chain':
ssl_cert.c:(.text+0x6a2): undefined reference to `X509_verify_cert_error_string'
libssl.a(ssl_cert.o): In function `SSL_add_dir_cert_subjects_to_stack':
ssl_cert.c:(.text+0xa5c): undefined reference to `OPENSSL_DIR_read'
ssl_cert.c:(.text+0xadb): undefined reference to `OPENSSL_DIR_end'
libssl.a(ssl_sess.o): In function `SSL_CTX_set_client_cert_engine':
ssl_sess.c:(.text+0x378): undefined reference to `ENGINE_get_ssl_client_cert_function'
libssl.a(ssl_ciph.o): In function `load_builtin_compressions':
ssl_ciph.c:(.text+0x60f): undefined reference to `COMP_zlib'
libssl.a(ssl_ciph.o): In function `ssl_cipher_get_evp':
ssl_ciph.c:(.text+0x1839): undefined reference to `EVP_enc_null'
libssl.a(tls_srp.o): In function `SRP_Calc_A_param':
tls_srp.c:(.text+0x337): undefined reference to `SRP_Calc_A'
tls_srp.c:(.text+0x37c): undefined reference to `SRP_check_known_gN_param'
libssl.a(tls_srp.o): In function `SRP_generate_client_master_secret':
tls_srp.c:(.text+0x3db): undefined reference to `SRP_Verify_B_mod_N'
tls_srp.c:(.text+0x466): undefined reference to `SRP_Calc_u'
tls_srp.c:(.text+0x4c1): undefined reference to `SRP_Calc_x'
tls_srp.c:(.text+0x505): undefined reference to `SRP_Calc_client_key'
libssl.a(tls_srp.o): In function `SRP_generate_server_master_secret':
tls_srp.c:(.text+0x5fb): undefined reference to `SRP_Verify_A_mod_N'
tls_srp.c:(.text+0x658): undefined reference to `SRP_Calc_u'
tls_srp.c:(.text+0x68e): undefined reference to `SRP_Calc_server_key'
libssl.a(tls_srp.o): In function `SSL_set_srp_server_param_pw':
tls_srp.c:(.text+0xbc7): undefined reference to `SRP_get_default_gN'
tls_srp.c:(.text+0xc74): undefined reference to `SRP_create_verifier_BN'
libssl.a(tls_srp.o): In function `SSL_srp_server_param_with_username':
tls_srp.c:(.text+0xd80): undefined reference to `SRP_Calc_B'
libssl.a(s3_clnt.o): In function `ssl_do_client_cert_cb':
s3_clnt.c:(.text+0x6ab): undefined reference to `ENGINE_load_ssl_client_cert'
libssl.a(s3_clnt.o): In function `ssl3_check_cert_and_algorithm':
s3_clnt.c:(.text+0x8f3): undefined reference to `X509_certificate_type'
libssl.a(s3_clnt.o): In function `ssl3_send_client_certificate':
s3_clnt.c:(.text+0x5adf): undefined reference to `ENGINE_load_ssl_client_cert'
libssl.a(s3_enc.o): In function `ssl3_change_cipher_state':
s3_enc.c:(.text+0xcbb): undefined reference to `COMP_CTX_free'
s3_enc.c:(.text+0xcd5): undefined reference to `COMP_CTX_new'
s3_enc.c:(.text+0xd66): undefined reference to `COMP_CTX_free'
s3_enc.c:(.text+0xd7c): undefined reference to `COMP_CTX_new'
libssl.a(d1_lib.o): In function `dtls1_clear_queues':
d1_lib.c:(.text+0x451): undefined reference to `pitem_free'
d1_lib.c:(.text+0x462): undefined reference to `pqueue_pop'
d1_lib.c:(.text+0x491): undefined reference to `pitem_free'
d1_lib.c:(.text+0x4a2): undefined reference to `pqueue_pop'
d1_lib.c:(.text+0x4ca): undefined reference to `pitem_free'
d1_lib.c:(.text+0x4db): undefined reference to `pqueue_pop'
d1_lib.c:(.text+0x502): undefined reference to `pitem_free'
d1_lib.c:(.text+0x513): undefined reference to `pqueue_pop'
d1_lib.c:(.text+0x53a): undefined reference to `pitem_free'
d1_lib.c:(.text+0x54b): undefined reference to `pqueue_pop'
libssl.a(d1_lib.o): In function `dtls1_free':
d1_lib.c:(.text+0x6b4): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x6c5): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x6d6): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x6e7): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x6f8): undefined reference to `pqueue_free'
libssl.a(d1_lib.o): In function `dtls1_new':
d1_lib.c:(.text+0x786): undefined reference to `pqueue_new'
d1_lib.c:(.text+0x791): undefined reference to `pqueue_new'
d1_lib.c:(.text+0x79c): undefined reference to `pqueue_new'
d1_lib.c:(.text+0x7a7): undefined reference to `pqueue_new'
d1_lib.c:(.text+0x7b2): undefined reference to `pqueue_new'
d1_lib.c:(.text+0x824): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x836): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x848): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x85a): undefined reference to `pqueue_free'
d1_lib.c:(.text+0x86c): undefined reference to `pqueue_free'
libssl.a(d1_pkt.o): In function `dtls1_buffer_record':
d1_pkt.c:(.text+0x600): undefined reference to `pqueue_size'
d1_pkt.c:(.text+0x64e): undefined reference to `pitem_new'
d1_pkt.c:(.text+0x660): undefined reference to `pitem_free'
d1_pkt.c:(.text+0x733): undefined reference to `pqueue_insert'
d1_pkt.c:(.text+0x7d8): undefined reference to `pitem_free'
libssl.a(d1_pkt.o): In function `dtls1_get_record':
d1_pkt.c:(.text+0x13ab): undefined reference to `pqueue_peek'
d1_pkt.c:(.text+0x13d8): undefined reference to `pqueue_pop'
d1_pkt.c:(.text+0x13fe): undefined reference to `pitem_free'
d1_pkt.c:(.text+0x141d): undefined reference to `pqueue_pop'
d1_pkt.c:(.text+0x143f): undefined reference to `pitem_free'
d1_pkt.c:(.text+0x1478): undefined reference to `pqueue_peek'
libssl.a(d1_pkt.o): In function `dtls1_read_bytes':
d1_pkt.c:(.text+0x1a45): undefined reference to `pqueue_pop'
d1_pkt.c:(.text+0x1a67): undefined reference to `pitem_free'
libssl.a(d1_both.o): In function `dtls1_retransmit_message':
d1_both.c:(.text+0xefe): undefined reference to `pqueue_find'
libssl.a(d1_both.o): In function `dtls1_retransmit_buffered_messages':
d1_both.c:(.text+0x1173): undefined reference to `pqueue_iterator'
d1_both.c:(.text+0x117f): undefined reference to `pqueue_next'
d1_both.c:(.text+0x1194): undefined reference to `pqueue_next'
libssl.a(d1_both.o): In function `dtls1_send_change_cipher_spec':
d1_both.c:(.text+0x13c1): undefined reference to `pitem_new'
d1_both.c:(.text+0x13da): undefined reference to `pqueue_insert'
libssl.a(d1_both.o): In function `dtls1_clear_record_buffer':
d1_both.c:(.text+0x148a): undefined reference to `pitem_free'
d1_both.c:(.text+0x149b): undefined reference to `pqueue_pop'
libssl.a(d1_both.o): In function `dtls1_reassemble_fragment':
d1_both.c:(.text+0x15d1): undefined reference to `pqueue_find'
d1_both.c:(.text+0x18e4): undefined reference to `pitem_new'
d1_both.c:(.text+0x1905): undefined reference to `pqueue_insert'
libssl.a(d1_both.o): In function `dtls1_get_message_fragment':
d1_both.c:(.text+0x1976): undefined reference to `pqueue_peek'
d1_both.c:(.text+0x1c0d): undefined reference to `pqueue_pop'
d1_both.c:(.text+0x1c3a): undefined reference to `pitem_free'
d1_both.c:(.text+0x1cb2): undefined reference to `pqueue_find'
d1_both.c:(.text+0x1e0c): undefined reference to `pitem_new'
d1_both.c:(.text+0x1fab): undefined reference to `pitem_free'
d1_both.c:(.text+0x207b): undefined reference to `pqueue_insert'
libssl.a(d1_both.o): In function `dtls1_buffer_message':
d1_both.c:(.text+0x23e0): undefined reference to `pitem_new'
d1_both.c:(.text+0x23fd): undefined reference to `pqueue_insert'
libssl.a(ssl_rsa.o): In function `SSL_CTX_use_certificate_chain_file':
ssl_rsa.c:(.text+0x1055): undefined reference to `PEM_read_bio_X509_AUX'
collect2: ld returned 1 exit status

This is on a different Debian 64bit machine. OpenSSL freshly pulled from Github.

$ gcc ../heartleech/heartleech.c libssl.a libcrypto.a -ldl -lpthread -o heartleech -I./include
../heartleech/heartleech.c: In function ‘main’:
../heartleech/heartleech.c:3182:21: warning: passing argument 3 of ‘pthread_create’ from incompatible pointer type [enabled by default]
pthread_create(&handle, 0, (void()(void))run_scan, &args);
^
In file included from ../heartleech/heartleech.c:77:0:
/usr/include/pthread.h:244:12: note: expected ‘void * ()(void *)’ but argument is of type ‘void ()(void *)’
extern int pthread_create (pthread_t *__restrict __newthread,

This is an issue caused by the binary being compiled as a debug binary, not release. Had it been compiled as a release binary, it would require MSVCR100.DLL (note the absence of the D), which is the intended behavior and is contained in the VC++ 2010 redistributable.

This is fixable by simply packaging the DLL with the binary (which is how I made it work, since I only have VS2013, and the DLL comes with VS2010), or by recompiling the binary in release mode.

kali@kali:/openssl$ gcc ../heartleech/heartleech.c libssl.a libcrypto.a -ldl -lpthread -o heartleech -I./include
../heartleech/heartleech.c:111:2: error: #error You are using the wrong version of OpenSSL headers.
111 | #error You are using the wrong version of OpenSSL headers.
| ^~~~~
../heartleech/heartleech.c:263:12: error: field ‘n’ has incomplete type
263 | BIGNUM n;
| ^
../heartleech/heartleech.c:264:12: error: field ‘e’ has incomplete type
264 | BIGNUM e;
| ^
../heartleech/heartleech.c: In function ‘receive_heartbeat’:
../heartleech/heartleech.c:562:10: error: ‘TLS1_RT_HEARTBEAT’ undeclared (first use in this function)
562 | case TLS1_RT_HEARTBEAT:
| ^~~~~~~~~~~~~~~~~
../heartleech/heartleech.c:562:10: note: each undeclared identifier is reported only once for each function it appears in
../heartleech/heartleech.c: In function ‘rsa_gen’:
../heartleech/heartleech.c:762:12: error: array type has incomplete element type ‘BIGNUM’ {aka ‘struct bignum_st’}
762 | BIGNUM p1[1], q1[1], r[1];
| ^
../heartleech/heartleech.c:762:19: error: array type has incomplete element type ‘BIGNUM’ {aka ‘struct bignum_st’}
762 | BIGNUM p1[1], q1[1], r[1];
| ^~
../heartleech/heartleech.c:762:26: error: array type has incomplete element type ‘BIGNUM’ {aka ‘struct bignum_st’}
762 | BIGNUM p1[1], q1[1], r[1];
| ^
../heartleech/heartleech.c:764:5: warning: implicit declaration of function ‘BN_init’ [-Wimplicit-function-declaration]
764 | BN_init(p1);
| ^~~~~~~
../heartleech/heartleech.c:768:8: error: dereferencing pointer to incomplete type ‘RSA’ {aka ‘struct rsa_st’}
768 | rsa->p = BN_new();
| ^~
../heartleech/heartleech.c: At top level:
../heartleech/heartleech.c:819:31: error: parameter 1 (‘n’) has incomplete type
819 | find_private_key(const BIGNUM n, const BIGNUM e,
| ~~~~~~~~~~~~~^
../heartleech/heartleech.c:819:47: error: parameter 2 (‘e’) has incomplete type
819 | find_private_key(const BIGNUM n, const BIGNUM e,
| ~~~~~~~~~~~~~^
../heartleech/heartleech.c: In function ‘find_private_key’:
../heartleech/heartleech.c:825:12: error: storage size of ‘p’ isn’t known
825 | BIGNUM p;
| ^
../heartleech/heartleech.c:826:12: error: storage size of ‘q’ isn’t known
826 | BIGNUM q;
| ^
../heartleech/heartleech.c:827:12: error: storage size of ‘remainder’ isn’t known
827 | BIGNUM remainder;
| ^~~~~~~~~
../heartleech/heartleech.c: At top level:
../heartleech/heartleech.c:906:22: error: parameter 4 (‘n’) has incomplete type
906 | BIGNUM n, BIGNUM e)
| ~~~~~~~^
../heartleech/heartleech.c:906:32: error: parameter 5 (‘e’) has incomplete type
906 | BIGNUM n, BIGNUM e)
| ~~~~~~~^
../heartleech/heartleech.c: In function ‘parse_cert’:
../heartleech/heartleech.c:973:25: error: dereferencing pointer to incomplete type ‘EVP_PKEY’ {aka ‘struct evp_pkey_st’}
973 | if (rsakey && rsakey->type == 6) {
| ^~
../heartleech/heartleech.c:975:35: error: dereferencing pointer to incomplete type ‘BIGNUM’ {aka ‘struct bignum_st’}
975 | memcpy(modulus, n, sizeof(*modulus));
| ^~~~~~~~
../heartleech/heartleech.c: In function ‘ssl_thread’:
../heartleech/heartleech.c:2057:12: error: dereferencing pointer to incomplete type ‘SSL’ {aka ‘struct ssl_st’}
2057 | if (ssl->tlsext_heartbeat != 1) {
| ^~
../heartleech/heartleech.c:2154:31: error: ‘TLS1_RT_HEARTBEAT’ undeclared (first use in this function)
2154 | ssl3_write_bytes(ssl, TLS1_RT_HEARTBEAT,
| ^~~~~~~~~~~~~~~~~
../heartleech/heartleech.c: In function ‘process_offline_file’:
../heartleech/heartleech.c:2344:12: error: storage size of ‘n’ isn’t known
2344 | BIGNUM n;
| ^
../heartleech/heartleech.c:2345:12: error: storage size of ‘e’ isn’t known
2345 | BIGNUM e;
| ^
../heartleech/heartleech.c: In function ‘main’:
../heartleech/heartleech.c:3142:5: warning: implicit declaration of function ‘CRYPTO_malloc_init’; did you mean ‘CRYPTO_malloc’? [-Wimplicit-function-declaration]
3142 | CRYPTO_malloc_init();
| ^~~~~~~~~~~~~~~~~~
| CRYPTO_malloc