mallocng
usage: mallocng [-h]
{explain,dump,vis,find,ctx,metaarea,ma,group,meta,slots,slotu}
...
Utility for inspecting the mallocng (musl) allocator.
Alias: ng
Positional arguments
| Positional Argument | Help |
| command | |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
mallocng explain
usage: mallocng explain [-h]
Gives a quick explanation of musl's mallocng allocator.
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
mallocng dump
usage: mallocng dump [-h] [-ma META_AREA]
Dump the mallocng heap.
Since the command may produce lots of output, you may want to pipe it to less with | ng-dump | less -R.
The [index] next to the metas is their index in the doubly linked list pointed to by ctx.freed_meta_head. The [index] next to the slots is the slot's index inside of its group (thus, these will always be sequential).
Notice that the pointers in the output of this command aren't colored according to their mapping's color but rather according to the object's allocation status. Color legend: allocated; freed; available.
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
| -ma | --meta-area | Dump only the meta area at the provided address. |
mallocng vis
usage: mallocng vis [-h] address [count]
Visualize slots in a group.
Positional arguments
| Positional Argument | Help |
| address | Address which is inside some slot. |
| count | The amount of slots to visualize. (default: 10) |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
mallocng find
usage: mallocng find [-h] [-a] [-m] [-s] address
Find slot which contains the given address.
Returns the start of the slot. We say a slot 'contains' an address if the address is in [start, start + stride).
Positional arguments
| Positional Argument | Help |
| address | The address to look for. |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
| -a | --all | Print out all information. Including meta and group data. |
| -m | --metadata | If the given address falls onto some in-band metadata, return the slot which owns that metadata. In other words, the containment check becomes [start - IB, end). |
| -s | --shallow | Return the biggest slot which contains this address, don't recurse for smaller slots. The group which owns this slot will not be a nested group. |
mallocng ctx
usage: mallocng ctx [-h] [address]
Print out the mallocng __malloc_context (ctx) object.
Positional arguments
| Positional Argument | Help |
| address | Use the provided address instead of the one Pwndbg found. |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
usage: mallocng metaarea [-h] [-i INDEX] address
Print out a mallocng meta_area object at the given address.
Alias: ma
Positional arguments
| Positional Argument | Help |
| address | The address of the meta_area object. |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
| -i | --index | Print address of meta at given index (0-indexed). |
mallocng group
usage: mallocng group [-h] [-i INDEX] address
Print out information about a mallocng group at the given address.
Positional arguments
| Positional Argument | Help |
| address | The address of the group object. |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
| -i | --index | Print start address of slot at given index (0-indexed). |
usage: mallocng meta [-h] address
Print out information about a mallocng group given the address of its meta.
Positional arguments
| Positional Argument | Help |
| address | The address of the meta object. |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
mallocng slots
usage: mallocng slots [-h] [-a] address
Dump information about a mallocng slot, given its start address.
Positional arguments
| Positional Argument | Help |
| address | The start of the slot (not including IB). |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
| -a | --all | Print out all information. Including meta and group data. |
mallocng slotu
usage: mallocng slotu [-h] [-a] address
Dump information about a mallocng slot, given its user address.
Positional arguments
| Positional Argument | Help |
| address | The start of user memory. Referred to as p in the source. |
Optional arguments
| Short | Long | Help |
| -h | --help | show this help message and exit |
| -a | --all | Print out all information. Including meta and group data. |