mallocng ¤

Bases: Enum

Attributes:

• ALLOCATED –
• FREED –
• AVAIL –

ALLOCATED = 'allocated'

FREED = 'freed'

AVAIL = 'available'

A group is an array of slots.

https://elixir.bootlin.com/musl/v1.2.5/source/src/malloc/mallocng/meta.h#L17 struct group { struct meta *meta; unsigned char active_idx:5; char pad[UNIT - sizeof(struct meta *) - 1]; unsigned char storage[]; };

Methods:

• preload –

  Read all the necessary process memory to populate the group's

• set_meta –

  Sets the meta object for this group.

• at_index –

  Get the address of the slot at index idx.

Attributes:

• addr –
• meta (Meta) –

  Raises:

• active_idx (int) –

  Raises:

• storage (int) –
• group_size (int) –

  The size of this group, in bytes.

addr = addr

meta: Meta

active_idx: int

storage: int

group_size: int

preload() -> None

set_meta(meta: Meta) -> None

at_index(idx: int) -> int

The "unit of allocation" (analogous to glibc's "chunk"). There is no struct in the source code that describes it.

Methods:

• preload –

  Read all the necessary process memory to populate the slot's

• preload_meta_dependants –

  Preloads all fields that depend on a sane meta.

• is_cyclic –

  Returns whether mallocng reports that p != start.

• contains_group –

  Does this slot nest a group?

• set_group –

  If the slot is FREED or AVAIL, it is impossible for it to

• from_p –
• from_start –

Attributes:

• p (int) –
• offset (int) –

  Raises:

• pn3 (int) –

  Raises:

• idx (int) –

  Raises:

• reserved_in_header (int) –
• big_offset_check (int) –

  Raises:

• start (int) –

  Raises:

• cyclic_offset (int) –

  Returns zero if is_cyclic() is False.

• startn3 (int) –

  Raises:

• reserved_in_footer (int) –

  Returns -1 if the value is invalid, i.e.

• end (int) –

  Raises:

• reserved (int) –

  Returns 0 if reserved_in_header() == 6.

• nominal_size (int) –

  Raises:

• user_size (int) –

  Raises:

• slack (int) –

  Raises:

• group (Group) –
• meta (Meta) –

  Raises:

• slot_state (SlotState) –

p: int = p

offset: int

pn3: int

idx: int

reserved_in_header: int

big_offset_check: int

start: int

cyclic_offset: int

startn3: int

reserved_in_footer: int

end: int

reserved: int

nominal_size: int

user_size: int

slack: int

group: Group

meta: Meta

slot_state: SlotState

preload() -> None

preload_meta_dependants() -> None

is_cyclic() -> int

contains_group() -> bool

set_group(group: Group) -> None

from_p(p: int) -> 'Slot'

from_start(start: int) -> 'Slot'

This is not a mallocng concept, this is a pwndbg abstraction.

A Slot object uses its inband metadata to recover all its fields and uncover more information about itself by locating its group and meta. It works essentially the same way mallocng's free() works.

However, if a slot is freed or available, most of its in-band metadata will be invalid and it will not be able to recover group and meta. But, given the start of the slot, we can infer which group it belongs to and what its index is by walking allocator state i.e. ctx i.e. by using Mallocng.find_slot().

A GroupedSlot then describes all information we can glean about a slot which is described by a (group, idx) pair. Many of its fields can be completely different from a Slot at the same location. They are guaranteed to be the same only if the slot is ALLOCATED and hasn't been corrupted.

Not all fields that are available in Slot are available in GroupedSlot.

Make sure the group you are passing to the constructor points to a valid meta object.

Attributes:

• group –
• meta –
• idx –
• stride –
• slot_state –
• start –
• end –

group = group

meta = meta

idx = idx

stride = stride

slot_state = slotstate_at_index(idx)

start = storage + stride * idx

end = start + stride - IB

The metadata of a group.

https://elixir.bootlin.com/musl/v1.2.5/source/src/malloc/mallocng/meta.h#L24 struct meta { struct meta *prev, *next; struct group *mem; volatile int avail_mask, freed_mask; uintptr_t last_idx:5; uintptr_t freeable:1; uintptr_t sizeclass:6; uintptr_t maplen:8*sizeof(uintptr_t)-12; };

Methods:

• preload –

  Read all the necessary process memory to populate the meta's

• parent_group –

  If this group is nested, returns the address of the group which

• root_group –

  Returns the topmost/biggest parent group. It will never be a nested

• slotstate_at_index –
• sizeof –

Attributes:

• addr (int) –
• prev (int) –

  Raises:

• next (int) –

  Raises:

• mem (int) –

  Raises:

• avail_mask (int) –

  Raises:

• freed_mask (int) –

  Raises:

• last_idx (int) –

  Raises:

• freeable (int) –

  Raises:

• sizeclass (int) –

  Raises:

• maplen (int) –

  Raises:

• stride (int) –

  Returns -1 if sizeclass >= len(size_classes).

• cnt (int) –

  Number of slots in the group.

• is_donated (bool) –

  Returns whether the group object referred to by this meta has been

• is_mmaped (bool) –

  Returns whether the group object referred to by this meta has been

• is_nested (bool) –

  Returns whether the group object referred to by this meta has been

addr: int = addr

prev: int

next: int

mem: int

avail_mask: int

freed_mask: int

last_idx: int

freeable: int

sizeclass: int

maplen: int

stride: int

cnt: int

is_donated: bool

is_mmaped: bool

is_nested: bool

preload() -> None

parent_group() -> int

root_group() -> Group

slotstate_at_index(idx: int) -> SlotState

sizeof() -> int

Slabs that contain metas, linked in a singly-linked list.

https://elixir.bootlin.com/musl/v1.2.5/source/src/malloc/mallocng/meta.h#L34 struct meta_area { uint64_t check; struct meta_area *next; int nslots; struct meta slots[]; };

Methods:

• load –
• at_index –

  Returns the address of the meta object located

Attributes:

• addr (int) –
• check (int) –
• meta_area (int) –
• nslots (int) –
• slots (int) –
• area_size (int) –

  Returns not the size of struct meta_area but rather

addr: int = addr

check: int = 0

meta_area: int = 0

nslots: int = 0

slots: int = 0

area_size: int

load() -> None

at_index(idx: int) -> int

The global object that holds all allocator state.

https://elixir.bootlin.com/musl/v1.2.5/source/src/malloc/mallocng/meta.h#L41 struct malloc_context { uint64_t secret;

ifndef PAGESIZE¤

size_t pagesize;

endif¤

int init_done; unsigned mmap_counter; struct meta *free_meta_head; struct meta *avail_meta; size_t avail_meta_count, avail_meta_area_count, meta_alloc_shift; struct meta_area *meta_area_head, *meta_area_tail; unsigned char *avail_meta_areas; struct meta *active[48]; size_t usage_by_class[48]; uint8_t unmap_seq[32], bounces[32]; uint8_t seq; uintptr_t brk; };

Methods:

• load –
• looks_valid –

  Returns true if this object looks like a valid struct malloc_context object

Attributes:

• addr (int) –
• secret (int) –
• pagesize (int) –
• init_done (int) –
• mmap_counter (int) –
• free_meta_head (int) –
• avail_meta (int) –
• avail_meta_count (int) –
• avail_meta_area_count (int) –
• meta_alloc_shift (int) –
• meta_area_head (int) –
• meta_area_tail (int) –
• avail_meta_areas (int) –
• active (list[int]) –
• usage_by_class (list[int]) –
• unmap_seq (list[int]) –
• bounces (list[int]) –
• seq (int) –
• brk (int) –
• sizeof (int) –
• has_pagesize_field (bool) –

addr: int = addr

secret: int = 0

pagesize: int = 0

init_done: int = 0

mmap_counter: int = 0

free_meta_head: int = 0

avail_meta: int = 0

avail_meta_count: int = 0

avail_meta_area_count: int = 0

meta_alloc_shift: int = 0

meta_area_head: int = 0

meta_area_tail: int = 0

avail_meta_areas: int = 0

active: list[int] = []

usage_by_class: list[int] = []

unmap_seq: list[int] = []

bounces: list[int] = []

seq: int = 0

brk: int = 0

sizeof: int = 0

has_pagesize_field: bool = False

load() -> None

looks_valid() -> bool

Bases: MemoryAllocator

Tracks the allocator state. By leveraging the __malloc_context symbol.

Import this singleton class like: from pwndbg.aglib.heap.mallocng import mallocng as ng

and make sure that you have run ng.init_if_needed() before you used the object.

Methods:

• init_if_needed –

  We want this class to be a singleton, but also we can't

• set_ctx_addr –

  Find where the __malloc_context global symbol is. Try using debug information,

• libc_has_debug_syms –
• find_slot –

  Get the slot which contains this address.

• containing –

  Same as find_slot() but returns only the start address of the slot, or zero

• get_free_metas –

  Get all free metas by traversing the ctx.free_meta_head doubly

• meta_is_avail –

  Checks whether a meta is available.

• is_initialized –

  Returns whether the allocator is initialized or not.

Attributes:

• finished_init (bool) –
• ctx_addr (int) –
• ctx (MallocContext | None) –
• has_debug_syms (bool) –

finished_init: bool = False

ctx_addr: int = 0

ctx: MallocContext | None = None

has_debug_syms: bool = False

init_if_needed() -> bool

set_ctx_addr() -> None

libc_has_debug_syms() -> bool

find_slot(
    address: int, metadata: bool = False, shallow: bool = False
) -> tuple[GroupedSlot | None, Slot | None]

containing(address: int, metadata: bool = False, shallow: bool = False) -> int

get_free_metas() -> dict[int, tuple[int, Meta]]

meta_is_avail(addr: int) -> bool

is_initialized() -> bool