ptmalloc2_tracking ¤

Heap Tracking

This module implements runtime tracking of the heap, allowing pwndbg to detect heap related misbehavior coming from an inferior in real time, which lets us catch UAF bugs, double frees (and more), and report them to the user.

Approach¤

The approach used starting with using breakpoints to hook into the following libc symbols: malloc, free, calloc, and realloc. Each hook has a reference to a shared instance of the Tracker class, which is responsible for handling the tracking of the chunks of memory from the heap.

The tracker keeps two sorted maps of chunks, for freed and in use chunks, keyed by their base address. Newly allocated chunks are added to the map of in use chunks right before an allocating call returns, and newly freed chunks are moved from the map of in use chunks to the map of free ones right before a freeing call returns. The tracker is also responsible for installing watchpoints for free chunks when they're added to the free chunk map and deleting them when their corresponding chunks are removed from the map.

Additionally, because going through the data structures inside of libc to determine whether a chunk is free or not is, more often than not, a fairly slow operation, this module will only do so when it determines its view of the chunks has diverged from the one in libc in a way that would affect behavior. When such a diffence is detected, this module will rebuild the chunk maps in the range it determines to have been affected.

Currently, the way it does this is by deleting and querying from libc the new status of all chunks that overlap the region of a new allocation when it detects that allocation overlaps chunks it previously considered free.

This approach lets us avoid a lot of the following linked lists that comes with trying to answer the allocation status of a chunk, by keeping at hand as much known-good information as possible about them. Keep in mind that, although it is much faster than going to libc every time we need to know the allocation status of a chunk, this approach does have drawbacks when it comes to memory usage.

Compatibility¤

Currently module assumes the inferior is using GLibc.

There are points along the code in this module where the assumptions it makes are explicitly documented and checked to be valid for the current inferior, so that it may be immediately clear to the user that something has gone wrong if they happen to not be valid. However, be aware that there may be assumptions that were not made explicit.

Classes:

• FreeChunkWatchpoint –
• AllocChunkWatchpoint –
• Chunk –
• Tracker –
• MallocEnterBreakpoint –
• CallocEnterBreakpoint –
• AllocExitBreakpoint –
• ReallocEnterBreakpoint –
• ReallocExitBreakpoint –
• FreeEnterBreakpoint –
• FreeExitBreakpoint –

Functions:

• is_enabled –

  Whether the heap tracker in enabled.

• resolve_address –

  Checks whether a given symbol is available and part of libc, and returns its

• get_chunk –

  Reads a chunk from a given address.

• in_program_code_stack –
• install –
• uninstall –

Attributes:

• LIBC_NAME –
• MALLOC_NAME –
• CALLOC_NAME –
• REALLOC_NAME –
• FREE_NAME –
• last_issue (str | None) –
• PRINT_DEBUG –
• DEFERED_DELETE (list[Breakpoint]) –
• malloc_enter –
• calloc_enter –
• realloc_enter –
• free_enter –
• stop_on_error –

LIBC_NAME = 'libc.so.6'

MALLOC_NAME = 'malloc'

CALLOC_NAME = 'calloc'

REALLOC_NAME = 'realloc'

FREE_NAME = 'free'

last_issue: str | None = None

PRINT_DEBUG = False

DEFERED_DELETE: list[Breakpoint] = []

malloc_enter = None

calloc_enter = None

realloc_enter = None

free_enter = None

stop_on_error = True

FreeChunkWatchpoint(chunk: Chunk, tracker: Tracker)

chunk = chunk

tracker = tracker

stop()

AllocChunkWatchpoint(chunk: Chunk)

chunk = chunk

stop() -> bool

Chunk(address: int, size: int, requested_size: int, flags: int)

address = address

size = size

requested_size = requested_size

flags = flags

Tracker()

free_chunks: SortedDict[int, Chunk] = SortedDict()

alloc_chunks: SortedDict[int, Chunk] = SortedDict()

free_watchpoints: dict[int, FreeChunkWatchpoint] = {}

memory_management_calls: dict[int, bool] = {}

is_performing_memory_management()

enter_memory_management(name: str) -> None

exit_memory_management() -> None

malloc(chunk: Chunk) -> None

free(address: int) -> bool

MallocEnterBreakpoint(address, tracker)

tracker = tracker

stop() -> bool

CallocEnterBreakpoint(address, tracker)

tracker = tracker

stop() -> bool

AllocExitBreakpoint(tracker, requested_size, name)

requested_size = requested_size

tracker = tracker

name = name

stop() -> bool

out_of_scope() -> None

ReallocEnterBreakpoint(address, tracker)

tracker = tracker

stop() -> bool

ReallocExitBreakpoint(tracker, freed_ptr, requested_size)

freed_ptr = freed_ptr

requested_size = requested_size

tracker = tracker

stop()

out_of_scope() -> None

FreeEnterBreakpoint(address, tracker)

tracker = tracker

stop() -> bool

FreeExitBreakpoint(tracker, ptr)

ptr = ptr

tracker = tracker

stop()

out_of_scope() -> None

is_enabled() -> bool

resolve_address(name: str) -> int | None

get_chunk(address, requested_size)

in_program_code_stack() -> bool

install(disable_hardware_watchpoints=True) -> None

uninstall() -> None