Don't like this style? Click here to change it! blue.css

Welcome .... Click here to logout

Heap Recap

OK just a reminder of everything:

The Vulnerabilities:

The bins (linked lists)

tcache bins

There are 64 of these (per thread) of size 0x20 up to size 0x410, each bin is a singly linked list

The linked lists are LIFO Last-in-First-out

There are also 64 counts at the top of each tcache struct which store how many chunks are in each bin

Once there are 7 chunks in a bin there will be no more added. Other things freed will go to fastbins or unsorted bin


There are 8 fastbins sized 0x20 to 0x90

They are stored in the main_arena

They are singly linked lists from main_arena to chunk to chunk etc

There is no limit to the number of chunks in a fastbin

BUT to fight fragmentation

they consolidate neighboring chunks and throw them into the unsorted bin now and again.

They also fill the tcache when possible.

The fastbin addresses are 16 bytes before the userdata.

Fastbins have two security checks:

Unsorted bin

doubly linked circular linked list from main_arena + 96 to chunk to chunk

Staging area for later sorting

After sorting the bins get put into Small or Large bins

We haven't dived too deeply into these yet.


Solidify our basics

After some office hours sessions I decided I needed to do a step-by-step of the tcache poisoning baseline.

I think the rough outline is there but maybe not the mechanics. So let's do this with a simple diagraming:

Head30->A->B is a way of saying this 0x30 chain points at A which points at B.