
IDA Pro plugin to examine the glibc heap, focused on exploit development
An IDA Pro plugin to examine the heap, focused on exploit development.
Currently supports the glibc malloc implementation (ptmalloc2).
3rd place winner of the 2018 Hex-Rays Plugin Contest
Just drop the heap_viewer.py file and the heap_viewer folder into IDA's plugin directory.
To install just for the current user, copy the files into one of these directories:
| OS | Plugin path |
|---|---|
| Linux/macOS | ~/.idapro/plugins |
| Windows | %AppData%\Hex-Rays\IDA Pro\plugins |
Currently the plugin does not require to be configured, since it tries to obtain automatically the necessary offsets to analyze the heap.
However, in case the plugin fails, it is possible to set the different offsets in the configuration tab. To obtain these offsets, you can use any of the tools located in the utils folder.
If you find any inconsistency, let me know :)
Tracer

Arena & chunk info

Tcache entries

Bins

Bin graph

Fastbin graph

Tcache graph

Find fake fastbin

Unlink merge info

Useful libc offsets

I'd recommend the following resources alongside this tool for learning heap exploiting.
Special mention to my colleagues soez, wagiro and DiaLluvioso for give me some ideas during the development of the plugin. And of course, the @pwndbg project, from which I picked up some things about heap parsing.
Any comment, issue or pull request will be highly appreciated :-)