nccgroup/libdlmallocHeap analysis tooling for dlmalloc
libdlmalloc 是一个设计用于与 GDB 配合使用的 python 脚本，可用于分析 Doug Lea 分配器（又名 dlmalloc）。它目前支持 dlmalloc 2.8.x 版本。请注意，某些部分也可以独立于 GDB 使用，例如对某些快照的堆内存进行离线分析。
libdlmalloc 的灵感来源于其他用于分析堆的 gdb python 脚本，例如 libtalloc、unmask_jemalloc 和 libheap。某些基本功能与这些项目几乎完全相同。
libdlmalloc 主要在 32 位和 64 位 Cisco ASA 设备上进行了测试，这些设备使用 dlmalloc 2.8.3。它应该可以与其他 2.8.x 版本一起使用，但由于存在显著差异，它无法在更早的版本（例如 <= 2.7.x）上运行。
如果你在某个特定的 2.8.x 版本或特定设备上成功测试了 libdlmalloc，请告知作者，我们将更新文档。
该脚本只需要一个相对较新的、支持 python3 的 GDB 版本。我们主要是在 python3 上测试的，因此预计它在 python2.7 上目前会出问题。
如果你想使用 gdb 命令，可以使用：``` (gdb) source libdlmalloc_28x.py
大部分核心逻辑被拆分到了 `dl_helper` 类中，使你可以直接导入 libdlmalloc 并在 GDB 会话之外访问某些重要的结构体。如果你想离线分析 chunk/堆快照，这会非常有用。
# 用法
大部分功能都模仿了 unmask_jemalloc 和 libtalloc 中的做法，即提供一个独立的 GDB 命令。不过我们也使用了相当多的开关选项。
要查看当前支持的命令的完整列表，可以使用 `dlhelp` 命令：
## dlhelp
这是用于查看可用命令的主函数。每个命令都支持 `-h` 选项，通过该选项你可以获得更详细的使用说明。```
(gdb) dlhelp
[libdlmalloc] dlmalloc commands for gdb
[libdlmalloc] dlchunk : show one or more chunks metadata and contents
[libdlmalloc] dlmstate : print mstate structure information. caches address after first use
[libdlmalloc] dlcallback : register a callback or query/modify callback status
[libdlmalloc] dlhelp : this help message
[libdlmalloc] NOTE: Pass -h to any of these commands for more extensive usage. Eg: dlchunk -h
dlchunk 可以为你提供某个块的摘要，或更详细的
每个字段的信息。你还可以使用它列出关于
多个块的信息、搜索块等。dlchunk 的用法如下所示：```
(gdb) dlchunk -h
[libdlmalloc] usage: dlchunk [-v] [-f] [-x] [-c ]
[libdlmalloc] a dlmalloc chunk header
[libdlmalloc] -v use verbose output (multiples for more verbosity)
[libdlmalloc] -f use explicitly, rather than be smart
[libdlmalloc] -x hexdump the chunk contents
[libdlmalloc] -m max bytes to dump with -x
[libdlmalloc] -c number of chunks to print
[libdlmalloc] -s search pattern when print chunks
[libdlmalloc] --depth depth to search inside chunk
[libdlmalloc] -d debug and force printing stuff
[libdlmalloc] Flag legend: C=CINUSE, P=PINUSE
基本输出如下：```
(gdb) dlchunk 0xacff59d0
0xacff59d0 M sz:0x000f8 fl:CP
如你所见，你需要给它实际 dlmalloc 元数据本身的地址。要获得更详细的输出，可以使用 -v。```
(gdb) dlchunk -v 0xacff59d0
struct malloc_chunk @ 0xacff59d0 {
prev_foot = 0x8140d4d0
size = 0xf8 (CINUSE|PINUSE)
您还可以使用 `-c <count>` 选项列出多个相邻的块。```
(gdb) dlchunk -c 2 0xacff59d0
0xacff59d0 M sz:0x000f8 fl:CP
0xacff5ac8 M sz:0x00270 fl:CP
(gdb) dlchunk -v -c 2 0xacff59d0
struct malloc_chunk @ 0xacff59d0 {
prev_foot = 0x8140d4d0
size = 0xf8 (CINUSE|PINUSE)
--
struct malloc_chunk @ 0xacff5ac8 {
prev_foot = 0x8140d4d0
size = 0x270 (CINUSE|PINUSE)
-x 转储数据块的十六进制内容，
并使用 -m 控制要转储的字节数。```
(gdb) dlchunk -v -x -m 16 -c 2 0xacff59d0
struct malloc_chunk @ 0xacff59d0 {
prev_foot = 0x8140d4d0
size = 0xf8 (CINUSE|PINUSE)
0x10 bytes of chunk data:
0xacff59d8: 0xa11c0123 0x000000cc 0x00000000 0x00000000struct malloc_chunk @ 0xacff5ac8 { prev_foot = 0x8140d4d0 size = 0x270 (CINUSE|PINUSE) 0x10 bytes of chunk data: 0xacff5ad0: 0xa11c0123 0x00000244 0x00000000 0x00000000
您还可以在块内进行搜索。让我们在 2 个块中搜索该值
`0x00000244`，如上所述，该值仅出现在第二个块中。```
(gdb) dlchunk -s 0x00000244 -c 2 0xacff59d0
0xacff59d0 M sz:0x000f8 fl:CP [NO MATCH]
0xacff5ac8 M sz:0x00270 fl:CP [MATCH]
所搜索块数内的所有匹配项都将显示。让我们搜索 0xa11c01123，我们上面看到它同时存在于两个块中：```
(gdb) dlchunk -s 0xa11c0123 -c 2 0xacff59d0
0xacff59d0 M sz:0x000f8 fl:CP [MATCH]
0xacff5ac8 M sz:0x00270 fl:CP [MATCH]
## dlmstate
`dlmstate` 命令可用于分析用于管理独立 dlmalloc 堆（若以 `MSPACES` 编译，则称为 mspace）的 `mstate` 结构。您可以通过 `-h` 开关查看该命令的用法。```
(gdb) dlmstate -h
[libdlmalloc] usage: dlmstate [-v] [-f] [-x] [-c <count>] <addr>
[libdlmalloc] <addr> a mstate struct addr. Optional if mstate cached
[libdlmalloc] -v use verbose output (multiples for more verbosity)
[libdlmalloc] -c print bin counts
[libdlmalloc] --depth how deep to count each bin (default 10)
[libdlmalloc] NOTE: Last defined mstate will be cached for future use
如果你知道保存 mstate 的地址（通常是第一个 malloc 段中的第一个 chunk），可以将其传递给 dlmstate：``` (gdb) dlmstate 0xa8400008 struct dl_mstate @ 0xa8400008 { smallmap = 0b000000000000010000011111111100 treemap = 0b000000000000000000000000000111 dvsize = 0x0 topsize = 0x2ebdf040 least_addr = 0xa8400000 dv = 0x0 top = 0xad020f90 trim_check = 0x200000 magic = 0x2900d4d8 smallbin[00] (sz 0x0) = 0xa840002c, 0xa840002c [EMPTY] smallbin[01] (sz 0x8) = 0xa8400034, 0xa8400034 [EMPTY] smallbin[02] (sz 0x10) = 0xacbf7ad0, 0xa88647f0 smallbin[03] (sz 0x18) = 0xa95059b8, 0xa9689a20 smallbin[04] (sz 0x20) = 0xac79a028, 0xa87206f8 smallbin[05] (sz 0x28) = 0xacff0120, 0xa948a0f8 smallbin[06] (sz 0x30) = 0xac4e4af8, 0xacb56878 smallbin[07] (sz 0x38) = 0xacfe3880, 0xacfe0df0 smallbin[08] (sz 0x40) = 0xa9509b28, 0xa9509b28 smallbin[09] (sz 0x48) = 0xa8a1dc80, 0xa8a1dc80 smallbin[10] (sz 0x50) = 0xac782cb0, 0xac782cb0 smallbin[11] (sz 0x58) = 0xacbf7a88, 0xacbf7a88 [EMPTY] smallbin[12] (sz 0x60) = 0xac782c00, 0xac782c00 [EMPTY] smallbin[13] (sz 0x68) = 0xacbf7a78, 0xacbf7a78 [EMPTY] smallbin[14] (sz 0x70) = 0xa89b9650, 0xa89b9650 [EMPTY] smallbin[15] (sz 0x78) = 0xac789828, 0xac789828 [EMPTY] smallbin[16] (sz 0x80) = 0xa89b9738, 0xa94af740 smallbin[17] (sz 0x88) = 0xac4e5700, 0xac4e5700 [EMPTY] smallbin[18] (sz 0x90) = 0xac788030, 0xac788030 [EMPTY] smallbin[19] (sz 0x98) = 0xac782bc8, 0xac782bc8 [EMPTY] smallbin[20] (sz 0xa0) = 0xa89b9718, 0xa89b9718 [EMPTY] smallbin[21] (sz 0xa8) = 0xa8a1dc20, 0xa8a1dc20 [EMPTY] smallbin[22] (sz 0xb0) = 0xac782af8, 0xac782af8 [EMPTY] smallbin[23] (sz 0xb8) = 0xac789ed0, 0xac789ed0 [EMPTY] smallbin[24] (sz 0xc0) = 0xacbf7a20, 0xacbf7a20 [EMPTY] smallbin[25] (sz 0xc8) = 0xac789940, 0xac789940 [EMPTY] smallbin[26] (sz 0xd0) = 0xac789eb8, 0xac789eb8 [EMPTY] smallbin[27] (sz 0xd8) = 0xa94af6e8, 0xa94af6e8 [EMPTY] smallbin[28] (sz 0xe0) = 0xacbf78e8, 0xacbf78e8 [EMPTY] smallbin[29] (sz 0xe8) = 0xac4e4e68, 0xac4e4e68 [EMPTY] smallbin[30] (sz 0xf0) = 0xac4e5780, 0xac4e5780 [EMPTY] smallbin[31] (sz 0xf8) = 0xac7880b0, 0xac7880b0 [EMPTY] treebin[00] (sz 0x180) = 0xac783cb0 treebin[01] (sz 0x200) = 0xac789dc0 treebin[02] (sz 0x300) = 0xa883db48 treebin[03] (sz 0x400) = 0x0 [EMPTY] treebin[04] (sz 0x600) = 0x0 [EMPTY] treebin[05] (sz 0x800) = 0x0 [EMPTY] treebin[06] (sz 0xc00) = 0x0 [EMPTY] treebin[07] (sz 0x1000) = 0x0 [EMPTY] treebin[08] (sz 0x1800) = 0x0 [EMPTY] treebin[09] (sz 0x2000) = 0x0 [EMPTY] treebin[10] (sz 0x3000) = 0x0 [EMPTY] treebin[11] (sz 0x4000) = 0x0 [EMPTY] treebin[12] (sz 0x6000) = 0x0 [EMPTY] treebin[13] (sz 0x8000) = 0x0 [EMPTY] treebin[14] (sz 0xc000) = 0x0 [EMPTY] treebin[15] (sz 0x10000) = 0x0 [EMPTY] treebin[16] (sz 0x18000) = 0x0 [EMPTY] treebin[17] (sz 0x20000) = 0x0 [EMPTY] treebin[18] (sz 0x30000) = 0x0 [EMPTY] treebin[19] (sz 0x40000) = 0x0 [EMPTY] treebin[20] (sz 0x60000) = 0x0 [EMPTY] treebin[21] (sz 0x80000) = 0x0 [EMPTY] treebin[22] (sz 0xc0000) = 0x0 [EMPTY] treebin[23] (sz 0x100000) = 0x0 [EMPTY] treebin[24] (sz 0x180000) = 0x0 [EMPTY] treebin[25] (sz 0x200000) = 0x0 [EMPTY] treebin[26] (sz 0x300000) = 0x0 [EMPTY] treebin[27] (sz 0x400000) = 0x0 [EMPTY] treebin[28] (sz 0x600000) = 0x0 [EMPTY] treebin[29] (sz 0x800000) = 0x0 [EMPTY] treebin[30] (sz 0xc00000) = 0x0 [EMPTY] treebin[31] (sz 0xffffffff) = 0x0 [EMPTY] footprint = 0x33800000 max_footprint = 0x33800000 mflags = 0x7 mutex = 0x0,0x0,0x0,0x0,0xa8400000, seg = struct malloc_segment @ 0xa84001d4 { base = 0xa8400000 size = 0x33800000 next = 0x0 sflags = 0x8
为了在较慢的设备上加快输出速度，我们缓存所读取的最后 mstate 数据，
因此，如果你再次运行 dlmstate，你将看到之前转储的输出
(当然可能是过期的)。```
(gdb) dlmstate
[libdlmalloc] Using cached mstate
struct dl_mstate @ 0xa8400008 {
smallmap = 0b000000000000010000011111111100
treemap = 0b000000000000000000000000000111
dvsize = 0x0
topsize = 0x2ebdf040
least_addr = 0xa8400000
dv = 0x0
top = 0xad020f90
trim_check = 0x200000
magic = 0x2900d4d8
smallbin[00] (sz 0x0) = 0xa840002c, 0xa840002c [EMPTY]
smallbin[01] (sz 0x8) = 0xa8400034, 0xa8400034 [EMPTY]
smallbin[02] (sz 0x10) = 0xacbf7ad0, 0xa88647f0
smallbin[03] (sz 0x18) = 0xa95059b8, 0xa9689a20
[...]
-c 开关可用于统计给定 bin 中的 chunk 数量。请注意，如果你通过串行线路进行调试，这可能非常慢，因此我们还提供了 --depth 选项来限制要统计的 bin 条目数量。默认情况下，depth 设置为 10：```
(gdb) dlmstate -c
[libdlmalloc] Using cached mstate
smallbin[00] (sz 0x0) = 0xa840002c, 0xa840002c [EMPTY] smallbin[01] (sz 0x8) = 0xa8400034, 0xa8400034 [EMPTY] smallbin[02] (sz 0x10) = 0xacbf7ad0, 0xa88647f0 [10+] smallbin[03] (sz 0x18) = 0xa95059b8, 0xa9689a20 [10+] smallbin[04] (sz 0x20) = 0xac79a028, 0xa87206f8 [10+] smallbin[05] (sz 0x28) = 0xacff0120, 0xa948a0f8 [10+] smallbin[06] (sz 0x30) = 0xac4e4af8, 0xacb56878 [10+] smallbin[07] (sz 0x38) = 0xacfe3880, 0xacfe0df0 [10] smallbin[08] (sz 0x40) = 0xa9509b28, 0xa9509b28 [2] smallbin[09] (sz 0x48) = 0xa8a1dc80, 0xa8a1dc80 [2] smallbin[10] (sz 0x50) = 0xac782cb0, 0xac782cb0 [2] [...]
如图所示，计数显示在 bin 内容右侧的括号中。
我们使用 mstate 位图来首先测试 bin 是否为空，因此你可能会偶尔看到一些 bin 条目带有指向堆的有效指针，但被标记为 `[EMPTY]`。这些指针此时只是过期的。
## dlcallback
我们支持插件间回调（inter-plugin callback）的概念。你可以在指定模块中注册一个回调函数，该函数将接收一个 dict，其中包含关于所查看对象状态的大量信息。当 dlchunk 和 dlmstate 都完成对各自参数的处理后，便会调用该回调。
可通过 `-h` 开关查看其用法：```
(gdb) dlcallback -h
[libdlmalloc] usage: dlcallback <option>
[libdlmalloc] disable temporarily disable the registered callback
[libdlmalloc] enable enable the registered callback
[libdlmalloc] status check if a callback is registered
[libdlmalloc] clear forget the registered callback
[libdlmalloc] register <name> <module> use a global function <name> as callback from <module>
[libdlmalloc] ex: register mpcallback libmempool/libmempool
为了演示此功能，我们将使用我们为独立的 GDB 插件 libmempool 开发的一个回调，``` (gdb) dlcallback register mpcallback libmempool/libmempool [libmempool] loaded [libdlmalloc] mpcallback registered as callback (gdb) dlcallback status [libdlmalloc] a callback is registered and enabled
现在当我们使用类似 dlchunk 的命令时，可以看到一些额外的注释：```
(gdb) dlchunk 0xacff59d0
0xacff59d0 M sz:0x000f8 fl:CP alloc_pc:0x08262b45,-
(gdb) dlchunk -v 0xacff59d0
struct malloc_chunk @ 0xacff59d0 {
prev_foot = 0x8140d4d0
size = 0xf8 (CINUSE|PINUSE)
struct mp_header @ 0xacff59d8 {
mh_magic = 0xa11c0123
mh_len = 0xcc
mh_refcount = 0x0
mh_unused = 0x0
mh_fd_link = 0xa9515ed0 (OK)
mh_bk_link = 0xa84005c4 (-)
alloc_pc = 0x8262b45 (-)
free_pc = 0x0 (-)
类似地，我们可以看到默认的 dlmalloc mstate 上附加了显著更多的数据，如 dlmstate 所示：``` (gdb) dlmstate [libdlmalloc] Using cached mstate struct dl_mstate @ 0xa8400008 { smallmap = 0b000000000000010000011111111100 treemap = 0b000000000000000000000000000111 dvsize = 0x0 topsize = 0x2ebdf040 least_addr = 0xa8400000 dv = 0x0 top = 0xad020f90 trim_check = 0x200000 magic = 0x2900d4d8 smallbin[00] (sz 0x0) = 0xa840002c, 0xa840002c [EMPTY] smallbin[01] (sz 0x8) = 0xa8400034, 0xa8400034 [EMPTY] smallbin[02] (sz 0x10) = 0xacbf7ad0, 0xa88647f0 smallbin[03] (sz 0x18) = 0xa95059b8, 0xa9689a20 smallbin[04] (sz 0x20) = 0xac79a028, 0xa87206f8 smallbin[05] (sz 0x28) = 0xacff0120, 0xa948a0f8 smallbin[06] (sz 0x30) = 0xac4e4af8, 0xacb56878 smallbin[07] (sz 0x38) = 0xacfe3880, 0xacfe0df0 smallbin[08] (sz 0x40) = 0xa9509b28, 0xa9509b28 smallbin[09] (sz 0x48) = 0xa8a1dc80, 0xa8a1dc80 smallbin[10] (sz 0x50) = 0xac782cb0, 0xac782cb0 smallbin[11] (sz 0x58) = 0xacbf7a88, 0xacbf7a88 [EMPTY] smallbin[12] (sz 0x60) = 0xac782c00, 0xac782c00 [EMPTY] smallbin[13] (sz 0x68) = 0xacbf7a78, 0xacbf7a78 [EMPTY] smallbin[14] (sz 0x70) = 0xa89b9650, 0xa89b9650 [EMPTY] smallbin[15] (sz 0x78) = 0xac789828, 0xac789828 [EMPTY] smallbin[16] (sz 0x80) = 0xa89b9738, 0xa94af740 smallbin[17] (sz 0x88) = 0xac4e5700, 0xac4e5700 [EMPTY] smallbin[18] (sz 0x90) = 0xac788030, 0xac788030 [EMPTY] smallbin[19] (sz 0x98) = 0xac782bc8, 0xac782bc8 [EMPTY] smallbin[20] (sz 0xa0) = 0xa89b9718, 0xa89b9718 [EMPTY] smallbin[21] (sz 0xa8) = 0xa8a1dc20, 0xa8a1dc20 [EMPTY] smallbin[22] (sz 0xb0) = 0xac782af8, 0xac782af8 [EMPTY] smallbin[23] (sz 0xb8) = 0xac789ed0, 0xac789ed0 [EMPTY] smallbin[24] (sz 0xc0) = 0xacbf7a20, 0xacbf7a20 [EMPTY] smallbin[25] (sz 0xc8) = 0xac789940, 0xac789940 [EMPTY] smallbin[26] (sz 0xd0) = 0xac789eb8, 0xac789eb8 [EMPTY] smallbin[27] (sz 0xd8) = 0xa94af6e8, 0xa94af6e8 [EMPTY] smallbin[28] (sz 0xe0) = 0xacbf78e8, 0xacbf78e8 [EMPTY] smallbin[29] (sz 0xe8) = 0xac4e4e68, 0xac4e4e68 [EMPTY] smallbin[30] (sz 0xf0) = 0xac4e5780, 0xac4e5780 [EMPTY] smallbin[31] (sz 0xf8) = 0xac7880b0, 0xac7880b0 [EMPTY] treebin[00] (sz 0x180) = 0xac783cb0 treebin[01] (sz 0x200) = 0xac789dc0 treebin[02] (sz 0x300) = 0xa883db48 treebin[03] (sz 0x400) = 0x0 [EMPTY] treebin[04] (sz 0x600) = 0x0 [EMPTY] treebin[05] (sz 0x800) = 0x0 [EMPTY] treebin[06] (sz 0xc00) = 0x0 [EMPTY] treebin[07] (sz 0x1000) = 0x0 [EMPTY] treebin[08] (sz 0x1800) = 0x0 [EMPTY] treebin[09] (sz 0x2000) = 0x0 [EMPTY] treebin[10] (sz 0x3000) = 0x0 [EMPTY] treebin[11] (sz 0x4000) = 0x0 [EMPTY] treebin[12] (sz 0x6000) = 0x0 [EMPTY] treebin[13] (sz 0x8000) = 0x0 [EMPTY] treebin[14] (sz 0xc000) = 0x0 [EMPTY] treebin[15] (sz 0x10000) = 0x0 [EMPTY] treebin[16] (sz 0x18000) = 0x0 [EMPTY] treebin[17] (sz 0x20000) = 0x0 [EMPTY] treebin[18] (sz 0x30000) = 0x0 [EMPTY] treebin[19] (sz 0x40000) = 0x0 [EMPTY] treebin[20] (sz 0x60000) = 0x0 [EMPTY] treebin[21] (sz 0x80000) = 0x0 [EMPTY] treebin[22] (sz 0xc0000) = 0x0 [EMPTY] treebin[23] (sz 0x100000) = 0x0 [EMPTY] treebin[24] (sz 0x180000) = 0x0 [EMPTY] treebin[25] (sz 0x200000) = 0x0 [EMPTY] treebin[26] (sz 0x300000) = 0x0 [EMPTY] treebin[27] (sz 0x400000) = 0x0 [EMPTY] treebin[28] (sz 0x600000) = 0x0 [EMPTY] treebin[29] (sz 0x800000) = 0x0 [EMPTY] treebin[30] (sz 0xc00000) = 0x0 [EMPTY] treebin[31] (sz 0xffffffff) = 0x0 [EMPTY] footprint = 0x33800000 max_footprint = 0x33800000 mflags = 0x7 mutex = 0x0,0x0,0x0,0x0,0xa8400000, seg = struct malloc_segment @ 0xa84001d4 { base = 0xa8400000 size = 0x33800000 next = 0x0 sflags = 0x8 struct mp_mstate @ 0xa84001e4 { mp_smallbin[00] - sz: 0x00000000 cnt: 0x0000, mh_fd_link: 0x0 mp_smallbin[01] - sz: 0x00000008 cnt: 0x0000, mh_fd_link: 0x0 mp_smallbin[02] - sz: 0x00000010 cnt: 0x0000, mh_fd_link: 0x0 mp_smallbin[03] - sz: 0x00000018 cnt: 0x0000, mh_fd_link: 0x0 mp_smallbin[04] - sz: 0x00000020 cnt: 0x0000, mh_fd_link: 0x0 mp_smallbin[05] - sz: 0x00000028 cnt: 0x0000, mh_fd_link: 0x0 mp_smallbin[06] - sz: 0x00000030 cnt: 0x0213, mh_fd_link: 0xacfdf800 mp_smallbin[07] - sz: 0x00000038 cnt: 0x0cb3, mh_fd_link: 0xaae0ff70 mp_smallbin[08] - sz: 0x00000040 cnt: 0x1c99, mh_fd_link: 0xac4e4b30 mp_smallbin[09] - sz: 0x00000048 cnt: 0x027b, mh_fd_link: 0xaae0fe30 mp_smallbin[10] - sz: 0x00000050 cnt: 0x0415, mh_fd_link: 0xac782c68 mp_smallbin[11] - sz: 0x00000058 cnt: 0x012d, mh_fd_link: 0xac799fd8 mp_smallbin[12] - sz: 0x00000060 cnt: 0x0125, mh_fd_link: 0xacbf7a78 mp_smallbin[13] - sz: 0x00000068 cnt: 0x0a06, mh_fd_link: 0xac789b78 mp_smallbin[14] - sz: 0x00000070 cnt: 0x003e, mh_fd_link: 0xa9515fc8 mp_smallbin[15] - sz: 0x00000078 cnt: 0x0074, mh_fd_link: 0xac789830 mp_smallbin[16] - sz: 0x00000080 cnt: 0x0124, mh_fd_link: 0xac7827a0 mp_smallbin[17] - sz: 0x00000088 cnt: 0x0016, mh_fd_link: 0xac799f50 mp_smallbin[18] - sz: 0x00000090 cnt: 0x0025, mh_fd_link: 0xac784e58 mp_smallbin[19] - sz: 0x00000098 cnt: 0x004e, mh_fd_link: 0xac4e56f8 mp_smallbin[20] - sz: 0x000000a0 cnt: 0x01c8, mh_fd_link: 0xacfefbf0 mp_smallbin[21] - sz: 0x000000a8 cnt: 0x0189, mh_fd_link: 0xacff05e0 mp_smallbin[22] - sz: 0x000000b0 cnt: 0x00e9, mh_fd_link: 0xacbf79c8 mp_smallbin[23] - sz: 0x000000b8 cnt: 0x0165, mh_fd_link: 0xac96be20 mp_smallbin[24] - sz: 0x000000c0 cnt: 0x0017, mh_fd_link: 0xac789a50 mp_smallbin[25] - sz: 0x000000c8 cnt: 0x001a, mh_fd_link: 0xacb4d998 mp_smallbin[26] - sz: 0x000000d0 cnt: 0x004d, mh_fd_link: 0xa9519150 mp_smallbin[27] - sz: 0x000000d8 cnt: 0x0024, mh_fd_link: 0xacbf78f0 mp_smallbin[28] - sz: 0x000000e0 cnt: 0x002c, mh_fd_link: 0xacff49d8 mp_smallbin[29] - sz: 0x000000e8 cnt: 0x0014, mh_fd_link: 0xa89b9658 mp_smallbin[30] - sz: 0x000000f0 cnt: 0x0008, mh_fd_link: 0xacfde720 mp_smallbin[31] - sz: 0x000000f8 cnt: 0x0044, mh_fd_link: 0xacff59d8 mp_treebin[00] - sz: 0x00000180 cnt: 0x0190, mh_fd_link: 0xacb48318 mp_treebin[01] - sz: 0x00000200 cnt: 0x0134, mh_fd_link: 0xa95059d8 mp_treebin[02] - sz: 0x00000300 cnt: 0x01ac, mh_fd_link: 0xad01cd38 mp_treebin[03] - sz: 0x00000400 cnt: 0x004e, mh_fd_link: 0xacffbac8 mp_treebin[04] - sz: 0x00000600 cnt: 0x0073, mh_fd_link: 0xac4e4fa0 mp_treebin[05] - sz: 0x00000800 cnt: 0x0030, mh_fd_link: 0xacfebe20 mp_treebin[06] - sz: 0x00000c00 cnt: 0x0277, mh_fd_link: 0xac7887e8 mp_treebin[07] - sz: 0x00001000 cnt: 0x004f, mh_fd_link: 0xa9507570 mp_treebin[08] - sz: 0x00001800 cnt: 0x0041, mh_fd_link: 0xac784fa8 mp_treebin[09] - sz: 0x00002000 cnt: 0x0010, mh_fd_link: 0xac74f248 mp_treebin[10] - sz: 0x00003000 cnt: 0x0024, mh_fd_link: 0xac796020 mp_treebin[11] - sz: 0x00004000 cnt: 0x0028, mh_fd_link: 0xacf9a3e0 mp_treebin[12] - sz: 0x00006000 cnt: 0x009a, mh_fd_link: 0xad01cf68 mp_treebin[13] - sz: 0x00008000 cnt: 0x000b, mh_fd_link: 0xacae3978 mp_treebin[14] - sz: 0x0000c000 cnt: 0x0027, mh_fd_link: 0xad014678 mp_treebin[15] - sz: 0x00010000 cnt: 0x000b, mh_fd_link: 0xacab7098 mp_treebin[16] - sz: 0x00018000 cnt: 0x0062, mh_fd_link: 0xacafa7c8 mp_treebin[17] - sz: 0x00020000 cnt: 0x0007, mh_fd_link: 0xac2cda88 mp_treebin[18] - sz: 0x00030000 cnt: 0x0012, mh_fd_link: 0xac800720 mp_treebin[19] - sz: 0x00040000 cnt: 0x000a, mh_fd_link: 0xac6e21e0 mp_treebin[20] - sz: 0x00060000 cnt: 0x0006, mh_fd_link: 0xaa5b0f28 mp_treebin[21] - sz: 0x00080000 cnt: 0x0004, mh_fd_link: 0xacf152e8 mp_treebin[22] - sz: 0x000c0000 cnt: 0x000e, mh_fd_link: 0xaac896f0 mp_treebin[23] - sz: 0x00100000 cnt: 0x0000, mh_fd_link: 0x0 mp_treebin[24] - sz: 0x00180000 cnt: 0x0004, mh_fd_link: 0xa934b730 mp_treebin[25] - sz: 0x00200000 cnt: 0x0001, mh_fd_link: 0xaa6d6cc8 mp_treebin[26] - sz: 0x00300000 cnt: 0x0003, mh_fd_link: 0xacc1feb0 mp_treebin[27] - sz: 0x00400000 cnt: 0x0001, mh_fd_link: 0xa8f39370 mp_treebin[28] - sz: 0x00600000 cnt: 0x0000, mh_fd_link: 0x0 mp_treebin[29] - sz: 0x00800000 cnt: 0x0001, mh_fd_link: 0xa9689a40 mp_treebin[30] - sz: 0x00c00000 cnt: 0x0001, mh_fd_link: 0xaae41208 mp_treebin[31] - sz: 0xffffffff cnt: 0x0001, mh_fd_link: 0xab641738 [UNSORTED]
## 回调字典
目前，我们只是将大量信息从 libdlmalloc 发送到回调函数，回调函数可以自行决定如何处理这些信息。我们提供的信息比大多数回调实际需要的更多。此外，预期回调函数需要了解发出回调的插件，以便决定要显示哪些附加信息。另一方面，调用回调的插件（本例中为 libdlmalloc）目前无需知道（或关心）这个外部回调提供程序所做的任何事情。
以下是我们提供给回调函数的部分数据示例：
* `caller`: 调用 gdb 命令或函数的名称
* `allocator`: 管理我们发送的块地址的后备分配器
* `addr`: 核心分配器元数据之后的块内容地址
* `hdr_sz`: 核心分配器元数据头部的大小
* `chunksz`: 根据核心分配器元数据头部计算的块大小
* `min_hdr_sz`: 此核心分配器可能的最小头部大小
* `data_size`: `addr` 处数据的大小
* `inuse`: 根据核心分配器，块是否处于使用中
* `chunk_info`: 调用库是否正在打印块信息
* `size_sz`: 在被调试平台上计算出的 `size_t` 数据类型的大小
# 未来发展
随着需求的出现，或在进行未来的 Cisco ASA 研究时，我们可能会为 libdlmalloc 添加功能。目前计划添加的功能包括：
- 将调试引擎逻辑抽象出来，使其更类似于 libheap 或 shadow 的较新设计
- 编写 `dlsearch`，遍历所有 msegments 搜索某个值。
- 为释放块提供一个 dlchunk 选项，通过遍历链接来查找 bin，从而推断关联的 `mstate` 基地址
# 关于 dlmalloc 的说明
## dlmalloc 与 ptmalloc 的对比
ptmalloc 分配器是 glibc 的一部分，它经常从 dlmalloc 分支出来。下表展示了各版本之间的关系：
| dlmalloc | ptmalloc | bin 类型 |
| -------------- | --------- | ---------------------------- |
| dlmalloc 2.5.x | N/A | bins |
| dlmalloc 2.6.x | ptmalloc | smallbins/bins |
| dlmalloc 2.7.x | ptmalloc2 | fastbins/smallbins/largebins |
| dlmalloc 2.8.x | ptmalloc3 | smallbins/treebins |
## 延伸阅读
dlmalloc 2.8.x 在许多方面与早期 dlmalloc 版本不同，主要是因为大型分配使用了树结构。最好的文档是[源代码](http://g.oswego.edu/pub/misc/)。如需了解 ptmalloc2 和 ptmalloc3（对应 dlmalloc 2.7.x 与 2.8.x）之间差异的背景知识，请参阅 blackngel 的 Phrack 67 文章 [The House Of Lore: Reloaded](http://phrack.org/issues/67/8.html)。
# 联系我们
我们非常乐意听取有关此工具的反馈，也欢迎提交 pull request。
* Aaron Adams
* 邮箱: `aaron<dot>adams<at>nccgroup<dot>trust`
* Twitter: @fidgetingbits
* Cedric Halbronn
* 邮箱: `cedric<dot>halbronn<at>nccgroup<dot>trust`
* Twitter: @saidelike