Heap analysis

.gitignore

@@ -16,3 +16,4 @@ venv
 *.egg-info
 *.core
 .coverage
+.idea

docs/source/heap.rst

@@ -0,0 +1,18 @@
+.. testsetup:: *
+
+   from pwnlib.heap import *
+   from pwnlib.tubes.process import process
+
+
+:mod:`pwnlib.heap` --- Heap
+===================================================
+
+.. automodule:: pwnlib.heap
+
+Allocators
+-------------
+.. toctree::
+    :maxdepth: 1
+    :glob:
+
+    heap/glmalloc

docs/source/heap/glmalloc.rst

@@ -0,0 +1,23 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc import *
+   from pwnlib.tubes.process import process
+
+
+:mod:`pwnlib.heap.glmalloc` --- glibc malloc
+===================================================
+
+Items
+-------------
+.. toctree::
+    :maxdepth: 1
+    :glob:
+
+    glmalloc/*
+
+
+Examples
+------------
+.. automodule:: pwnlib.heap.glmalloc
+
+

docs/source/heap/glmalloc/arena.rst

@@ -0,0 +1,17 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc.arena import *
+
+:mod:`pwnlib.heap.glmalloc.arena` --- Arena of libc
+========================================================================
+
+Arena
+-------
+.. autoclass:: pwnlib.heap.glmalloc.Arena()
+   :members:
+
+NoTcacheError
+--------------
+.. autoclass:: pwnlib.heap.glmalloc.NoTcacheError()
+   :members:
+   :show-inheritance:

docs/source/heap/glmalloc/bins.rst

@@ -0,0 +1,18 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc.bins import *
+
+:mod:`pwnlib.heap.glmalloc.bins` --- Bins of the libc
+=========================================================
+
+This modules contains the classes used to represent the different
+bins of the libc.
+
+Bins
+-----
+.. toctree::
+    :maxdepth: 2
+    :glob:
+
+    bins/*
+

docs/source/heap/glmalloc/bins/bins.rst

@@ -0,0 +1,20 @@
+Bins (abstract classes)
+==========================
+Classes with generic behaviour that are inherit by the all
+the bins types.
+
+
+Bins
+-----
+.. autoclass:: pwnlib.heap.glmalloc.Bins()
+   :members:
+
+Bin
+----
+.. autoclass:: pwnlib.heap.glmalloc.Bin()
+   :members:
+
+BinEntry
+---------
+.. autoclass:: pwnlib.heap.glmalloc.BinEntry()
+   :members:

docs/source/heap/glmalloc/bins/fastbins.rst

@@ -0,0 +1,21 @@
+Fast bins
+==========
+Classes to represent the tcache bins of the libc.
+
+FastBins
+---------
+.. autoclass:: pwnlib.heap.glmalloc.FastBins()
+   :members:
+   :show-inheritance:
+
+FastBin
+--------
+.. autoclass:: pwnlib.heap.glmalloc.FastBin()
+   :members:
+   :show-inheritance:
+
+FastBinEntry
+-------------
+.. autoclass:: pwnlib.heap.glmalloc.FastBinEntry()
+   :members:
+   :show-inheritance:

docs/source/heap/glmalloc/bins/largebins.rst

@@ -0,0 +1,21 @@
+Large bins
+===========
+Classes to represent the large bins of the libc.
+
+LargeBins
+-----------
+.. autoclass:: pwnlib.heap.glmalloc.LargeBins()
+   :members:
+   :show-inheritance:
+
+LargeBin
+----------
+.. autoclass:: pwnlib.heap.glmalloc.LargeBin()
+   :members:
+   :show-inheritance:
+
+LargeBinEntry
+---------------
+.. autoclass:: pwnlib.heap.glmalloc.LargeBinEntry()
+   :members:
+   :show-inheritance:

docs/source/heap/glmalloc/bins/smallbins.rst

@@ -0,0 +1,21 @@
+Small bins
+===========
+Classes to represent the small bins of the libc.
+
+SmallBins
+-----------
+.. autoclass:: pwnlib.heap.glmalloc.SmallBins()
+   :members:
+   :show-inheritance:
+
+SmallBin
+----------
+.. autoclass:: pwnlib.heap.glmalloc.SmallBin()
+   :members:
+   :show-inheritance:
+
+SmallBinEntry
+--------------
+.. autoclass:: pwnlib.heap.glmalloc.SmallBinEntry()
+   :members:
+   :show-inheritance:

docs/source/heap/glmalloc/bins/tcaches.rst

@@ -0,0 +1,23 @@
+Tcaches
+========
+Classes to represent the tcache bins of the libc. Tcaches were
+incorporated in libc 2.26, therefore this classes are only
+used if the current libc version of the process is at least 2.26.
+
+Tcaches
+--------
+.. autoclass:: pwnlib.heap.glmalloc.Tcaches()
+   :members:
+   :show-inheritance:
+
+Tcache
+-------
+.. autoclass:: pwnlib.heap.glmalloc.Tcache()
+   :members:
+   :show-inheritance:
+
+TcacheEntry
+------------
+.. autoclass:: pwnlib.heap.glmalloc.TcacheEntry()
+   :members:
+   :show-inheritance:

docs/source/heap/glmalloc/bins/unsortedbin.rst

@@ -0,0 +1,22 @@
+Unsorted bin
+==============
+Classes to represent the unsorted bin of the libc.
+
+UnsortedBins
+--------------
+.. autoclass:: pwnlib.heap.glmalloc.UnsortedBins()
+   :members:
+   :show-inheritance:
+
+UnsortedBin
+-------------
+.. autoclass:: pwnlib.heap.glmalloc.UnsortedBin()
+   :members:
+   :show-inheritance:
+
+UnsortedBinEntry
+------------------
+.. autoclass:: pwnlib.heap.glmalloc.UnsortedBinEntry()
+   :members:
+   :show-inheritance:
+

docs/source/heap/glmalloc/heap.rst

@@ -0,0 +1,16 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc.heap import *
+
+:mod:`pwnlib.heap.glmalloc.heap` --- Heap managed by the libc
+========================================================================
+
+Heap
+------
+.. autoclass:: pwnlib.heap.glmalloc.Heap()
+   :members:
+
+HeapError
+-----------
+.. autoclass:: pwnlib.heap.glmalloc.HeapError()
+   :members:

docs/source/heap/glmalloc/heap_explorer.rst

@@ -0,0 +1,13 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc import *
+   from pwnlib.tubes.process import process
+   from pwnlib.elf.corefile import Corefile
+
+Heap Explorer
+===============
+
+HeapExplorer
+--------------
+.. autoclass:: pwnlib.heap.glmalloc.HeapExplorer()
+   :members:

docs/source/heap/glmalloc/malloc_chunk.rst

@@ -0,0 +1,11 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc.malloc_chunk import *
+
+:mod:`pwnlib.heap.glmalloc.malloc_chunk` --- Chunks with metadata managed by libc
+===================================================================================
+
+MallocChunk
+---------------
+.. autoclass:: pwnlib.heap.glmalloc.MallocChunk()
+   :members:

docs/source/heap/glmalloc/malloc_state.rst

@@ -0,0 +1,24 @@
+.. testsetup:: *
+
+   from pwnlib.heap.glmalloc.malloc_state import *
+
+:mod:`pwnlib.heap.glmalloc.malloc_state` --- Malloc state of each arena of the libc
+=====================================================================================
+
+
+MallocState
+------------
+.. autoclass:: pwnlib.heap.glmalloc.MallocState()
+   :members:
+
+
+FastBinsY
+-----------
+.. autoclass:: pwnlib.heap.glmalloc.malloc_state.FastBinsY()
+   :members:
+
+Bins
+------
+.. autoclass:: pwnlib.heap.glmalloc.malloc_state.Bins()
+   :members:
+

docs/source/index.rst

@@ -58,6 +58,7 @@ Each of the ``pwntools`` modules is documented here.
    flag
    fmtstr
    gdb
+   heap
    libcdb
    log
    memleak

pwn/toplevel.py

@@ -65,6 +65,7 @@
 from pwnlib.util.sh_string import sh_string, sh_prepare, sh_command_with
 from pwnlib.util.splash import *
 from pwnlib.util.web import *
+from pwnlib.heap import *
 
 # Promote these modules, so that "from pwn import *" will let you access them
 

pwnlib/__init__.py

@@ -37,6 +37,7 @@
     'util',
     'adb',
     'update',
+    'heap'
 ]
 
 for module in __all__:

pwnlib/data/__init__.py

@@ -4,6 +4,7 @@
     # These files are not distributed with Pwntools, but
     # are in the source tree and used for testing.
     from pwnlib.data import elf
+    from pwnlib.data import heap
 except ImportError:
     pass
 

pwnlib/data/heap/__init__.py

@@ -0,0 +1,8 @@
+from __future__ import absolute_import
+from pwnlib.data.heap import x86_64
+
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)

pwnlib/data/heap/x86_64/__init__.py

@@ -0,0 +1,5 @@
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)