heap

heap

此heap非彼heap

终于开始堆漏洞的学习了

这篇作为前置知识的总结

一直放着…

慢慢写…

拖了几个月了

想着还是输出一些东西吧

启动!

偷了一张图…

内存布局

从栈(stack)到堆(heap)

栈LIFO的栈帧结构解决了函数调用的管理

自动，确定，但生命周期短

经历了栈pwn的洗礼，想必我们已经深刻理解这个过程了

而堆则维持了动态内存的管理

灵活，生命周期长，但也更复杂

堆管理器则位于用户程序与操作系统之间，通过brk和mmap获取原始内存，再以 chunk 和 bin 为单位进行组织与复用

其中(s)brk用于调整program break(堆顶)以连续扩展heap，适合小块频繁分配，由allocator统一管理

而mmap则直接向内核申请一块独立映射区，不一定连续，但可通过munmap单独释放，且通常用于大块内存

在堆pwn中漏洞变得更加隐秘

不过还是有迹可循的

先从基础开始吧~

malloc_chunk

在c语言动态内存管理中，我们使用malloc向系统所申请得到的内存块一般被称为chunk

比如我们malloc(0x50)

堆管理器实际返回给用户的大小应该为0x60

而当你用gdb调试时却会看到0x61

why???

ps:仅记录64位，后不再重复qwq

在ptmalloc的内部使用malloc_chunk结构体来表示每个内存块

如下:

1
2
3
4
5
6
7
8
9
10
11
12
struct malloc_chunk {

  INTERNAL_SIZE_T      prev_size;  /* Size of previous chunk (if free).  */
  INTERNAL_SIZE_T      size;       /* Size in bytes, including overhead. */

  struct malloc_chunk* fd;         /* double links -- used only if free. */
  struct malloc_chunk* bk;

  /* Only used for large blocks: pointer to next larger size.  */
  struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
  struct malloc_chunk* bk_nextsize;
};

还有各种宏😭

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
#ifndef INTERNAL_SIZE_T
#define INTERNAL_SIZE_T size_t
#endif

/* The corresponding word size */
#define SIZE_SZ                (sizeof(INTERNAL_SIZE_T))

/*
  MALLOC_ALIGNMENT is the minimum alignment for malloc'ed chunks.
  It must be a power of two at least 2 * SIZE_SZ, even on machines
  for which smaller alignments would suffice. It may be defined as
  larger than this though. Note however that code and data structures
  are optimized for the case of 8-byte alignment.
*/


#ifndef MALLOC_ALIGNMENT
# if !SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_16)
/* This is the correct definition when there is no past ABI to constrain it.

   Among configurations with a past ABI constraint, it differs from
   2*SIZE_SZ only on powerpc32.  For the time being, changing this is
   causing more compatibility problems due to malloc_get_state and
   malloc_set_state than will returning blocks not adequately aligned for
   long double objects under -mlong-double-128.  */

#  define MALLOC_ALIGNMENT       (2 *SIZE_SZ < __alignof__ (long double)      \
                                  ? __alignof__ (long double) : 2 *SIZE_SZ)
# else
#  define MALLOC_ALIGNMENT       (2 *SIZE_SZ)
# endif
#endif

/* The corresponding bit mask value */
#define MALLOC_ALIGN_MASK      (MALLOC_ALIGNMENT - 1)

INTERNAL_SIZE_T宏展开后其实就是size_t，64位下为8字节

同时有MALLOC_ALIGNMENT宏 -> 即64位下16字节对齐

prev_size : 用以保存在内存中前一个物理地址相邻的chunk的size，仅在该chunk为free状态时会被使用到

size : 即用以保存这个chunk的总的大小，同时包含chunk头(prev_size + size)和chunk剩余部分的大小

chunk标志位的宏:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
/*
   --------------- Physical chunk operations ---------------
 */


/* size field is or'ed with PREV_INUSE when previous adjacent chunk in use */
#define PREV_INUSE 0x1

/* extract inuse bit of previous chunk */
#define prev_inuse(p)       ((p)->size & PREV_INUSE)


/* size field is or'ed with IS_MMAPPED if the chunk was obtained with mmap() */
#define IS_MMAPPED 0x2

/* check for mmap()'ed chunk */
#define chunk_is_mmapped(p) ((p)->size & IS_MMAPPED)


/* size field is or'ed with NON_MAIN_ARENA if the chunk was obtained
   from a non-main arena.  This is only set immediately before handing
   the chunk to the user, if necessary.  */
#define NON_MAIN_ARENA 0x4

/* check for chunk from non-main arena */
#define chunk_non_main_arena(p) ((p)->size & NON_MAIN_ARENA)

size 的低三位是标志位(P/M/A) : 分别表示前一块是否在用、是否为mmap分配、是否属于非主分配区(non main_arena)

其中size的PREV_INUSE位表示前一个 chunk 是否正在使用(1即在用 0即空闲)

空间复用规则(设计哲学~):

只有当前块的PREV_INUSE位为 0 时，prev_size 才表示前一空闲块大小，否则该字段被复用为用户数据的一部分

还要注意相邻free chunk的合并等等

ps:动手调试!

fd bk : 仅在chunk被free后使用，用以连接其它的chunk，所以当chunk处于被使用的状态时该字段无效，被用以存储用户的数据

如你所见，这是一个指针，free后，在各类bin中，以链表的形式存在

而UAF即释放后依然能向chunk中写入数据，本质就是能控制fd指针以返回任意地址

fd_nextsize bk_nextsize : 同理，不过仅存在于large bin中，用于在不同 size 的 chunk 间快速跳转查找(分层索引)，提高查找效率的同时也为我们提供了攻击面

ps:理解unlink操作

malloc_state

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
struct malloc_state
{
  /* Serialize access.  */
  __libc_lock_define (, mutex);
  /* Flags (formerly in max_fast).  */
  int flags;
  /* Set if the fastbin chunks contain recently inserted free blocks.  */
  /* Note this is a bool but not all targets support atomics on booleans.  */
  int have_fastchunks;
  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];
  /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr top;
  /* The remainder from the most recent split of a small request */
  mchunkptr last_remainder;
  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];
  /* Bitmap of bins */
  unsigned int binmap[BINMAPSIZE];
  /* Linked list */
  struct malloc_state *next;
  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;
  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;
  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

重要

bins

当我们使用free后

chunk闲置

ptmalloc会根据size的不同大小将之存放到不同的bins中进行统一的调度，而不会马上返还给系统

这样在用户再次进行请求时，ptmalloc便可从bins中挑选出合适的chunk给予用户，大幅度地减少了系统调用的次数及其带来的巨大开销…

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
/*
   Bins

    An array of bin headers for free chunks. Each bin is doubly
    linked.  The bins are approximately proportionally (log) spaced.
    There are a lot of these bins (128). This may look excessive, but
    works very well in practice.  Most bins hold sizes that are
    unusual as malloc request sizes, but are more usual for fragments
    and consolidated sets of chunks, which is what these bins hold, so
    they can be found quickly.  All procedures maintain the invariant
    that no consolidated chunk physically borders another one, so each
    chunk in a list is known to be preceeded and followed by either
    inuse chunks or the ends of memory.

    Chunks in bins are kept in size order, with ties going to the
    approximately least recently used chunk. Ordering isn't needed
    for the small bins, which all contain the same-sized chunks, but
    facilitates best-fit allocation for larger chunks. These lists
    are just sequential. Keeping them in order almost never requires
    enough traversal to warrant using fancier ordered data
    structures.

    Chunks of the same size are linked with the most
    recently freed at the front, and allocations are taken from the
    back.  This results in LRU (FIFO) allocation order, which tends
    to give each chunk an equal opportunity to be consolidated with
    adjacent freed chunks, resulting in larger free chunks and less
    fragmentation.

    To simplify use in double-linked lists, each bin header acts
    as a malloc_chunk. This avoids special-casing for headers.
    But to conserve space and improve locality, we allocate
    only the fd/bk pointers of bins, and then use repositioning tricks
    to treat these as the fields of a malloc_chunk*.
 */

typedef struct malloc_chunk *mbinptr;

当bins中无chunk时则从top chunk切一块下来

若top chunk也不够，就要用(s)brk/mmap系统调用向系统申请内存扩展堆了…

ps:曾经能利用top chunk进行攻击，现在已经成为时代的眼泪了…

bins是一个用以存放闲置的chunk的数组，chunk按照size来存放在不同的下标的bin中，每个bin中的chunk都是使用双向链表进行连接的

在ptmalloc中bins数组中的bin一共可以划分为三类 : unsorted bin small bin large bin

ps:好乱，果然知识能授予，智慧只能自己领悟qwq

unsorted bin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
/*
   Unsorted chunks

    All remainders from chunk splits, as well as all returned chunks,
    are first placed in the "unsorted" bin. They are then placed
    in regular bins after malloc gives them ONE chance to be used before
    binning. So, basically, the unsorted_chunks list acts as a queue,
    with chunks being placed on it in free (and malloc_consolidate),
    and taken off (to be either used or placed in bins) in malloc.

    The NON_MAIN_ARENA flag is never set for unsorted chunks, so it
    does not have to be taken into account in size comparisons.
 */

/* The otherwise unindexable 1-bin is used to hold unsorted chunks. */
#define unsorted_chunks(M)          (bin_at (M, 1))

unsorted bin是glibc堆管理中的一个临时缓存双向链表，所有新释放(or合并后)的 chunk 都会先进入其中而不立即按大小分类

在后续 malloc 时会优先遍历该链表，若命中则直接分配，否则再将其重新分配到对应的small/large bin，从而减少分箱开销并提升局部性与性能~

存在unsorted bin attack

待补充…

small bin

1
2
3
4
5
6
7
8
9
10
11
#define NSMALLBINS         64
#define SMALLBIN_WIDTH    MALLOC_ALIGNMENT
#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > 2 * SIZE_SZ)
#define MIN_LARGE_SIZE    ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH)

#define in_smallbin_range(sz)  \
  ((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE)

#define smallbin_index(sz) \
  ((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\
   + SMALLBIN_CORRECTION)

我暂时还没接触到😂

sorry~

large bin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#define largebin_index_32(sz)                                                \
  (((((unsigned long) (sz)) >> 6) <= 38) ?  56 + (((unsigned long) (sz)) >> 6) :\
   ((((unsigned long) (sz)) >> 9) <= 20) ?  91 + (((unsigned long) (sz)) >> 9) :\
   ((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
   ((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
   ((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
   126)

#define largebin_index_32_big(sz)                                            \
  (((((unsigned long) (sz)) >> 6) <= 45) ?  49 + (((unsigned long) (sz)) >> 6) :\
   ((((unsigned long) (sz)) >> 9) <= 20) ?  91 + (((unsigned long) (sz)) >> 9) :\
   ((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
   ((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
   ((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
   126)

// XXX It remains to be seen whether it is good to keep the widths of
// XXX the buckets the same or whether it should be scaled by a factor
// XXX of two as well.
#define largebin_index_64(sz)                                                \
  (((((unsigned long) (sz)) >> 6) <= 48) ?  48 + (((unsigned long) (sz)) >> 6) :\
   ((((unsigned long) (sz)) >> 9) <= 20) ?  91 + (((unsigned long) (sz)) >> 9) :\
   ((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
   ((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
   ((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
   126)

#define largebin_index(sz) \
  (SIZE_SZ == 8 ? largebin_index_64 (sz)                                     \
   : MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz)                     \
   : largebin_index_32 (sz))

宏还是太神秘了😇

存在large bin attack

关注glibc2.30版本之后的souce code:

1
2
3
4
5
6
7
if ((unsigned long) (size) < (unsigned long) chunksize_nomask (bck->bk)){
	  fwd = bck;
	  bck = bck->bk;
		victim->fd_nextsize = fwd->fd;
		victim->bk_nextsize = fwd->fd->bk_nextsize;
		fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
}

实现任意地址写堆地址

控制bk_nextsize为target - 0x20

往victim->bk_nextsize->fd_nextsize的地址写入victim地址

即我们控制的bk_nextsize + 0x20也就是target

注意一下保护机制和写入条件

具体:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
#include<stdio.h>
#include<stdlib.h>
#include<assert.h>
int main(){
  /*Disable IO buffering to prevent stream from interfering with heap*/
  setvbuf(stdin,NULL,_IONBF,0);
  setvbuf(stdout,NULL,_IONBF,0);
  setvbuf(stderr,NULL,_IONBF,0);

  printf("\n\n");
  printf("Since glibc2.30, two new checks have been enforced on large bin chunk insertion\n\n");
  printf("Check 1 : \n");
  printf(">    if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))\n");
  printf(">        malloc_printerr (\"malloc(): largebin double linked list corrupted (nextsize)\");\n");
  printf("Check 2 : \n");
  printf(">    if (bck->fd != fwd)\n");
  printf(">        malloc_printerr (\"malloc(): largebin double linked list corrupted (bk)\");\n\n");
  printf("This prevents the traditional large bin attack\n");
  printf("However, there is still one possible path to trigger large bin attack. The PoC is shown below : \n\n");
  
  printf("====================================================================\n\n");

  size_t target = 0;
  printf("Here is the target we want to overwrite (%p) : %lu\n\n",&target,target);
  size_t *p1 = malloc(0x428);
  printf("First, we allocate a large chunk [p1] (%p)\n",p1-2);
  size_t *g1 = malloc(0x18);
  printf("And another chunk to prevent consolidate\n");

  printf("\n");

  size_t *p2 = malloc(0x418);
  printf("We also allocate a second large chunk [p2]  (%p).\n",p2-2);
  printf("This chunk should be smaller than [p1] and belong to the same large bin.\n");
  size_t *g2 = malloc(0x18);
  printf("Once again, allocate a guard chunk to prevent consolidate\n");

  printf("\n");

  free(p1);
  printf("Free the larger of the two --> [p1] (%p)\n",p1-2);
  size_t *g3 = malloc(0x438);
  printf("Allocate a chunk larger than [p1] to insert [p1] into large bin\n");

  printf("\n");

  free(p2);
  printf("Free the smaller of the two --> [p2] (%p)\n",p2-2);
  printf("At this point, we have one chunk in large bin [p1] (%p),\n",p1-2);
  printf("               and one chunk in unsorted bin [p2] (%p)\n",p2-2);

  printf("\n");

  p1[3] = (size_t)((&target)-4);
  printf("Now modify the p1->bk_nextsize to [target-0x20] (%p)\n",(&target)-4);

  printf("\n");

  size_t *g4 = malloc(0x438);
  printf("Finally, allocate another chunk larger than [p2] (%p) to place [p2] (%p) into large bin\n", p2-2, p2-2);
  printf("Since glibc does not check chunk->bk_nextsize if the new inserted chunk is smaller than smallest,\n");
  printf("  the modified p1->bk_nextsize does not trigger any error\n");
  printf("Upon inserting [p2] (%p) into largebin, [p1](%p)->bk_nextsize->fd_nextsize is overwritten to address of [p2] (%p)\n", p2-2, p1-2, p2-2);

  printf("\n");

  printf("In our case here, target is now overwritten to address of [p2] (%p), [target] (%p)\n", p2-2, (void *)target);
  printf("Target (%p) : %p\n",&target,(size_t*)target);

  printf("\n");
  printf("====================================================================\n\n");

  assert((size_t)(p2-2) == target);

  return 0;
}

由于从各种bins中取出一个chunk的操作十分频繁，若是使用函数实现则会造成较大的开销，故unlink操作被单独实现为一个宏，如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
/* Take a chunk off a bin list */
#define unlink(AV, P, BK, FD) {                                            \
    FD = P->fd;								      \
    BK = P->bk;								      \
    if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      \
      malloc_printerr (check_action, "corrupted double-linked list", P, AV);  \
    else {								      \
        FD->bk = BK;							      \
        BK->fd = FD;							      \
        if (!in_smallbin_range (P->size)				      \
            && __builtin_expect (P->fd_nextsize != NULL, 0)) {		      \
	    if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)	      \
		|| __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    \
	      malloc_printerr (check_action,				      \
			       "corrupted double-linked list (not small)",    \
			       P, AV);					      \
            if (FD->fd_nextsize == NULL) {				      \
                if (P->fd_nextsize == P)				      \
                  FD->fd_nextsize = FD->bk_nextsize = FD;		      \
                else {							      \
                    FD->fd_nextsize = P->fd_nextsize;			      \
                    FD->bk_nextsize = P->bk_nextsize;			      \
                    P->fd_nextsize->bk_nextsize = FD;			      \
                    P->bk_nextsize->fd_nextsize = FD;			      \
                  }							      \
              } else {							      \
                P->fd_nextsize->bk_nextsize = P->bk_nextsize;		      \
                P->bk_nextsize->fd_nextsize = P->fd_nextsize;		      \
              }								      \
          }								      \
      }									      \
}

重点!

后续利用的关键!

好好理解哦~

fastbins

虽然我们在前面讲到在ptmalloc中使用bins数组储存闲置的chunk

但是由于大部分程序都会频繁地申请以及释放一些较小的chunk，若是我们将大部分的时间都花在合并chunk、分割chunk、复杂的安全检查上，则会大大地降低堆的利用效率，故ptmalloc独立于bins之外单独设计了一个fastbin用以储存一些size较小的闲置chunk

如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
/*
   Fastbins

    An array of lists holding recently freed small chunks.  Fastbins
    are not doubly linked.  It is faster to single-link them, and
    since chunks are never removed from the middles of these lists,
    double linking is not necessary. Also, unlike regular bins, they
    are not even processed in FIFO order (they use faster LIFO) since
    ordering doesn't much matter in the transient contexts in which
    fastbins are normally used.

    Chunks in fastbins keep their inuse bit set, so they cannot
    be consolidated with other free chunks. malloc_consolidate
    releases all chunks in fastbins and consolidates them with
    other free chunks.
 */

typedef struct malloc_chunk *mfastbinptr;

注意:

fastbins是一个用以保存最近释放的较小的chunk的数组，为了提高速度使用单向链表进行连接

采取LIFO的策略，即每次都取用fastbin链表头部的chunk，每次释放chunk时都插入至链表头部成为新的头结点，因而大幅提高了存取chunk的速度

但是也更方便利用就是了

相关宏:

1
2
3
4
5
6
7
8
9
#define fastbin(ar_ptr, idx) ((ar_ptr)->fastbinsY[idx])

/* offset 2 to use otherwise unindexable first 2 bins */
#define fastbin_index(sz) \
  ((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)
/* The maximum fastbin request size we support */
#define MAX_FAST_SIZE     (80 * SIZE_SZ / 4)

#define NFASTBINS  (fastbin_index (request2size (MAX_FAST_SIZE)) + 1)
1
2
3
4
5
6
7
#define set_max_fast(s) \
  global_max_fast = (((s) == 0)						      \
                     ? SMALLBIN_WIDTH : ((s + SIZE_SZ) & ~MALLOC_ALIGN_MASK))
#define get_max_fast() global_max_fast
...
/* Maximum size of memory handled in fastbins.  */
static INTERNAL_SIZE_T global_max_fast;

global_max_fast : fastbin chunk size最大值

有一种利用手法哦~

tcache

自 glibc 2.26 起新增tcache作为线程本地缓存用于存储小块 free chunk，支持快速 LIFO 分配与释放，减少对全局 bin 的竞争与锁开销

下面是一些宏:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#if USE_TCACHE
/* We want 64 entries.  This is an arbitrary limit, which tunables can reduce.  */
# define TCACHE_MAX_BINS		64
# define MAX_TCACHE_SIZE	tidx2usize (TCACHE_MAX_BINS-1)
/* Only used to pre-fill the tunables.  */
# define tidx2usize(idx)	(((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ)
/* When "x" is from chunksize().  */
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
/* When "x" is a user-provided size.  */
# define usize2tidx(x) csize2tidx (request2size (x))
/* With rounding and alignment, the bins are...
   idx 0   bytes 0..24 (64-bit) or 0..12 (32-bit)
   idx 1   bytes 25..40 or 13..20
   idx 2   bytes 41..56 or 21..28
   etc.  */
/* This is another arbitrary limit, which tunables can change.  Each
   tcache bin will hold at most this number of chunks.  */
# define TCACHE_FILL_COUNT 7
/* Maximum chunks in tcache bins for tunables.  This value must fit the range
   of tcache->counts[] entries, else they may overflow.  */
# define MAX_TCACHE_COUNT UINT16_MAX
#endif

TCACHE_MAX_BINS = 64 定义了最多有 64 个大小类别(bin)

TCACHE_FILL_COUNT = 7 每个 bin 最多缓存 7 个 chunk(default)

MAX_TCACHE_COUNT 单个 bin 的最大计数上限(防止溢出)

MAX_TCACHE_SIZE tcache 能管理的最大 chunk 大小

并定义了chunk size <-> tcache bin 下标的转换，每个 bin 管一段连续大小区间，按MALLOC_ALIGNMENT(16 字节)对齐递增

具体的索引计算:

来自how2heap(github)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <malloc.h>


struct malloc_chunk {

  size_t      mchunk_prev_size;  /* Size of previous chunk (if free).  */
  size_t      mchunk_size;       /* Size in bytes, including overhead. */

  struct malloc_chunk* fd;         /* double links -- used only if free. */
  struct malloc_chunk* bk;

  /* Only used for large blocks: pointer to next larger size.  */
  struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
  struct malloc_chunk* bk_nextsize;
};

/* The corresponding word size.  */
#define SIZE_SZ (sizeof (size_t))

#define MALLOC_ALIGNMENT (2 * SIZE_SZ < __alignof__ (long double) \
                          ? __alignof__ (long double) : 2 * SIZE_SZ)

/* The corresponding bit mask value.  */
#define MALLOC_ALIGN_MASK (MALLOC_ALIGNMENT - 1)

/* The smallest possible chunk */
#define MIN_CHUNK_SIZE        (offsetof(struct malloc_chunk, fd_nextsize))

/* The smallest size we can malloc is an aligned minimal chunk */
#define MINSIZE  \
  (unsigned long)(((MIN_CHUNK_SIZE+MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK))

#define request2size(req)                                         \
  (((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE)  ?             \
   MINSIZE :                                                      \
   ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)

/* When "x" is from chunksize().  */
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)

/* When "x" is a user-provided size.  */
# define usize2tidx(x) csize2tidx (request2size (x))

int main()
{
    unsigned long long req;
    unsigned long long tidx;
        fprintf(stderr, "This file doesn't demonstrate an attack, but calculates the tcache idx for a given chunk size.\n");
        fprintf(stderr, "The basic formula is as follows:\n");
    fprintf(stderr, "\tIDX = (CHUNKSIZE - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT\n");
    fprintf(stderr, "\tOn a 64 bit system the current values are:\n");
    fprintf(stderr, "\t\tMINSIZE: 0x%lx\n", MINSIZE);
    fprintf(stderr, "\t\tMALLOC_ALIGNMENT: 0x%lx\n", MALLOC_ALIGNMENT);
    fprintf(stderr, "\tSo we get the following equation:\n");
    fprintf(stderr, "\tIDX = (CHUNKSIZE - 0x%lx) / 0x%lx\n\n", MINSIZE-MALLOC_ALIGNMENT+1, MALLOC_ALIGNMENT);
    fprintf(stderr, "BUT be AWARE that CHUNKSIZE is not the x in malloc(x)\n");
    fprintf(stderr, "It is calculated as follows:\n");
    fprintf(stderr, "\tIF x + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE(0x%lx) CHUNKSIZE = MINSIZE (0x%lx)\n", MINSIZE, MINSIZE);
    fprintf(stderr, "\tELSE: CHUNKSIZE = (x + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK) \n");
    fprintf(stderr, "\t=> CHUNKSIZE = (x + 0x%lx + 0x%lx) & ~0x%lx\n\n\n", SIZE_SZ, MALLOC_ALIGN_MASK, MALLOC_ALIGN_MASK);
    while(1) {
        fprintf(stderr, "[CTRL-C to exit] Please enter a size x (malloc(x)) in hex (e.g. 0x10): ");
        scanf("%llx", &req);
        tidx = usize2tidx(req);
        if (tidx > 63) {
            fprintf(stderr, "\nWARNING: NOT IN TCACHE RANGE!\n");
        }
        fprintf(stderr, "\nTCache Idx: %llu\n", tidx);
    }
    return 0;
}

自行学习!

由于tcache结构过于简单，针对tcache poisoning的UAF亦或double free过于容易了

于是在glibc 2.32引入了safe linking保护机制

1
2
3
4
5
6
7
8
9
10
11
12
/* Safe-Linking:
   Use randomness from ASLR (mmap_base) to protect single-linked lists
   of Fast-Bins and TCache.  That is, mask the "next" pointers of the
   lists' chunks, and also perform allocation alignment checks on them.
   This mechanism reduces the risk of pointer hijacking, as was done with
   Safe-Unlinking in the double-linked lists of Small-Bins.
   It assumes a minimum page size of 4096 bytes (12 bits).  Systems with
   larger pages provide less entropy, although the pointer mangling
   still works.  */
#define PROTECT_PTR(pos, ptr) \
  ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))
#define REVEAL_PTR(ptr)  PROTECT_PTR (&ptr, ptr)

通过简单异或混淆对指针进行加密

这样攻击者即使可以写fd，也无法直接伪造任意地址，而必须先泄露heap地址(info leak)

有防亦有攻!

由于fd指针的低12位(页内偏移)是已知的

且混淆所用的key(ASLR导致的heap基址高位)在同一上下文中是相同的

因此，当存储该fd指针的chunk与指针本身位于同一内存页时，即page offset相同时，完全可以恢复该指针的真实值!

具体:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>

long decrypt(long cipher)
{
        puts("The decryption uses the fact that the first 12bit of the plaintext (the fwd pointer) is known,");
        puts("because of the 12bit sliding.");
        puts("And the key, the ASLR value, is the same with the leading bits of the plaintext (the fwd pointer)");
        long key = 0;
        long plain;

        for(int i=1; i<6; i++) {
                int bits = 64-12*i;
                if(bits < 0) bits = 0;
                plain = ((cipher ^ key) >> bits) << bits;
                key = plain >> 12;
                printf("round %d:\n", i);
                printf("key:    %#016lx\n", key);
                printf("plain:  %#016lx\n", plain);
                printf("cipher: %#016lx\n\n", cipher);
        }
        return plain;
}

int main()
{
        /*
         * This technique demonstrates how to recover the original content from a poisoned
         * value because of the safe-linking mechanism.
         * The attack uses the fact that the first 12 bit of the plaintext (pointer) is known
         * and the key (ASLR slide) is the same to the pointer's leading bits.
         * As a result, as long as the chunk where the pointer is stored is at the same page
         * of the pointer itself, the value of the pointer can be fully recovered.
         * Otherwise, we can also recover the pointer with the page-offset between the storer
         * and the pointer. What we demonstrate here is a special case whose page-offset is 0.
         * For demonstrations of other more general cases, plz refer to
         * https://github.com/n132/Dec-Safe-Linking
         */

        setbuf(stdin, NULL);
        setbuf(stdout, NULL);

        // step 1: allocate chunks
        long *a = malloc(0x20);
        long *b = malloc(0x20);
        printf("First, we create chunk a @ %p and chunk b @ %p\n", a, b);
        malloc(0x10);
        puts("And then create a padding chunk to prevent consolidation.");


        // step 2: free chunks
        puts("Now free chunk a and then free chunk b.");
        free(a);
        free(b);
        printf("Now the freelist is: [%p -> %p]\n", b, a);
        printf("Due to safe-linking, the value actually stored at b[0] is: %#lx\n", b[0]);

        // step 3: recover the values
        puts("Now decrypt the poisoned value");
        long plaintext = decrypt(b[0]);

        printf("value: %p\n", a);
        printf("recovered value: %#lx\n", plaintext);
        assert(plaintext == (long)a);
}

arena/main_arena

ps: arena 中文 : 竞技场 qwq ???

在多线程程序中

每个线程都会单独有着一个arena实例用以管理属于该线程的堆内存区域

1
2
3
4
5
6
static struct malloc_state main_arena =
{
  .mutex = _LIBC_LOCK_INITIALIZER,
  .next = &main_arena,
  .attached_threads = 1
};

ps: 还记得malloc_state吗😡

顾名思义

main_arena即主线程所使用的arena(主分配区)

main_arena是一个全局静态变量，类型是struct malloc_state，next = &main_arena即形成环形链表起点

1
2
3
4
5
6
7
8
//每个线程一个 arena(TLS)
static __thread mstate thread_arena;

static inline struct malloc_state *
arena_for_chunk (mchunkptr ptr)
{
  return chunk_main_arena (ptr) ? &main_arena : heap_for_ptr (ptr)->ar_ptr;
}

每个arena都是一个独立的分配器实例

内部包含fastbins，bins(small/large/unsorted)，top chunk等链表结构

main_arena(来自libc)管理程序初始heap(brk)

ps:常利用unsorted bin的fd指针用于泄露libc基址

why?

unsorted bin的本质是一个挂在main_arena内部的双向链表，其头节点本身就位于libc中，因此任何进入unsorted bin的chunk，其fd/bk指针都会直接指向main_arena，从而天然形成 libc地址泄露原语!

见下:

main_arena.bins[1] <-> chunk1 <-> chunk2 ...

而thread arena则管理mmap出来的heap(多线程)

malloc_hook/free_hook

曾经的利用利器

覆盖hook即RCE

然而于glibc 2.34被彻底移除😭

遥想公瑾当年啊~

这之后可谓是堆利用的至暗时刻

然而这并不能阻止hacker们的热情

针对IO_FILE结构体的FSOP攻击应运而生…

待补充…

heap
#heap #堆
heap
https://roxy5201314.github.io/2026/02/11/heap/
作者
roxy
发布于
2026年2月11日
更新于
2026年3月30日
许可协议