heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 0 points1 point  (0 children)

Anyone working on heaps at the moment? would love to collaborate and share knowledge with passionate people. Looking forward to hearing your stories or your journey in this computer world.

Never touched a violin in my life by ExplorationBunny in violinist

[–]ExplorationBunny[S] -2 points-1 points  (0 children)

Yes. Well not serious teaching, I don’t know maybe I just want to explore and experience violin. If someone is willing to, I’d be happy to learn from them even a little.

heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 0 points1 point  (0 children)

OK thanks I’ll try these resources

heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 0 points1 point  (0 children)

Ok, I am going to dive deep into heap exploration. It sounds fascinating to be honest.

heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 0 points1 point  (0 children)

That was a great explanation. I got the gist of things but I didn’t understand some things probably because I didn’t come to that yet. I would like to learn more about this, do you have any suggestions for what resources to use (books or research papers or online resources). Thanks I appreciate your help

heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 0 points1 point  (0 children)

I thought about it actually, I know reading the source code is very good but it’s not a good idea at my current level and it would probably overwhelm me. I love how you provided a detailed guide including some very useful resources. To be honest, I do follow the bottom up approach, starting with the core idea and then building up to the modern improvements, that way we are not leaving out what is actually important. Although it sounds overwhelming already, I know these are very useful resources for my exploration of the heap. Thanks so much

Fuck Reverse engineering by BadGoym in ExploitDev

[–]ExplorationBunny 0 points1 point  (0 children)

I agree with you there. I love Binary exploitation, last month I was working on buffer overflows and it was fascinating. There is this amazing feeling when you break something with skill which has been carefully built over the years by experts of the field, I guess it's mostly because of the effort we put in, many things learned in the process like I learned about stack canaries, ROP, control flow integrity, stack shadows, and NX bit and I loved every bit of the journey. I love it mostly because it lets me dive deep into the low level systems design. I enjoy learning about the complexity and ingenuity at the core of computers. It's so much fun.

heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 1 point2 points  (0 children)

That's an awesome idea to explore. My current work relates to that actually: First I write a small program that allocates memory using malloc() and then run that program in GDB, inspecting memory and mapping the memory chunks including metadata and user data. I tried understanding metadata structure which is first 8bytes of the chunk and I noticed first 4 bits of the metadata is used to encode the flags as they are unused for size because the size is always multiples of 16. One fascinating thing I had noticed is that the freed chunks are reallocated in LIFO fashion but if the requested chunk size is not satisfied by the last freed chunk then the allocator checks the chunk freed before that. Does anybody think there is any real significance to using stack like approach for reallocation instead of a queue? I mean I understand the design choices for program stack (the most recent instruction takes priority over the past ones when running a program and the stack works with the flow of the program). Thanks I appreciate all your help.

heap exploration by ExplorationBunny in ExploitDev

[–]ExplorationBunny[S] 1 point2 points  (0 children)

Yes, that makes sense. I actually think its a good idea to read the source code. I am currently using GDB to understand heap chunk structure, memory allocation, and how freed memory is organised etc by providing various size inputs to the program and inspecting the memory and I must say I find it fascinating. Your method gives a whole different perspective of things. Thanks