{"id":13422793,"url":"https://github.com/danigargu/heap-viewer","last_synced_at":"2025-03-15T12:30:51.268Z","repository":{"id":37636969,"uuid":"132489731","full_name":"danigargu/heap-viewer","owner":"danigargu","description":"IDA Pro plugin to examine the glibc heap, focused on exploit development","archived":false,"fork":false,"pushed_at":"2022-07-25T09:21:47.000Z","size":207,"stargazers_count":736,"open_issues_count":4,"forks_count":87,"subscribers_count":21,"default_branch":"master","last_synced_at":"2024-10-28T00:00:31.294Z","etag":null,"topics":["exploit","exploitation","glibc","heap","ida-plugin","ida-pro","idapython","idapython-plugin","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/danigargu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-05-07T16:46:37.000Z","updated_at":"2024-10-26T02:43:50.000Z","dependencies_parsed_at":"2022-07-12T22:50:27.357Z","dependency_job_id":null,"html_url":"https://github.com/danigargu/heap-viewer","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danigargu%2Fheap-viewer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danigargu%2Fheap-viewer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danigargu%2Fheap-viewer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danigargu%2Fheap-viewer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/danigargu","download_url":"https://codeload.github.com/danigargu/heap-viewer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243731044,"owners_count":20338761,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["exploit","exploitation","glibc","heap","ida-plugin","ida-pro","idapython","idapython-plugin","python"],"created_at":"2024-07-30T23:00:57.896Z","updated_at":"2025-03-15T12:30:50.935Z","avatar_url":"https://github.com/danigargu.png","language":"Python","funding_links":[],"categories":["IDA Plugins","\u003ca id=\"1ded622dca60b67288a591351de16f8b\"\u003e\u003c/a\u003e漏洞","\u003ca id=\"683b645c2162a1fce5f24ac2abfa1973\"\u003e\u003c/a\u003e漏洞\u0026\u0026漏洞管理\u0026\u0026漏洞发现/挖掘\u0026\u0026漏洞开发\u0026\u0026漏洞利用\u0026\u0026Fuzzing","使用"],"sub_categories":["\u003ca id=\"385d6777d0747e79cccab0a19fa90e7e\"\u003e\u003c/a\u003e未分类","\u003ca id=\"41ae40ed61ab2b61f2971fea3ec26e7c\"\u003e\u003c/a\u003e漏洞利用","\u003ca id=\"1ded622dca60b67288a591351de16f8b\"\u003e\u003c/a\u003e漏洞"],"readme":"# HeapViewer\n[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)\n\nAn IDA Pro plugin to examine the heap, focused on exploit development.\n\nCurrently supports the glibc malloc implementation (ptmalloc2).\n\n[3rd place winner of the 2018 Hex-Rays Plugin Contest](https://www.hex-rays.com/contests/2018/index.shtml)\n\n\n## Requirements\n\n* IDA Pro \u003e= 7.0\n\n## Tested on\n\n* glibc 2.23 \u003c= 2.31 (x86, x64)\n\n## Features\n\n* Heap tracer (malloc/free/calloc/realloc)\n  * Detection of overlaps and double-frees\n  * Visualization using [villoc](https://github.com/wapiflapi/villoc)\n* Malloc chunk info\n* Chunk editor\n* Multi-arena info (chunks, top, last-remainder)\n* Bins info (fastbins, unsortedbin, smallbins y largebins)\n* Tcache info (glibc \u003e= 2.26)\n* GraphView for linked lists (bins/tcache)\n* Structs view (malloc_state / malloc_par / tcache_perthread)\n* Magic utils:\n  * Unlink merge info\n  * Freeable/merge info\n  * Fake fastbin finder\n  * House of force helper\n  * Useful libc offsets\n  * Calc chunk size (request2size)\n  * IO_FILE structs\n\n\n## Install\n\nJust drop the `heap_viewer.py` file and the `heap_viewer` folder into IDA's plugin directory.\n\nTo install just for the current user, copy the files into one of these directories:\n\n| OS          | Plugin path                          |\n| ----------- | ------------------------------------ |\n| Linux/macOS | `~/.idapro/plugins`                  |\n| Windows     | `%AppData%\\Hex-Rays\\IDA Pro\\plugins` |\n\n## Configuration\n\nCurrently the plugin does not require to be configured, since it tries to obtain automatically the necessary offsets to analyze the heap. \n\nHowever, in case the plugin fails, it is possible to set the different offsets in the configuration tab. To obtain these offsets, you can use any of the tools located in the `utils` folder.\n\nIf you find any inconsistency, let me know :)\n\n## Screenshots\n\n**Tracer**\n\n![Tracer](https://user-images.githubusercontent.com/1675387/39698165-fe882786-51f3-11e8-847a-18a5b40a6be2.png)\n\n**Arena \u0026 chunk info**\n\n![Arena-Chunk](https://user-images.githubusercontent.com/1675387/39698203-2ba59370-51f4-11e8-9b66-c3dfaafadba3.png)\n\n**Tcache entries**\n\n![Tcache entries](https://user-images.githubusercontent.com/1675387/39698220-4c3d3e94-51f4-11e8-8aea-ef9182c8910f.png)\n\n**Bins**\n\n![Bins](https://user-images.githubusercontent.com/1675387/39698914-19bf9db0-51f7-11e8-97f4-82ddf84b7e0e.png)\n\n**Bin graph**\n\n![BinGraph](https://user-images.githubusercontent.com/1675387/39698795-97abbd90-51f6-11e8-8cbc-475b5e623894.png)\n\n\n**Fastbin graph**\n\n![fastbin graph](https://user-images.githubusercontent.com/1675387/39918437-b5e49562-5510-11e8-8437-86da11eb466f.png)\n\n\n**Tcache graph**\n\n![tcache graph](https://user-images.githubusercontent.com/1675387/39926350-3dbbc7e4-552f-11e8-99f9-72e5dd99d421.png)\n\n\n**Find fake fastbin**\n\n![Find fake fastbin](https://user-images.githubusercontent.com/1675387/39698662-f661b11a-51f5-11e8-8796-c852252bd75a.png)\n\n\n**Unlink merge info**\n\n![Unlink merge info](https://user-images.githubusercontent.com/1675387/39699039-b2740870-51f7-11e8-9e61-ca9407af1793.png)\n\n\n**Useful libc offsets**\n\n![Useful libc offsets](https://user-images.githubusercontent.com/1675387/39698577-b1d40b56-51f5-11e8-8ef8-7711bc2efd32.png)\n\n\n## Learning Resources\n\nI'd recommend the following resources alongside this tool for learning heap exploiting.\n\n* [shellphish's how2heap](https://github.com/shellphish/how2heap)\n\n\n## Author\n\n* Daniel García Gutiérrez - @danigargu\n\n## Contributors :beer:\n\nSpecial mention to my colleagues [soez][soez], [wagiro][wagiro] and [DiaLluvioso][DiaLluvioso] for give me some ideas during the development of the plugin. And of course, the [@pwndbg](https://github.com/pwndbg/pwndbg/) project, from which I picked up some things about heap parsing.\n\n[Contributors](https://github.com/danigargu/heap-viewer/graphs/contributors)\n\n[soez]: https://twitter.com/javierprtd\n[wagiro]: https://twitter.com/egarme\n[DiaLluvioso]: https://twitter.com/Manuelbp01\n\n## Bugs / Feedback / PRs\n\nAny comment, issue or pull request will be highly appreciated :-)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdanigargu%2Fheap-viewer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdanigargu%2Fheap-viewer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdanigargu%2Fheap-viewer/lists"}