• Stars
    star
    300
  • Rank 138,870 (Top 3 %)
  • Language
    C
  • License
    BSD 3-Clause "New...
  • Created almost 4 years ago
  • Updated almost 2 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

helps visualize heap operations for pwn and debugging

About

heaptrace is a heap debugger for tracking glibc heap operations in ELF64 (x86_64) binaries. Its purpose is to help visualize heap operations when debugging binaries or doing heap pwn.

screenshot.png

  • replaces addresses with easy-to-understand symbols
  • detects heap corruption and memory leakage issues
  • can debug in gdb at any point (--break)
  • supports all ELF64 (x86_64) binaries regardless of ASLR or compiler settings (including stripped binaries)

How are heaptrace and valgrind different?

Installation

Official Releases

See the .deb and .rpm release files, and a pre-compiled binary at the Releases page.

Ubuntu PPA

$ sudo add-apt-repository ppa:arinerron/heaptrace
$ sudo apt-get update
$ sudo apt-get install heaptrace

Arch User Repository (PKGBUILD)

Use your preferred AUR helper to install one of the two following packages:

$ trizen -S heaptrace-git
... OR ...
$ trizen -S heaptrace

Compile from Source

$ git clone https://github.com/Arinerron/heaptrace.git && cd heaptrace
$ make
$ sudo make install
...
$ heaptrace ./target

Usage

You can specify arguments to heaptrace before specifying the binary name:

Usage:
  heaptrace [options...] <target> [args...]
  heaptrace [options...] --attach <pid>

Options:
  -p <pid>, --attach <pid>, --pid <pid>
	 Tells heaptrace to attach to the specified pid 
	 instead of running the binary from the `target` 
	 argument. Note that if you specify this argument 
	 you do not have to specify `target`.


  -b <expression>, --break=<expression>, --break-at=<expression>
	 Send SIGSTOP to the process when the specified 
	 `expression` is satisfied and attach the GNU debugger 
	 (gdb) to the process.

	 This argument supports complex expressions. Please 
	 See the documentation for more information: 
	 https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints


  -B <expression>, --break-after=<expression>
	 Similar to `--break`. Replaces the tracer 
	 process with gdb, but only after the heap function 
	 returns. See the documentation for more information: 
	 https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints


  -e <name=value>, --environ=<name=value>, --environment=<name=value>
	 Sets a single environmental variable. Useful for 
	 setting runtime settings for the target such as 
	 LD_PRELOAD=./libc.so.6 without having them affect 
	 heaptrace's runtime configuration. This option can 
	 be used multiple times.


  -s <sym_defs>, --symbols=<sym_defs>
	 Override the values heaptrace detects for the 
	 malloc/calloc/free/realloc/reallocarray symbols. 
	 Useful if heaptrace fails to automatically 
	 identify heap functions in a stripped binary. See 
	 the wiki for more info.


  -F, --follow-fork, --follow
	 Tells heaptrace to detach the parent and follow 
	 the child if the target calls fork(), vfork(), or 
	 clone().

	 The default behavior is to detach the child and 
	 only trace the parent.


  -G <path>, --gdb-path <path>
	 Tells heaptrace to use the path to gdb specified 
	 in `path` instead of /usr/bin/gdb (default).


  -w <width>, --width=<width>, --term-width=<width>
	 Force a certain terminal width.


  -o <file>, --output=<file>
	 Write the heaptrace output to `file` instead of 
	 /dev/stderr (which is the default output path).


  -v, --verbose
	 Prints verbose information such as line numbers in
	 source code given the required debugging info is
	 stored in the ELF.


  -V, --version
	 Displays the current heaptrace version.


  -h, --help
	 Shows this help menu.

  • For example, if you wanted to automatically attach gdb at operation #3, you would execute heaptrace --break=3 ./my-binary. Please see the wiki documentation for more information on how to use this argument.
  • See the wiki documentation for more information on how to use the -s/--symbol argument to debug stripped binaries that heaptrace failed to automatically identify functions in.
  • Set the $NO_COLOR argument to remove ANSI color codes from output. This option is still in development and will be converted into an argument soon.

Support

I'm happy to help if you experience a bug or have any feedback. Please see the GitHub Issues page.

More Repositories

1

CVE-2022-0847-DirtyPipe-Exploit

A root exploit for CVE-2022-0847 (Dirty Pipe)
C
1,060
star
2

re-lmgtfy

Now that lmgtfy.com has ads, all is lost if we don't recreate it.
HTML
29
star
3

uftpd_dirtrav

A proof of concept exploit that tries to pop you a shell on a uftpd server between versions 2.6 and 2.10
Python
20
star
4

pfc

pfc is a cli-based modular toolkit for pentesting and reconnaissance
Java
7
star
5

compile

generate x86 shellcode from a simple scripting language
Python
6
star
6

ScratchAPI

A library written in Java for accessing scratch.mit.edu via your Java application...
Java
6
star
7

cicada3301

a bot that allows users to perform cryptographic operations from discord
6
star
8

Ping-Pong

Simple ping pong game! (I made like 101010101 years ago :P)
Java
5
star
9

spoofcommit

Spoof GitHub commits...
Shell
5
star
10

LinesOfCode

A simple program to read lines of code in a folder I made a while back...
Java
5
star
11

pfc2

pfc2 is a more modular and powerful, second generation of pfc
Python
5
star
12

pystrfry

a tool and library for solving those annoying strfry CTF challenges
Python
5
star
13

meissner

Meissner Lop - Dictionary-based fuzzer for mutation XSS
Python
5
star
14

discord3301

a bot that allows users to perform cryptographic operations from discord
Java
4
star
15

ChatSpammer

Feel the sudden urge to spam someone? ( don't cross the line :p ) This is perfect for you!
Java
4
star
16

SecurityCamera

A little script that takes a picture whenever there is motion, and deletes it 48 hours later.
Java
4
star
17

scratch-dark-theme

A version of Scratch that makes everything-- Just read the title. :P
CSS
4
star
18

InternetometerBot

Please don't expect this code to be readable. I was never planning on publishing the source code. :)
Java
3
star
19

asfdiuhasdofhukias

3
star
20

RawSocket

Read and write directly to a socket. Like nc, but it also has a feature that enables easy testing for buffer overflows.
Java
3
star
21

WebBitcoin

A client-side web-based bitcoin wallet
HTML
3
star
22

ethernotify

Get push notifications about Ethereum spikes or crashes
Java
2
star
23

damn-vulnerable-defi-solutions

my solutions to damn-vulnerable-defi challenges
Solidity
2
star
24

i-use-arch-btw

just wanted you to know
2
star
25

CrappyCrypto

Want to "encrypt" your stuff with a totally not secure algorithm? You're in luck!
Java
2
star
26

user_history

logs other users' command history from an account without root privileges
Python
2
star
27

Forux

An in-development, simple, lightweight game library
Java
2
star
28

window.opener

A window.opener exploit PoC
HTML
2
star
29

smartbytes

smartbytes makes byte parsing not painful
Python
2
star
30

captcha

a test captcha system
PHP
1
star
31

pycket

makes packet parsing really simple
Python
1
star
32

Arinerron

1
star
33

SeleniumWrapper

A wrapper for SeleniumDriver to make it easier to set up.
Java
1
star
34

brainfrick

a brainfrick interpreter in rust
Rust
1
star
35

libuserfaultfd

a userfaultfd library for CTF so you don't have to copy/paste so much code to exploit race conditions
C
1
star
36

lazypkg

A cross-distro package generator
Python
1
star
37

pylockscreen

a modular, Python-based, modern i3lock / i3lock-fancy / i3lock-fancy-multimonitor alternative
1
star
38

cryptobot

my cryptocurrency trading bot
Python
1
star
39

neodesmos

JavaScript
1
star
40

Game

a "fun" game made in a single multi-thousand-lined Java class file
Java
1
star