module HeapInfo
HeapInfo
- an interactive debugger for heap exploitation
HeapInfo
makes pwning life easier with ruby style memory dumper. Easy to show bin(s) layouts, or dump memory for checking whether exploit (will) works. HeapInfo
can be used with ltrace/strace/gdb simultaneously since it not use any ptrace.
@author david942j
Constants
- TMP_DIR
Directory for writing some tmp files when working, make sure /tmp is writable
- VERSION
Current gem version.
Public Class Methods
heapinfo(prog, options = {})
click to toggle source
Entry point for using {HeapInfo}. Show segments info of the process after loaded. @param [String, Integer] prog
The program name of victim. If a number is given, seem as pid (useful when multi-processes exist).
@param [Hash] options Give library's file name. @option options [String, Regexp] :libc file name of glibc, default is +/bc*.so/+. @return [HeapInfo::Process] The object for further usage. @example
h = heapinfo './victim' # outputs: # Program: /home/heapinfo/victim PID: 20568 # victim base @ 0x400000 # [heap] base @ 0x11cc000 # [stack] base @ 0x7fff2b244000 # libc-2.19.so base @ 0x7f892a63a000 # ld-2.19.so base @ 0x7f892bee6000 # canary value: 0x84b742f03d94c100 p h.libc.name #=> "/lib/x86_64-linux-gnu/libc-2.19.so" p h.ld.name #=> "/lib/x86_64-linux-gnu/ld-2.19.so" p h.heap.base.to_s(16) #=> '11cc000'
@example
h = heapinfo(27605, libc: 'libc.so.6') # pid 27605 is run by custom loader p h.libc.name #=> "/home/heapinfo/libc.so.6" p h.ld.name #=> "/home/heapinfo/ld-linux-x86-64.so.2"
# File lib/heapinfo.rb, line 51 def self.heapinfo(prog, options = {}) HeapInfo::Process.new(prog, options).tap { |h| $stdout.puts h } end