ptmalloc fanzine26 Jul 2016
This post is intended to be the parent-page of the ptmalloc fanzine episodes, as well as a collection of resources related to glibc heap meta-data corruptions.
The zine deals with some peculiarities of ptmalloc meta-data attacks, mostly from an offensive perspective. Familiarity with the glibc malloc implementation and the different techniques for leveraging corruptions is assumed, see below for introductory resources.
- episode 01: munmap madness
- episode 02: fastbin fever
- episode 03: scraps of notes on ptmalloc metadata corruptions
- episode 04: once upon a realloc()
- episode 05: thread local caching in glibc malloc
- glibc wiki malloc internals: high-level overview of ptmalloc
- sploitfun: describes ptmalloc and the different attacks
- how2heap: nice practical examples of the currently relevant techniques, as well as a collection of other resources
- GB_MASTER’S /DEV/NULL: explores each technique in the Malloc Maleficarum