heapinfo 0.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/README.md +130 -0
- data/lib/heapinfo.rb +75 -0
- data/lib/heapinfo/arena.rb +193 -0
- data/lib/heapinfo/chunk.rb +96 -0
- data/lib/heapinfo/chunks.rb +20 -0
- data/lib/heapinfo/dumper.rb +204 -0
- data/lib/heapinfo/ext/string.rb +29 -0
- data/lib/heapinfo/helper.rb +123 -0
- data/lib/heapinfo/libc.rb +46 -0
- data/lib/heapinfo/nil.rb +27 -0
- data/lib/heapinfo/process.rb +205 -0
- data/lib/heapinfo/segment.rb +34 -0
- data/lib/heapinfo/tools/get_arena.c +29 -0
- data/lib/heapinfo/version.rb +3 -0
- data/spec/chunk_spec.rb +40 -0
- data/spec/chunks_spec.rb +25 -0
- data/spec/dumper_spec.rb +79 -0
- data/spec/files/32bit_maps +23 -0
- data/spec/files/64bit_maps +29 -0
- data/spec/files/victim.cpp +32 -0
- data/spec/helper_spec.rb +73 -0
- data/spec/nil_spec.rb +15 -0
- data/spec/process_spec.rb +157 -0
- data/spec/spec_helper.rb +98 -0
- data/spec/string_spec.rb +18 -0
- metadata +81 -0
@@ -0,0 +1,29 @@
|
|
1
|
+
00400000-00401000 r-xp 00000000 ca:01 464143 /home/heapinfo/examples/uaf/uaf
|
2
|
+
00600000-00601000 r--p 00000000 ca:01 464143 /home/heapinfo/examples/uaf/uaf
|
3
|
+
00601000-00602000 rw-p 00001000 ca:01 464143 /home/heapinfo/examples/uaf/uaf
|
4
|
+
7f65ac7b8000-7f65ac7ce000 r-xp 00000000 ca:01 402137 /lib/x86_64-linux-gnu/libgcc_s.so.1
|
5
|
+
7f65ac7ce000-7f65ac9cd000 ---p 00016000 ca:01 402137 /lib/x86_64-linux-gnu/libgcc_s.so.1
|
6
|
+
7f65ac9cd000-7f65ac9ce000 rw-p 00015000 ca:01 402137 /lib/x86_64-linux-gnu/libgcc_s.so.1
|
7
|
+
7f65ac9ce000-7f65acad3000 r-xp 00000000 ca:01 401788 /lib/x86_64-linux-gnu/libm-2.19.so
|
8
|
+
7f65acad3000-7f65accd2000 ---p 00105000 ca:01 401788 /lib/x86_64-linux-gnu/libm-2.19.so
|
9
|
+
7f65accd2000-7f65accd3000 r--p 00104000 ca:01 401788 /lib/x86_64-linux-gnu/libm-2.19.so
|
10
|
+
7f65accd3000-7f65accd4000 rw-p 00105000 ca:01 401788 /lib/x86_64-linux-gnu/libm-2.19.so
|
11
|
+
7f65accd4000-7f65ace8f000 r-xp 00000000 ca:01 402326 /lib/x86_64-linux-gnu/libc-2.19.so
|
12
|
+
7f65ace8f000-7f65ad08e000 ---p 001bb000 ca:01 402326 /lib/x86_64-linux-gnu/libc-2.19.so
|
13
|
+
7f65ad08e000-7f65ad092000 r--p 001ba000 ca:01 402326 /lib/x86_64-linux-gnu/libc-2.19.so
|
14
|
+
7f65ad092000-7f65ad094000 rw-p 001be000 ca:01 402326 /lib/x86_64-linux-gnu/libc-2.19.so
|
15
|
+
7f65ad094000-7f65ad099000 rw-p 00000000 00:00 0
|
16
|
+
7f65ad099000-7f65ad17f000 r-xp 00000000 ca:01 13857 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19
|
17
|
+
7f65ad17f000-7f65ad37e000 ---p 000e6000 ca:01 13857 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19
|
18
|
+
7f65ad37e000-7f65ad386000 r--p 000e5000 ca:01 13857 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19
|
19
|
+
7f65ad386000-7f65ad388000 rw-p 000ed000 ca:01 13857 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19
|
20
|
+
7f65ad388000-7f65ad39d000 rw-p 00000000 00:00 0
|
21
|
+
7f65ad39d000-7f65ad3c0000 r-xp 00000000 ca:01 402319 /lib/x86_64-linux-gnu/ld-2.19.so
|
22
|
+
7f65ad5aa000-7f65ad5af000 rw-p 00000000 00:00 0
|
23
|
+
7f65ad5bc000-7f65ad5bf000 rw-p 00000000 00:00 0
|
24
|
+
7f65ad5bf000-7f65ad5c0000 r--p 00022000 ca:01 402319 /lib/x86_64-linux-gnu/ld-2.19.so
|
25
|
+
7f65ad5c0000-7f65ad5c1000 rw-p 00023000 ca:01 402319 /lib/x86_64-linux-gnu/ld-2.19.so
|
26
|
+
7f65ad5c1000-7f65ad5c2000 rw-p 00000000 00:00 0
|
27
|
+
7fff3d1e8000-7fff3d209000 rw-p 00000000 00:00 0 [stack]
|
28
|
+
7fff3d309000-7fff3d30b000 r-xp 00000000 00:00 0 [vdso]
|
29
|
+
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
|
@@ -0,0 +1,32 @@
|
|
1
|
+
#include <cstdlib>
|
2
|
+
#include <cstdio>
|
3
|
+
#include <unistd.h>
|
4
|
+
int main(int argc, char **argv) {
|
5
|
+
if(argc <=1 ) alarm(10);
|
6
|
+
void *v, *u;
|
7
|
+
int *i, *j;
|
8
|
+
|
9
|
+
void *mmap = malloc(0x20000);
|
10
|
+
|
11
|
+
// normal
|
12
|
+
v = malloc(24); u = malloc(24);
|
13
|
+
free(v); free(u);
|
14
|
+
|
15
|
+
// invalid
|
16
|
+
i = (int*)malloc(40);
|
17
|
+
free(i);
|
18
|
+
*i = 0xdeadbeef;
|
19
|
+
|
20
|
+
// loop
|
21
|
+
v = malloc(56); u = malloc(56);
|
22
|
+
free(v); free(u); free(v);
|
23
|
+
|
24
|
+
v = malloc(136);
|
25
|
+
void** others = (void**)malloc(72); // also prevent small bin merge with top_chunk
|
26
|
+
*others = mmap; // hack for test can get address of mmap
|
27
|
+
free(v);
|
28
|
+
v = malloc(152); // let 136 put into smallbin
|
29
|
+
malloc(200); // to prevent merge with top_chunk
|
30
|
+
free(v); // put into unsorted bin
|
31
|
+
scanf("%*c");
|
32
|
+
}
|
data/spec/helper_spec.rb
ADDED
@@ -0,0 +1,73 @@
|
|
1
|
+
# encoding: ascii-8bit
|
2
|
+
require 'heapinfo'
|
3
|
+
describe HeapInfo::Helper do
|
4
|
+
describe 'unpack' do
|
5
|
+
it '32bit' do
|
6
|
+
expect(HeapInfo::Helper.unpack(4, "\x15\xCD\x5b\x07")).to eq 123456789
|
7
|
+
end
|
8
|
+
it '64bit' do
|
9
|
+
expect(HeapInfo::Helper.unpack(8, "\xEF\xCD\xAB\xEF\xBE\xAD\xDE\x00")).to eq 0xdeadbeefabcdef
|
10
|
+
end
|
11
|
+
end
|
12
|
+
|
13
|
+
it 'proc' do
|
14
|
+
expect { HeapInfo::Helper.exe_of 0 }.to raise_error ArgumentError
|
15
|
+
end
|
16
|
+
|
17
|
+
describe 'parse_maps' do
|
18
|
+
before(:all) do
|
19
|
+
@files_dir = File.expand_path('../files', __FILE__)
|
20
|
+
end
|
21
|
+
it '32bit' do
|
22
|
+
maps = IO.binread(@files_dir + '/32bit_maps')
|
23
|
+
expect(HeapInfo::Helper.parse_maps maps).to eq [
|
24
|
+
[0x8048000, 0x8049000, 'r-xp', '/home/heapinfo/examples/uaf/uaf'],
|
25
|
+
[0x8049000, 0x804a000, 'r--p', '/home/heapinfo/examples/uaf/uaf'],
|
26
|
+
[0x804a000, 0x804b000, 'rw-p', '/home/heapinfo/examples/uaf/uaf'],
|
27
|
+
[0xf73d7000, 0xf73f3000, 'r-xp', '/usr/lib32/libgcc_s.so.1'],
|
28
|
+
[0xf73f3000, 0xf73f4000, 'rw-p', '/usr/lib32/libgcc_s.so.1'],
|
29
|
+
[0xf73f4000, 0xf7438000, 'r-xp', '/lib32/libm-2.19.so'],
|
30
|
+
[0xf7438000, 0xf7439000, 'r--p', '/lib32/libm-2.19.so'],
|
31
|
+
[0xf7439000, 0xf743a000, 'rw-p', '/lib32/libm-2.19.so'],
|
32
|
+
[0xf743a000, 0xf75df000, 'r-xp', '/lib32/libc-2.19.so'],
|
33
|
+
[0xf75df000, 0xf75e1000, 'r--p', '/lib32/libc-2.19.so'],
|
34
|
+
[0xf75e1000, 0xf75e2000, 'rw-p', '/lib32/libc-2.19.so'],
|
35
|
+
[0xf75e5000, 0xf76c1000, 'r-xp', '/usr/lib32/libstdc++.so.6.0.19'],
|
36
|
+
[0xf76c1000, 0xf76c5000, 'r--p', '/usr/lib32/libstdc++.so.6.0.19'],
|
37
|
+
[0xf76c5000, 0xf76c6000, 'rw-p', '/usr/lib32/libstdc++.so.6.0.19'],
|
38
|
+
[0xf76dd000, 0xf76de000, 'r-xp', '[vdso]'],
|
39
|
+
[0xf76de000, 0xf76fe000, 'r-xp', '/lib32/ld-2.19.so'],
|
40
|
+
[0xf76fe000, 0xf76ff000, 'r--p', '/lib32/ld-2.19.so'],
|
41
|
+
[0xf76ff000, 0xf7700000, 'rw-p', '/lib32/ld-2.19.so'],
|
42
|
+
[0xffdd7000, 0xffdf8000, 'rw-p', '[stack]']]
|
43
|
+
end
|
44
|
+
it '64bit' do
|
45
|
+
maps = IO.binread(@files_dir + '/64bit_maps')
|
46
|
+
expect(HeapInfo::Helper.parse_maps maps).to eq [
|
47
|
+
[0x400000, 0x401000, 'r-xp', '/home/heapinfo/examples/uaf/uaf'],
|
48
|
+
[0x600000, 0x601000, 'r--p', '/home/heapinfo/examples/uaf/uaf'],
|
49
|
+
[0x601000, 0x602000, 'rw-p', '/home/heapinfo/examples/uaf/uaf'],
|
50
|
+
[0x7f65ac7b8000, 0x7f65ac7ce000, 'r-xp', '/lib/x86_64-linux-gnu/libgcc_s.so.1'],
|
51
|
+
[0x7f65ac7ce000, 0x7f65ac9cd000, '---p', '/lib/x86_64-linux-gnu/libgcc_s.so.1'],
|
52
|
+
[0x7f65ac9cd000, 0x7f65ac9ce000, 'rw-p', '/lib/x86_64-linux-gnu/libgcc_s.so.1'],
|
53
|
+
[0x7f65ac9ce000, 0x7f65acad3000, 'r-xp', '/lib/x86_64-linux-gnu/libm-2.19.so'],
|
54
|
+
[0x7f65acad3000, 0x7f65accd2000, '---p', '/lib/x86_64-linux-gnu/libm-2.19.so'],
|
55
|
+
[0x7f65accd2000, 0x7f65accd3000, 'r--p', '/lib/x86_64-linux-gnu/libm-2.19.so'],
|
56
|
+
[0x7f65accd3000, 0x7f65accd4000, 'rw-p', '/lib/x86_64-linux-gnu/libm-2.19.so'],
|
57
|
+
[0x7f65accd4000, 0x7f65ace8f000, 'r-xp', '/lib/x86_64-linux-gnu/libc-2.19.so'],
|
58
|
+
[0x7f65ace8f000, 0x7f65ad08e000, '---p', '/lib/x86_64-linux-gnu/libc-2.19.so'],
|
59
|
+
[0x7f65ad08e000, 0x7f65ad092000, 'r--p', '/lib/x86_64-linux-gnu/libc-2.19.so'],
|
60
|
+
[0x7f65ad092000, 0x7f65ad094000, 'rw-p', '/lib/x86_64-linux-gnu/libc-2.19.so'],
|
61
|
+
[0x7f65ad099000, 0x7f65ad17f000, 'r-xp', '/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19'],
|
62
|
+
[0x7f65ad17f000, 0x7f65ad37e000, '---p', '/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19'],
|
63
|
+
[0x7f65ad37e000, 0x7f65ad386000, 'r--p', '/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19'],
|
64
|
+
[0x7f65ad386000, 0x7f65ad388000, 'rw-p', '/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19'],
|
65
|
+
[0x7f65ad39d000, 0x7f65ad3c0000, 'r-xp', '/lib/x86_64-linux-gnu/ld-2.19.so'],
|
66
|
+
[0x7f65ad5bf000, 0x7f65ad5c0000, 'r--p', '/lib/x86_64-linux-gnu/ld-2.19.so'],
|
67
|
+
[0x7f65ad5c0000, 0x7f65ad5c1000, 'rw-p', '/lib/x86_64-linux-gnu/ld-2.19.so'],
|
68
|
+
[0x7fff3d1e8000, 0x7fff3d209000, 'rw-p', '[stack]'],
|
69
|
+
[0x7fff3d309000, 0x7fff3d30b000, 'r-xp', '[vdso]'],
|
70
|
+
[0xffffffffff600000, 0xffffffffff601000, 'r-xp', '[vsyscall]']]
|
71
|
+
end
|
72
|
+
end
|
73
|
+
end
|
data/spec/nil_spec.rb
ADDED
@@ -0,0 +1,15 @@
|
|
1
|
+
require 'heapinfo'
|
2
|
+
describe HeapInfo::Nil do
|
3
|
+
before(:all) do
|
4
|
+
@nil = HeapInfo::Nil.new
|
5
|
+
end
|
6
|
+
it 'nil?' do
|
7
|
+
expect(@nil.nil?).to be true
|
8
|
+
end
|
9
|
+
it 'nil chain' do
|
10
|
+
expect(@nil.xdd.oao.no_method).to be @nil
|
11
|
+
end
|
12
|
+
it 'puts' do
|
13
|
+
expect(puts @nil).to be nil
|
14
|
+
end
|
15
|
+
end
|
@@ -0,0 +1,157 @@
|
|
1
|
+
# encoding: ascii-8bit
|
2
|
+
require 'heapinfo'
|
3
|
+
describe HeapInfo::Process do
|
4
|
+
describe 'self' do
|
5
|
+
before(:all) do
|
6
|
+
@prog = File.readlink('/proc/self/exe')
|
7
|
+
@h = HeapInfo::Process.new(@prog)
|
8
|
+
@h.instance_variable_set(:@pid, 'self')
|
9
|
+
end
|
10
|
+
it 'segments' do
|
11
|
+
expect(@h.elf.name).to eq @prog
|
12
|
+
expect(@h.libc.class).to eq HeapInfo::Libc
|
13
|
+
expect(@h.respond_to? :heap).to be true
|
14
|
+
expect(@h.respond_to? :ld).to be true
|
15
|
+
expect(@h.respond_to? :stack).to be true
|
16
|
+
end
|
17
|
+
|
18
|
+
it 'dump' do
|
19
|
+
expect(@h.dump(:elf, 4)).to eq "\x7fELF"
|
20
|
+
end
|
21
|
+
|
22
|
+
it 'dump_chunks' do
|
23
|
+
expect(@h.dump_chunks(:heap, 0x30).class).to be HeapInfo::Chunks
|
24
|
+
end
|
25
|
+
end
|
26
|
+
|
27
|
+
describe 'victim' do
|
28
|
+
before(:all) do
|
29
|
+
@victim = HeapInfo::TMP_DIR + '/victim'
|
30
|
+
%x(g++ #{File.expand_path('../files/victim.cpp', __FILE__)} -o #{@victim} 2>&1 > /dev/null)
|
31
|
+
pid = fork
|
32
|
+
# run without ASLR
|
33
|
+
exec "setarch `uname -m` -R /bin/sh -c #{@victim}" if pid.nil?
|
34
|
+
loop until `pidof #{@victim}` != ''
|
35
|
+
@h = heapinfo(@victim, ld: '/ld')
|
36
|
+
class Cio;def puts(s);s;end;end
|
37
|
+
@io = Cio.new
|
38
|
+
end
|
39
|
+
after(:all) do
|
40
|
+
%x(killall #{@victim})
|
41
|
+
FileUtils.rm(@victim)
|
42
|
+
end
|
43
|
+
|
44
|
+
it 'check process' do
|
45
|
+
expect(@h.elf.name).to eq @victim
|
46
|
+
pid = @h.pid
|
47
|
+
expect(pid.is_a? Integer).to be true
|
48
|
+
expect(HeapInfo::Process.new(pid).elf.name).to eq @h.elf.name
|
49
|
+
end
|
50
|
+
|
51
|
+
it 'x' do
|
52
|
+
expect(@h.x 3, :heap, io: @io).to eq "0x602000:\t\e[38;5;12m0x0000000000000000\e[0m\t\e[38;5;12m0x0000000000000021\e[0m\n0x602010:\t\e[38;5;12m0x0000000000000000\e[0m"
|
53
|
+
expect(@h.x 2, 'heap+0x20', io: @io).to eq "0x602020:\t\e[38;5;12m0x0000000000000000\e[0m\t\e[38;5;12m0x0000000000000021\e[0m"
|
54
|
+
end
|
55
|
+
|
56
|
+
it 'debug wrapper' do
|
57
|
+
@h.instance_variable_set(:@pid, nil)
|
58
|
+
# will reload pid
|
59
|
+
expect(@h.debug { @h.to_s }).to eq @h.to_s
|
60
|
+
end
|
61
|
+
|
62
|
+
it 'main_arena' do
|
63
|
+
expect(@h.libc.main_arena.top_chunk.size_t).to eq 8
|
64
|
+
expect(@h.libc.main_arena.fastbin.size).to eq 7
|
65
|
+
end
|
66
|
+
|
67
|
+
describe 'find/search' do
|
68
|
+
it 'faraway' do
|
69
|
+
expect(@h.find('/bin/sh', :libc).is_a? Integer).to be true
|
70
|
+
end
|
71
|
+
it 'value' do
|
72
|
+
expect(@h.search(0xdeadbeef, :heap)).to eq 0x602050
|
73
|
+
end
|
74
|
+
it 'not found' do
|
75
|
+
expect(@h.search(0xdeadbeef, :heap, 0x4f)).to be nil
|
76
|
+
expect(@h.search(0xdead1234ddddd, :heap)).to be nil
|
77
|
+
end
|
78
|
+
it 'string' do
|
79
|
+
expect(@h.search("\xbe\xad", :heap)).to eq 0x602051
|
80
|
+
end
|
81
|
+
it 'regexp' do
|
82
|
+
expect(@h.search(/[^\x00]/, :heap)).to eq 0x602008
|
83
|
+
end
|
84
|
+
end
|
85
|
+
|
86
|
+
describe 'fastbin' do
|
87
|
+
it 'normal' do
|
88
|
+
expect(@h.libc.main_arena.fastbin[0].list).to eq [0x602020, 0x602000, nil]
|
89
|
+
end
|
90
|
+
|
91
|
+
it 'invalid' do
|
92
|
+
expect(@h.libc.main_arena.fastbin[1].list).to eq [0x602040, 0xdeadbeef, :invalid]
|
93
|
+
end
|
94
|
+
|
95
|
+
it 'loop' do
|
96
|
+
expect(@h.libc.main_arena.fastbin[2].list).to eq [0x602070, 0x6020b0, 0x602070, :loop]
|
97
|
+
end
|
98
|
+
|
99
|
+
it 'fastbin' do
|
100
|
+
lay = @h.layouts :fastbin, io: @io
|
101
|
+
expect(lay).to include '0xdeadbeef'
|
102
|
+
expect(lay).to include '(nil)'
|
103
|
+
expect(lay).to include '(invalid)'
|
104
|
+
expect(lay).to include '(loop)'
|
105
|
+
end
|
106
|
+
end
|
107
|
+
|
108
|
+
describe 'otherbin' do
|
109
|
+
it 'unsorted' do
|
110
|
+
list = @h.libc.main_arena.unsorted_bin.link_list 1
|
111
|
+
expect(list).to eq [0x6021d0, @h.libc.main_arena.unsorted_bin.base, 0x6021d0]
|
112
|
+
end
|
113
|
+
it 'normal' do
|
114
|
+
list = @h.libc.main_arena.smallbin[0].link_list 1
|
115
|
+
base = @h.libc.main_arena.smallbin[0].base
|
116
|
+
expect(list).to eq [0x6020f0, base, 0x6020f0]
|
117
|
+
end
|
118
|
+
it 'layouts' do
|
119
|
+
inspect = @h.layouts :smallbin, :unsorted_bin, io: @io
|
120
|
+
expect(inspect).to include "[self]"
|
121
|
+
expect(inspect).to include '0x6020f0'
|
122
|
+
expect(inspect).to include 'UnsortedBin'
|
123
|
+
end
|
124
|
+
end
|
125
|
+
|
126
|
+
describe 'chunks' do
|
127
|
+
before(:all) do
|
128
|
+
mmap_addr = HeapInfo::Helper.unpack(8, @h.dump(:heap, 0x190, 8))
|
129
|
+
@mmap_chunk = @h.dump(mmap_addr-0x10, 0x20).to_chunk(base: mmap_addr-0x10)
|
130
|
+
end
|
131
|
+
it 'mmap' do
|
132
|
+
expect(@mmap_chunk.base & 0xfff).to be 0
|
133
|
+
expect(@mmap_chunk.bintype).to eq :mmap
|
134
|
+
expect(@mmap_chunk.flags).to eq [:mmapped]
|
135
|
+
expect(@mmap_chunk.to_s).to include ':mmapped'
|
136
|
+
end
|
137
|
+
end
|
138
|
+
end
|
139
|
+
|
140
|
+
describe 'no process' do
|
141
|
+
before(:all) do
|
142
|
+
@h = heapinfo('NO_SUCH_PROCESS~~~')
|
143
|
+
end
|
144
|
+
it 'dump like' do
|
145
|
+
expect(@h.dump(:heap).nil?).to be true
|
146
|
+
expect(@h.dump_chunks(:heap).nil?).to be true
|
147
|
+
end
|
148
|
+
|
149
|
+
it 'debug wrapper' do
|
150
|
+
expect(@h.debug{ fail }).to be nil
|
151
|
+
end
|
152
|
+
|
153
|
+
it 'nil chain' do
|
154
|
+
expect(@h.dump(:heap).no_such_method.xdd.nil?).to be true
|
155
|
+
end
|
156
|
+
end
|
157
|
+
end
|
data/spec/spec_helper.rb
ADDED
@@ -0,0 +1,98 @@
|
|
1
|
+
require "codeclimate-test-reporter"
|
2
|
+
CodeClimate::TestReporter.start
|
3
|
+
# This file was generated by the `rspec --init` command. Conventionally, all
|
4
|
+
# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
|
5
|
+
# The generated `.rspec` file contains `--require spec_helper` which will cause
|
6
|
+
# this file to always be loaded, without a need to explicitly require it in any
|
7
|
+
# files.
|
8
|
+
#
|
9
|
+
# Given that it is always loaded, you are encouraged to keep this file as
|
10
|
+
# light-weight as possible. Requiring heavyweight dependencies from this file
|
11
|
+
# will add to the boot time of your test suite on EVERY test run, even for an
|
12
|
+
# individual file that may not need all of that loaded. Instead, consider making
|
13
|
+
# a separate helper file that requires the additional dependencies and performs
|
14
|
+
# the additional setup, and require it from the spec files that actually need
|
15
|
+
# it.
|
16
|
+
#
|
17
|
+
# The `.rspec` file also contains a few flags that are not defaults but that
|
18
|
+
# users commonly want.
|
19
|
+
#
|
20
|
+
# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
|
21
|
+
RSpec.configure do |config|
|
22
|
+
# rspec-expectations config goes here. You can use an alternate
|
23
|
+
# assertion/expectation library such as wrong or the stdlib/minitest
|
24
|
+
# assertions if you prefer.
|
25
|
+
config.expect_with :rspec do |expectations|
|
26
|
+
# This option will default to `true` in RSpec 4. It makes the `description`
|
27
|
+
# and `failure_message` of custom matchers include text for helper methods
|
28
|
+
# defined using `chain`, e.g.:
|
29
|
+
# be_bigger_than(2).and_smaller_than(4).description
|
30
|
+
# # => "be bigger than 2 and smaller than 4"
|
31
|
+
# ...rather than:
|
32
|
+
# # => "be bigger than 2"
|
33
|
+
expectations.include_chain_clauses_in_custom_matcher_descriptions = true
|
34
|
+
end
|
35
|
+
|
36
|
+
# rspec-mocks config goes here. You can use an alternate test double
|
37
|
+
# library (such as bogus or mocha) by changing the `mock_with` option here.
|
38
|
+
config.mock_with :rspec do |mocks|
|
39
|
+
# Prevents you from mocking or stubbing a method that does not exist on
|
40
|
+
# a real object. This is generally recommended, and will default to
|
41
|
+
# `true` in RSpec 4.
|
42
|
+
mocks.verify_partial_doubles = true
|
43
|
+
end
|
44
|
+
|
45
|
+
# The settings below are suggested to provide a good initial experience
|
46
|
+
# with RSpec, but feel free to customize to your heart's content.
|
47
|
+
=begin
|
48
|
+
# These two settings work together to allow you to limit a spec run
|
49
|
+
# to individual examples or groups you care about by tagging them with
|
50
|
+
# `:focus` metadata. When nothing is tagged with `:focus`, all examples
|
51
|
+
# get run.
|
52
|
+
config.filter_run :focus
|
53
|
+
config.run_all_when_everything_filtered = true
|
54
|
+
|
55
|
+
# Allows RSpec to persist some state between runs in order to support
|
56
|
+
# the `--only-failures` and `--next-failure` CLI options. We recommend
|
57
|
+
# you configure your source control system to ignore this file.
|
58
|
+
config.example_status_persistence_file_path = "spec/examples.txt"
|
59
|
+
|
60
|
+
# Limits the available syntax to the non-monkey patched syntax that is
|
61
|
+
# recommended. For more details, see:
|
62
|
+
# - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/
|
63
|
+
# - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
|
64
|
+
# - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode
|
65
|
+
config.disable_monkey_patching!
|
66
|
+
|
67
|
+
# This setting enables warnings. It's recommended, but in some cases may
|
68
|
+
# be too noisy due to issues in dependencies.
|
69
|
+
config.warnings = true
|
70
|
+
|
71
|
+
# Many RSpec users commonly either run the entire suite or an individual
|
72
|
+
# file, and it's useful to allow more verbose output when running an
|
73
|
+
# individual spec file.
|
74
|
+
if config.files_to_run.one?
|
75
|
+
# Use the documentation formatter for detailed output,
|
76
|
+
# unless a formatter has already been configured
|
77
|
+
# (e.g. via a command-line flag).
|
78
|
+
config.default_formatter = 'doc'
|
79
|
+
end
|
80
|
+
|
81
|
+
# Print the 10 slowest examples and example groups at the
|
82
|
+
# end of the spec run, to help surface which specs are running
|
83
|
+
# particularly slow.
|
84
|
+
config.profile_examples = 10
|
85
|
+
|
86
|
+
# Run specs in random order to surface order dependencies. If you find an
|
87
|
+
# order dependency and want to debug it, you can fix the order by providing
|
88
|
+
# the seed, which is printed after each run.
|
89
|
+
# --seed 1234
|
90
|
+
config.order = :random
|
91
|
+
|
92
|
+
# Seed global randomization in this process using the `--seed` CLI option.
|
93
|
+
# Setting this allows you to use `--seed` to deterministically reproduce
|
94
|
+
# test failures related to randomization by passing the same `--seed` value
|
95
|
+
# as the one that triggered the failure.
|
96
|
+
Kernel.srand config.seed
|
97
|
+
=end
|
98
|
+
end
|
data/spec/string_spec.rb
ADDED
@@ -0,0 +1,18 @@
|
|
1
|
+
# encoding: ascii-8bit
|
2
|
+
require 'heapinfo'
|
3
|
+
describe String do
|
4
|
+
it 'to_chunk' do
|
5
|
+
chunk = "\x00\x00\x00\x00\x00\x00\x00\x00g\x00\x00\x00\x00\x00\x00\x00".to_chunk
|
6
|
+
expect(chunk.class).to be HeapInfo::Chunk
|
7
|
+
expect(chunk.size).to be 0x60
|
8
|
+
expect(chunk.flags).to eq [:non_main_arena, :mmapped, :prev_inuse]
|
9
|
+
end
|
10
|
+
|
11
|
+
it 'to_chunks' do
|
12
|
+
chunks = [0,0x21,0,0,0,0x41].pack("Q*").to_chunks
|
13
|
+
expect(chunks.size).to be 2
|
14
|
+
chunks.each{|chunk| # test each
|
15
|
+
expect(chunk.size & 15).to be 0
|
16
|
+
}
|
17
|
+
end
|
18
|
+
end
|
metadata
ADDED
@@ -0,0 +1,81 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: heapinfo
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.0.0
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- david942j
|
8
|
+
autorequire:
|
9
|
+
bindir: bin
|
10
|
+
cert_chain: []
|
11
|
+
date: 2016-05-21 00:00:00.000000000 Z
|
12
|
+
dependencies: []
|
13
|
+
description: create an interactive heap info interface while exploiting binary (with
|
14
|
+
glibc) with ruby
|
15
|
+
email:
|
16
|
+
- david942j@gmail.com
|
17
|
+
executables: []
|
18
|
+
extensions: []
|
19
|
+
extra_rdoc_files: []
|
20
|
+
files:
|
21
|
+
- README.md
|
22
|
+
- lib/heapinfo.rb
|
23
|
+
- lib/heapinfo/arena.rb
|
24
|
+
- lib/heapinfo/chunk.rb
|
25
|
+
- lib/heapinfo/chunks.rb
|
26
|
+
- lib/heapinfo/dumper.rb
|
27
|
+
- lib/heapinfo/ext/string.rb
|
28
|
+
- lib/heapinfo/helper.rb
|
29
|
+
- lib/heapinfo/libc.rb
|
30
|
+
- lib/heapinfo/nil.rb
|
31
|
+
- lib/heapinfo/process.rb
|
32
|
+
- lib/heapinfo/segment.rb
|
33
|
+
- lib/heapinfo/tools/get_arena.c
|
34
|
+
- lib/heapinfo/version.rb
|
35
|
+
- spec/chunk_spec.rb
|
36
|
+
- spec/chunks_spec.rb
|
37
|
+
- spec/dumper_spec.rb
|
38
|
+
- spec/files/32bit_maps
|
39
|
+
- spec/files/64bit_maps
|
40
|
+
- spec/files/victim.cpp
|
41
|
+
- spec/helper_spec.rb
|
42
|
+
- spec/nil_spec.rb
|
43
|
+
- spec/process_spec.rb
|
44
|
+
- spec/spec_helper.rb
|
45
|
+
- spec/string_spec.rb
|
46
|
+
homepage: https://github.com/david942j/heapinfo
|
47
|
+
licenses:
|
48
|
+
- MIT
|
49
|
+
metadata: {}
|
50
|
+
post_install_message:
|
51
|
+
rdoc_options: []
|
52
|
+
require_paths:
|
53
|
+
- lib
|
54
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
55
|
+
requirements:
|
56
|
+
- - ">="
|
57
|
+
- !ruby/object:Gem::Version
|
58
|
+
version: 2.1.0
|
59
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
60
|
+
requirements:
|
61
|
+
- - ">="
|
62
|
+
- !ruby/object:Gem::Version
|
63
|
+
version: '0'
|
64
|
+
requirements: []
|
65
|
+
rubyforge_project:
|
66
|
+
rubygems_version: 2.4.8
|
67
|
+
signing_key:
|
68
|
+
specification_version: 4
|
69
|
+
summary: HeapInfo - interactive heap exploitation helper
|
70
|
+
test_files:
|
71
|
+
- spec/chunk_spec.rb
|
72
|
+
- spec/files/32bit_maps
|
73
|
+
- spec/files/64bit_maps
|
74
|
+
- spec/files/victim.cpp
|
75
|
+
- spec/helper_spec.rb
|
76
|
+
- spec/string_spec.rb
|
77
|
+
- spec/spec_helper.rb
|
78
|
+
- spec/nil_spec.rb
|
79
|
+
- spec/chunks_spec.rb
|
80
|
+
- spec/dumper_spec.rb
|
81
|
+
- spec/process_spec.rb
|