heapinfo 0.0.5 → 0.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +1 -0
- data/lib/heapinfo.rb +8 -8
- data/lib/heapinfo/arena.rb +47 -45
- data/lib/heapinfo/cache.rb +12 -13
- data/lib/heapinfo/chunk.rb +23 -23
- data/lib/heapinfo/chunks.rb +16 -5
- data/lib/heapinfo/dumper.rb +55 -44
- data/lib/heapinfo/ext/string.rb +2 -2
- data/lib/heapinfo/glibc/error.rb +2 -1
- data/lib/heapinfo/glibc/free.rb +29 -16
- data/lib/heapinfo/glibc/glibc.rb +5 -1
- data/lib/heapinfo/glibc/helper.rb +9 -6
- data/lib/heapinfo/helper.rb +22 -26
- data/lib/heapinfo/libc.rb +18 -17
- data/lib/heapinfo/nil.rb +14 -8
- data/lib/heapinfo/process.rb +34 -25
- data/lib/heapinfo/process_info.rb +15 -14
- data/lib/heapinfo/segment.rb +10 -9
- data/lib/heapinfo/tools/get_arena.c +0 -1
- data/lib/heapinfo/version.rb +1 -1
- metadata +75 -31
- data/spec/cache_spec.rb +0 -46
- data/spec/chunk_spec.rb +0 -40
- data/spec/chunks_spec.rb +0 -25
- data/spec/dumper_spec.rb +0 -105
- data/spec/files/32bit_maps +0 -23
- data/spec/files/64bit_maps +0 -29
- data/spec/files/victim.cpp +0 -33
- data/spec/helper_spec.rb +0 -73
- data/spec/libc_spec.rb +0 -75
- data/spec/nil_spec.rb +0 -15
- data/spec/process_spec.rb +0 -201
- data/spec/spec_helper.rb +0 -98
- data/spec/string_spec.rb +0 -18
data/spec/nil_spec.rb
DELETED
@@ -1,15 +0,0 @@
|
|
1
|
-
require 'heapinfo'
|
2
|
-
describe HeapInfo::Nil do
|
3
|
-
before(:all) do
|
4
|
-
@nil = HeapInfo::Nil.new
|
5
|
-
end
|
6
|
-
it 'nil?' do
|
7
|
-
expect(@nil.nil?).to be true
|
8
|
-
end
|
9
|
-
it 'nil chain' do
|
10
|
-
expect(@nil.xdd.oao.no_method).to be @nil
|
11
|
-
end
|
12
|
-
it 'puts' do
|
13
|
-
expect(puts @nil).to be nil
|
14
|
-
end
|
15
|
-
end
|
data/spec/process_spec.rb
DELETED
@@ -1,201 +0,0 @@
|
|
1
|
-
# encoding: ascii-8bit
|
2
|
-
require 'heapinfo'
|
3
|
-
describe HeapInfo::Process do
|
4
|
-
describe 'self' do
|
5
|
-
before(:all) do
|
6
|
-
@prog = File.readlink('/proc/self/exe')
|
7
|
-
@h = HeapInfo::Process.new(@prog)
|
8
|
-
@h.instance_variable_set(:@pid, 'self')
|
9
|
-
end
|
10
|
-
it 'segments' do
|
11
|
-
expect(@h.elf.name).to eq @prog
|
12
|
-
expect(@h.libc.class).to eq HeapInfo::Libc
|
13
|
-
expect(@h.respond_to? :heap).to be true
|
14
|
-
expect(@h.respond_to? :ld).to be true
|
15
|
-
expect(@h.respond_to? :stack).to be true
|
16
|
-
end
|
17
|
-
|
18
|
-
it 'dump' do
|
19
|
-
expect(@h.dump(:elf, 4)).to eq "\x7fELF"
|
20
|
-
end
|
21
|
-
|
22
|
-
it 'dump_chunks' do
|
23
|
-
expect(@h.dump_chunks(:heap, 0x30).class).to be HeapInfo::Chunks
|
24
|
-
end
|
25
|
-
end
|
26
|
-
|
27
|
-
describe 'victim' do
|
28
|
-
before(:all) do
|
29
|
-
HeapInfo::Cache.send :clear_all # force cache miss, to make sure coverage
|
30
|
-
@victim = HeapInfo::TMP_DIR + '/victim'
|
31
|
-
%x(g++ #{File.expand_path('../files/victim.cpp', __FILE__)} -o #{@victim} 2>&1 > /dev/null)
|
32
|
-
pid = fork
|
33
|
-
# run without ASLR
|
34
|
-
exec "setarch `uname -m` -R /bin/sh -c #{@victim}" if pid.nil?
|
35
|
-
loop until `pidof #{@victim}` != ''
|
36
|
-
@h = heapinfo(@victim, ld: '/ld')
|
37
|
-
class Cio;def puts(s);s;end;end
|
38
|
-
@io = Cio.new
|
39
|
-
end
|
40
|
-
after(:all) do
|
41
|
-
`killall #{@victim}`
|
42
|
-
FileUtils.rm(@victim)
|
43
|
-
end
|
44
|
-
|
45
|
-
it 'check process' do
|
46
|
-
expect(@h.elf.name).to eq @victim
|
47
|
-
pid = @h.pid
|
48
|
-
expect(pid.is_a? Integer).to be true
|
49
|
-
expect(HeapInfo::Process.new(pid).elf.name).to eq @h.elf.name
|
50
|
-
end
|
51
|
-
|
52
|
-
it 'x' do
|
53
|
-
expect(@h.x 3, :heap, io: @io).to eq "0x602000:\t\e[38;5;12m0x0000000000000000\e[0m\t\e[38;5;12m0x0000000000000021\e[0m\n0x602010:\t\e[38;5;12m0x0000000000000000\e[0m"
|
54
|
-
expect(@h.x 2, 'heap+0x20', io: @io).to eq "0x602020:\t\e[38;5;12m0x0000000000000000\e[0m\t\e[38;5;12m0x0000000000000021\e[0m"
|
55
|
-
end
|
56
|
-
|
57
|
-
it 'debug wrapper' do
|
58
|
-
@h.instance_variable_set(:@pid, nil)
|
59
|
-
# will reload pid
|
60
|
-
expect(@h.debug { @h.to_s }).to eq @h.to_s
|
61
|
-
end
|
62
|
-
|
63
|
-
it 'main_arena' do
|
64
|
-
expect(@h.libc.main_arena.top_chunk.size_t).to eq 8
|
65
|
-
expect(@h.libc.main_arena.fastbin.size).to eq 7
|
66
|
-
end
|
67
|
-
|
68
|
-
describe 'find/search' do
|
69
|
-
it 'faraway' do
|
70
|
-
expect(@h.find('/bin/sh', :libc).is_a? Integer).to be true
|
71
|
-
end
|
72
|
-
it 'value' do
|
73
|
-
expect(@h.search(0xdeadbeef, :heap)).to eq 0x602050
|
74
|
-
end
|
75
|
-
it 'not found' do
|
76
|
-
expect(@h.search(0xdeadbeef, :heap, 0x4f)).to be nil
|
77
|
-
expect(@h.search(0xdead1234ddddd, :heap)).to be nil
|
78
|
-
end
|
79
|
-
it 'string' do
|
80
|
-
expect(@h.search("\xbe\xad", :heap)).to eq 0x602051
|
81
|
-
end
|
82
|
-
it 'regexp' do
|
83
|
-
expect(@h.search(/[^\x00]/, :heap)).to eq 0x602008
|
84
|
-
end
|
85
|
-
end
|
86
|
-
|
87
|
-
describe 'reload' do
|
88
|
-
it 'monkey' do
|
89
|
-
prog = File.readlink('/proc/self/exe')
|
90
|
-
@h = HeapInfo::Process.new(prog)
|
91
|
-
expect(@h.pid.is_a? Integer).to be true
|
92
|
-
pid = @h.pid
|
93
|
-
@h.instance_variable_set(:@prog, 'NO_THIS')
|
94
|
-
expect(@h.reload!.pid).to be nil
|
95
|
-
@h.instance_variable_set(:@prog, prog)
|
96
|
-
expect(@h.reload!.pid).to be pid
|
97
|
-
end
|
98
|
-
end
|
99
|
-
|
100
|
-
describe 'fastbin' do
|
101
|
-
it 'normal' do
|
102
|
-
expect(@h.libc.main_arena.fastbin[0].list).to eq [0x602020, 0x602000, nil]
|
103
|
-
end
|
104
|
-
|
105
|
-
it 'invalid' do
|
106
|
-
expect(@h.libc.main_arena.fastbin[1].list).to eq [0x602040, 0xdeadbeef, :invalid]
|
107
|
-
end
|
108
|
-
|
109
|
-
it 'loop' do
|
110
|
-
expect(@h.libc.main_arena.fastbin[2].list).to eq [0x602070, 0x6020b0, 0x602070, :loop]
|
111
|
-
end
|
112
|
-
|
113
|
-
it 'fastbin' do
|
114
|
-
lay = @h.layouts :fastbin, io: @io
|
115
|
-
expect(lay).to include '0xdeadbeef'
|
116
|
-
expect(lay).to include '(nil)'
|
117
|
-
expect(lay).to include '(invalid)'
|
118
|
-
expect(lay).to include '(loop)'
|
119
|
-
end
|
120
|
-
end
|
121
|
-
|
122
|
-
describe 'otherbin' do
|
123
|
-
it 'unsorted' do
|
124
|
-
list = @h.libc.main_arena.unsorted_bin.link_list 1
|
125
|
-
expect(list).to eq [0x6021d0, @h.libc.main_arena.unsorted_bin.base, 0x6021d0]
|
126
|
-
end
|
127
|
-
it 'normal' do
|
128
|
-
list = @h.libc.main_arena.smallbin[0].link_list 1
|
129
|
-
base = @h.libc.main_arena.smallbin[0].base
|
130
|
-
expect(list).to eq [0x6020f0, base, 0x6020f0]
|
131
|
-
end
|
132
|
-
it 'layouts' do
|
133
|
-
inspect = @h.layouts :smallbin, :unsorted_bin, io: @io
|
134
|
-
expect(inspect).to include "[self]"
|
135
|
-
expect(inspect).to include '0x6020f0'
|
136
|
-
expect(inspect).to include 'UnsortedBin'
|
137
|
-
end
|
138
|
-
end
|
139
|
-
|
140
|
-
describe 'chunks' do
|
141
|
-
before(:all) do
|
142
|
-
mmap_addr = HeapInfo::Helper.unpack(8, @h.dump(:heap, 0x190, 8))
|
143
|
-
@mmap_chunk = @h.dump(mmap_addr-0x10, 0x20).to_chunk(base: mmap_addr-0x10)
|
144
|
-
end
|
145
|
-
it 'mmap' do
|
146
|
-
expect(@mmap_chunk.base & 0xfff).to be 0
|
147
|
-
expect(@mmap_chunk.bintype).to eq :mmap
|
148
|
-
expect(@mmap_chunk.flags).to eq [:mmapped]
|
149
|
-
expect(@mmap_chunk.to_s).to include ':mmapped'
|
150
|
-
end
|
151
|
-
end
|
152
|
-
end
|
153
|
-
|
154
|
-
describe 'static-link' do
|
155
|
-
before(:all) do
|
156
|
-
@victim = HeapInfo::TMP_DIR + '/victim'
|
157
|
-
%x(g++ -static #{File.expand_path('../files/victim.cpp', __FILE__)} -o #{@victim} 2>&1 > /dev/null)
|
158
|
-
pid = fork
|
159
|
-
# run without ASLR
|
160
|
-
exec "setarch `uname -m` -R /bin/sh -c #{@victim}" if pid.nil?
|
161
|
-
loop until `pidof #{@victim}` != ''
|
162
|
-
@h = heapinfo(@victim)
|
163
|
-
end
|
164
|
-
|
165
|
-
after(:all) do
|
166
|
-
`killall #{@victim}`
|
167
|
-
FileUtils.rm(@victim)
|
168
|
-
end
|
169
|
-
|
170
|
-
it 'normal' do
|
171
|
-
expect(@h.libc).to be_a HeapInfo::Nil
|
172
|
-
expect(@h.ld).to be_a HeapInfo::Nil
|
173
|
-
end
|
174
|
-
|
175
|
-
it 'dump' do
|
176
|
-
expect(@h.dump :elf, 4).to eq "\x7fELF"
|
177
|
-
end
|
178
|
-
end
|
179
|
-
|
180
|
-
describe 'no process' do
|
181
|
-
before(:all) do
|
182
|
-
@h = heapinfo('NO_SUCH_PROCESS~~~')
|
183
|
-
end
|
184
|
-
it 'dump like' do
|
185
|
-
expect(@h.dump(:heap).nil?).to be true
|
186
|
-
expect(@h.dump_chunks(:heap).nil?).to be true
|
187
|
-
end
|
188
|
-
|
189
|
-
it 'debug wrapper' do
|
190
|
-
expect(@h.debug{ fail }).to be nil
|
191
|
-
end
|
192
|
-
|
193
|
-
it 'nil chain' do
|
194
|
-
expect(@h.dump(:heap).no_such_method.xdd.nil?).to be true
|
195
|
-
end
|
196
|
-
|
197
|
-
it 'info methods' do
|
198
|
-
expect(@h.libc.base.nil?).to be true
|
199
|
-
end
|
200
|
-
end
|
201
|
-
end
|
data/spec/spec_helper.rb
DELETED
@@ -1,98 +0,0 @@
|
|
1
|
-
require "codeclimate-test-reporter"
|
2
|
-
CodeClimate::TestReporter.start
|
3
|
-
# This file was generated by the `rspec --init` command. Conventionally, all
|
4
|
-
# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
|
5
|
-
# The generated `.rspec` file contains `--require spec_helper` which will cause
|
6
|
-
# this file to always be loaded, without a need to explicitly require it in any
|
7
|
-
# files.
|
8
|
-
#
|
9
|
-
# Given that it is always loaded, you are encouraged to keep this file as
|
10
|
-
# light-weight as possible. Requiring heavyweight dependencies from this file
|
11
|
-
# will add to the boot time of your test suite on EVERY test run, even for an
|
12
|
-
# individual file that may not need all of that loaded. Instead, consider making
|
13
|
-
# a separate helper file that requires the additional dependencies and performs
|
14
|
-
# the additional setup, and require it from the spec files that actually need
|
15
|
-
# it.
|
16
|
-
#
|
17
|
-
# The `.rspec` file also contains a few flags that are not defaults but that
|
18
|
-
# users commonly want.
|
19
|
-
#
|
20
|
-
# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
|
21
|
-
RSpec.configure do |config|
|
22
|
-
# rspec-expectations config goes here. You can use an alternate
|
23
|
-
# assertion/expectation library such as wrong or the stdlib/minitest
|
24
|
-
# assertions if you prefer.
|
25
|
-
config.expect_with :rspec do |expectations|
|
26
|
-
# This option will default to `true` in RSpec 4. It makes the `description`
|
27
|
-
# and `failure_message` of custom matchers include text for helper methods
|
28
|
-
# defined using `chain`, e.g.:
|
29
|
-
# be_bigger_than(2).and_smaller_than(4).description
|
30
|
-
# # => "be bigger than 2 and smaller than 4"
|
31
|
-
# ...rather than:
|
32
|
-
# # => "be bigger than 2"
|
33
|
-
expectations.include_chain_clauses_in_custom_matcher_descriptions = true
|
34
|
-
end
|
35
|
-
|
36
|
-
# rspec-mocks config goes here. You can use an alternate test double
|
37
|
-
# library (such as bogus or mocha) by changing the `mock_with` option here.
|
38
|
-
config.mock_with :rspec do |mocks|
|
39
|
-
# Prevents you from mocking or stubbing a method that does not exist on
|
40
|
-
# a real object. This is generally recommended, and will default to
|
41
|
-
# `true` in RSpec 4.
|
42
|
-
mocks.verify_partial_doubles = true
|
43
|
-
end
|
44
|
-
|
45
|
-
# The settings below are suggested to provide a good initial experience
|
46
|
-
# with RSpec, but feel free to customize to your heart's content.
|
47
|
-
=begin
|
48
|
-
# These two settings work together to allow you to limit a spec run
|
49
|
-
# to individual examples or groups you care about by tagging them with
|
50
|
-
# `:focus` metadata. When nothing is tagged with `:focus`, all examples
|
51
|
-
# get run.
|
52
|
-
config.filter_run :focus
|
53
|
-
config.run_all_when_everything_filtered = true
|
54
|
-
|
55
|
-
# Allows RSpec to persist some state between runs in order to support
|
56
|
-
# the `--only-failures` and `--next-failure` CLI options. We recommend
|
57
|
-
# you configure your source control system to ignore this file.
|
58
|
-
config.example_status_persistence_file_path = "spec/examples.txt"
|
59
|
-
|
60
|
-
# Limits the available syntax to the non-monkey patched syntax that is
|
61
|
-
# recommended. For more details, see:
|
62
|
-
# - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/
|
63
|
-
# - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
|
64
|
-
# - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode
|
65
|
-
config.disable_monkey_patching!
|
66
|
-
|
67
|
-
# This setting enables warnings. It's recommended, but in some cases may
|
68
|
-
# be too noisy due to issues in dependencies.
|
69
|
-
config.warnings = true
|
70
|
-
|
71
|
-
# Many RSpec users commonly either run the entire suite or an individual
|
72
|
-
# file, and it's useful to allow more verbose output when running an
|
73
|
-
# individual spec file.
|
74
|
-
if config.files_to_run.one?
|
75
|
-
# Use the documentation formatter for detailed output,
|
76
|
-
# unless a formatter has already been configured
|
77
|
-
# (e.g. via a command-line flag).
|
78
|
-
config.default_formatter = 'doc'
|
79
|
-
end
|
80
|
-
|
81
|
-
# Print the 10 slowest examples and example groups at the
|
82
|
-
# end of the spec run, to help surface which specs are running
|
83
|
-
# particularly slow.
|
84
|
-
config.profile_examples = 10
|
85
|
-
|
86
|
-
# Run specs in random order to surface order dependencies. If you find an
|
87
|
-
# order dependency and want to debug it, you can fix the order by providing
|
88
|
-
# the seed, which is printed after each run.
|
89
|
-
# --seed 1234
|
90
|
-
config.order = :random
|
91
|
-
|
92
|
-
# Seed global randomization in this process using the `--seed` CLI option.
|
93
|
-
# Setting this allows you to use `--seed` to deterministically reproduce
|
94
|
-
# test failures related to randomization by passing the same `--seed` value
|
95
|
-
# as the one that triggered the failure.
|
96
|
-
Kernel.srand config.seed
|
97
|
-
=end
|
98
|
-
end
|
data/spec/string_spec.rb
DELETED
@@ -1,18 +0,0 @@
|
|
1
|
-
# encoding: ascii-8bit
|
2
|
-
require 'heapinfo'
|
3
|
-
describe String do
|
4
|
-
it 'to_chunk' do
|
5
|
-
chunk = "\x00\x00\x00\x00\x00\x00\x00\x00g\x00\x00\x00\x00\x00\x00\x00".to_chunk
|
6
|
-
expect(chunk.class).to be HeapInfo::Chunk
|
7
|
-
expect(chunk.size).to be 0x60
|
8
|
-
expect(chunk.flags).to eq [:non_main_arena, :mmapped, :prev_inuse]
|
9
|
-
end
|
10
|
-
|
11
|
-
it 'to_chunks' do
|
12
|
-
chunks = [0,0x21,0,0,0,0x41].pack("Q*").to_chunks
|
13
|
-
expect(chunks.size).to be 2
|
14
|
-
chunks.each{|chunk| # test each
|
15
|
-
expect(chunk.size & 15).to be 0
|
16
|
-
}
|
17
|
-
end
|
18
|
-
end
|