heapinfo 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 961ba248f261232617b7ed7ee649fd3fc21b72b9
-  data.tar.gz: 7bffd6cf6c33d2a6868ec59ba9d8b3509ab1512f
+  metadata.gz: b734871451b91231d5c1c159633f1de9ad3255bb
+  data.tar.gz: 2742c1043b6466cad49415191c9753819e499e2d
 SHA512:
-  metadata.gz: 13d13edbcaab506b3b9044894f51bf10f5b9a32eb2e10d81a397f913a2488b947877d1d3747e1cb8d02f3f8304aa7c59e44f20ee3009bce20c7cd8c7f47ca658
-  data.tar.gz: 6680a5c6ab2a2483acbd0317d2dc3bf3871800d66136cd2d4263a23cff4b5367b5c10901e0788e21b3b4dc8af675fab1b270f1ac57d7d8c9bc1bea0162fb5b4a
+  metadata.gz: 93861f6cd8f05a68666e2e67caff87d810f784f42aac009a4db4ca7b90031dc792a6643f780f316e7e5b43211e34c18eb5bd4a9dab3634dfad44a17d43c9de24
+  data.tar.gz: e6349ece2cba17b12af3daafb2a62dad995e4a03b0ca83e33a35661ed6985db16cc26e4d50810dedc411ceef497537c964a2804c84a081887cddd3cb1159f4f1

data/README.md

@@ -9,7 +9,7 @@
 ## HeapInfo
 As pwn lovers, while playing CTF with heap exploitation, we always need a debugger (e.g. gdb) for tracking memory layout. But we don't really need gdb if we want to see whether the heap layout same as our imagine or not. Hope this small tool helps us exploit easier ;).
 
-#### Why
+### Why
 **HeapInfo** is very helpful when binary has somehow anti-debugger limitations, e.g being ptraced.
 **HeapInfo** still works because it doesn't use ptrace.
 
@@ -17,9 +17,7 @@ Implement with ruby because I love ruby :P. But might also implement with Python
 
 If you prefer [pwntools](https://github.com/Gallopsled/pwntools) for exploiting, you can still use **HeapInfo** in irb/pry as a small debugger.
 
-Any suggestion of features or bug issues is welcome.
-
-Related works are [pwntools-ruby](https://github.com/peter50216/pwntools-ruby) and [gdbpwn](https://github.com/scwuaptx/Pwngdb).
+Any suggestion of features or bug issues are welcome.
 
 ## Install
 **HeapInfo** is still under developing for more features, so the version might change frequently :p
@@ -156,12 +154,17 @@ h.find(/E.F/, 0x400000, 4)
 #=> 4194305 # 0x400001
 h.find(/E.F/, 0x400000, 3)
 #=> nil
+
+# Get relative offset of searching result
+h.find('/bin/sh', :libc, rel: true)
+#=> 1622391 # 0x18c177
 h.offset(h.find('/bin/sh', :libc))
 # 0x18c177 after libc
 ```
 
 ## Tests
 **HeapInfo** currently only run tests on ubuntu, followings are tested glibc versions:
+
 * libc-2.19
 * libc-2.23
 * libc-2.24

data/lib/heapinfo/arena.rb

@@ -47,8 +47,8 @@ module HeapInfo
         f
       end
       @unsorted_bin = UnsortedBin.new(size_t, top_ptr_offset, @dumper, head: true)
-      @smallbin = Array.new(55) do |idx|
-        s = Smallbin.new(size_t, @base + 8 + size_t * (26 + 2 * idx), @dumper, head: true)
+      @smallbin = Array.new(62) do |idx|
+        s = Smallbin.new(size_t, @base + 8 + size_t * (12 + 2 * idx), @dumper, head: true)
         s.index = idx
         s
       end
@@ -61,7 +61,9 @@ module HeapInfo
     # @return [String] Bin layouts that wrapper with color codes.
     # @example
     #   puts h.libc.main_arena.layouts(:fast, :unsorted, :small)
+    #   puts h.libc.main_arena.layouts(:all)
     def layouts(*args)
+      args.concat(%i[fast unsort small large]) if args.map(&:to_s).include?('all')
       args = args.map(&:to_s).join('|')
       res = ''
       res += fastbin.map(&:inspect).join if args.include?('fast')
@@ -227,7 +229,7 @@ module HeapInfo
     # Mapping index of smallbin to chunk size.
     # @return [Integer] size
     def idx_to_size
-      index * size_t * 2 + size_t * 18
+      index * size_t * 2 + size_t * 4
     end
   end
 

data/lib/heapinfo/cache.rb

@@ -38,8 +38,8 @@ module HeapInfo
         filepath = realpath(key)
         return unless File.file?(filepath)
         Marshal.load(IO.binread(filepath))
-      rescue
-        nil # handle if file content invalid
+      rescue TypeError, ArgumentError
+        nil # handle if file content is invalid
       end
 
       # Clear the cache directory.
@@ -53,7 +53,7 @@ module HeapInfo
       # @return [void]
       def init
         FileUtils.mkdir_p(CACHE_DIR)
-      rescue
+      rescue Errno::EACCES
         # To prevent ~/ is not writable.
         send(:remove_const, :CACHE_DIR)
         const_set(:CACHE_DIR, File.join(HeapInfo::TMP_DIR, '.cache/heapinfo'))

data/lib/heapinfo/chunk.rb

@@ -27,7 +27,10 @@ module HeapInfo
       @size_t = size_t
       @base = base
       sz = dump(@base, size_t * 2)
-      return @data = dump(@base + size_t * 2, size_t * 4) if head # no need to read size if is bin
+      if head # no need to read size if is bin
+        @data = dump(@base + size_t * 2, size_t * 4)
+        return
+      end
       @prev_size = Helper.unpack(size_t, sz[0, size_t])
       @size = Helper.unpack(size_t, sz[size_t..-1])
       r_size = [size - size_t * 2, size_t * 4].min # don't read too much data

data/lib/heapinfo/dumper.rb

@@ -30,7 +30,7 @@ module HeapInfo
       mem = file.readpartial len
       file.close
       mem
-    rescue => e
+    rescue => e # rubocop:disable Style/RescueStandardError
       raise e if e.is_a? ArgumentError
       nil
     end
@@ -67,6 +67,8 @@ module HeapInfo
       puts str
     end
 
+    # @api private
+    #
     # Search a specific value/string/regexp in memory.
     # +#find+ only return the first matched address.
     # @param [Integer, String, Regexp] pattern
@@ -75,22 +77,25 @@ module HeapInfo
     #   Start address for searching, can be segment(+Symbol+)
     #   or segments with offset. See examples for more information.
     # @param [Integer] length The length limit for searching.
+    # @param [Boolean] rel Return relative or absolute.
     # @return [Integer, nil] The first matched address, +nil+ is returned when no such pattern found.
     # @example
-    #   find(/E.F/, :elf)
+    #   find(/E.F/, :elf, false)
     #   #=> 4194305
-    #   find(0x4141414141414141, 'heap+0x10', 0x1000)
+    #   find(0x4141414141414141, 'heap+0x10', 0x1000, false)
     #   #=> 6291472
-    #   find('/bin/sh', :libc)
-    #   #=> 140662379588827
-    def find(pattern, from, length)
+    #   find('/bin/sh', :libc, true)
+    #   #=> 1622391 # 0x18c177
+    def find(pattern, from, length, rel)
       from = base_of(from)
       length = 1 << 40 if length.is_a? Symbol
-      case pattern
-      when Integer then find_integer(pattern, from, length)
-      when String then find_string(pattern, from, length)
-      when Regexp then find_regexp(pattern, from, length)
-      end
+      ret = case pattern
+            when Integer then find_integer(pattern, from, length)
+            when String then find_string(pattern, from, length)
+            when Regexp then find_regexp(pattern, from, length)
+            end
+      ret -= from if ret && rel
+      ret
     end
 
     private
@@ -107,12 +112,8 @@ module HeapInfo
     def dumpable?
       mem_f.close
       true
-    rescue => e
-      if e.is_a? Errno::EACCES
-        false
-      else
-        throw e
-      end
+    rescue Errno::EACCES, Errno::ENOENT
+      false
     end
 
     def mem_f

data/lib/heapinfo/glibc/free.rb

@@ -25,7 +25,7 @@ module HeapInfo
     # The original method in C is too long, split to multiple methods to match ruby convention.
     # @param [HeapInfo::Arena] av
     # @param [Integer] ptr Use <tt>ptr</tt> instead of <tt>p</tt> to prevent confusing with ruby native method.
-    def int_free(av, ptr) # is have_lock important?
+    def int_free(av, ptr)
       chunk = dumper.call(ptr, size_t * 2).to_chunk
       size = ulong chunk.size
       invalid_pointer(ptr, size)

data/lib/heapinfo/helper.rb

@@ -1,15 +1,16 @@
 require 'dentaku'
 require 'shellwords'
+require 'time'
 
 module HeapInfo
   # Some helper functions.
   module Helper
     # Create read +/proc/[pid]/*+ methods.
-    %w(exe maps auxv).each do |method|
+    %w[exe maps auxv].each do |method|
       define_singleton_method("#{method}_of".to_sym) do |pid|
         begin
           IO.binread("/proc/#{pid}/#{method}")
-        rescue
+        rescue Errno::ENOENT
           throw "reading /proc/#{pid}/#{method} error"
         end
       end

data/lib/heapinfo/nil.rb

@@ -4,7 +4,7 @@ module HeapInfo
   # Can be the return value of {HeapInfo::Process#dump} and {HeapInfo::Process#dump_chunks},
   # to prevent use the return value for calculating accidentally while exploiting remote.
   class Nil
-    %i(nil? inspect to_s).each do |method_sym|
+    %i[nil? inspect to_s].each do |method_sym|
       define_method(method_sym) { |*args, &block| nil.send(method_sym, *args, &block) }
     end
 

data/lib/heapinfo/process.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+
 module HeapInfo
   # Main class of heapinfo.
   class Process
@@ -20,9 +21,9 @@ module HeapInfo
       load!
     end
 
-    # Reload a new process with same program name
+    # Reload a new process with same program name.
     #
-    # @return [HeapInfo::Process] return +self+ for chainable.
+    # @return [HeapInfo::Process] return +self+ so that this method is chainable.
     # @example
     #   puts h.reload!
     def reload!
@@ -30,6 +31,7 @@ module HeapInfo
       load!
       self
     end
+    alias reload reload!
 
     # Use this method to wrapper all HeapInfo methods.
     #
@@ -111,11 +113,14 @@ module HeapInfo
       segment = @info.send(sym) if HeapInfo::ProcessInfo::EXPORT.include?(sym)
       segment = nil unless segment.is_a?(HeapInfo::Segment)
       if segment.nil?
-        sym, segment = @info.segments.select { |_, seg| seg.base <= addr }.min_by { |_, seg| addr - seg.base }
+        sym, segment = @info.segments
+                            .select { |_, seg| seg.base <= addr }
+                            .min_by { |_, seg| addr - seg }
       end
       return puts "Invalid address #{Helper.hex(addr)}" if segment.nil?
-      puts Helper.color(Helper.hex(addr - segment.base)) + ' after ' + Helper.color(sym, sev: :sym)
+      puts Helper.color(Helper.hex(addr - segment)) + ' after ' + Helper.color(sym, sev: :sym)
     end
+    alias off offset
 
     # Gdb-like command
     #
@@ -153,6 +158,8 @@ module HeapInfo
     # @param [Integer] length
     #   The search length limit, default is unlimited,
     #   which will search until pattern found or reach unreadable memory.
+    # @param [Boolean] rel
+    #   To show relative offset of +from+ or absolute address.
     # @return [Integer, nil] The first matched address, +nil+ is returned when no such pattern found.
     # @example
     #   h.find(0xdeadbeef, 'heap+0x10', 0x1000)
@@ -161,12 +168,13 @@ module HeapInfo
     #   #=> 4194305 # 0x400001
     #   h.find(/E.F/, 0x400000, 3)
     #   #=> nil
-    #   sh_offset = h.find('/bin/sh', :libc) - h.libc.base
+    #   sh_offset = h.find('/bin/sh', :libc) - h.libc
     #   #=> 1559771 # 0x17ccdb
-    def find(pattern, from, length = :unlimited)
+    #   h.find('/bin/sh', :libc, rel: true) == h.find('/bin/sh', :libc) - h.libc
+    #   #=> true
+    def find(pattern, from, length = :unlimited, rel: false)
       return Nil.new unless load?
-      length = 1 << 40 if length.is_a? Symbol
-      dumper.find(pattern, from, length)
+      dumper.find(pattern, from, length, rel)
     end
 
     # +search+ is more intutive to me
@@ -215,19 +223,21 @@ module HeapInfo
 
     # Make pry not so verbose.
     #
-    # @return [nil]
+    # @return [String]
     def inspect
-      nil
+      format('#<HeapInfo::Process:0x%016x>', __id__)
     end
 
     private
 
     attr_accessor :dumper
+
     def load?
       @pid != nil
     end
 
-    def load! # try to load
+    # try to load
+    def load!
       return true if @pid
       @pid = fetch_pid
       return clear_process if @pid.nil? # still can't load

data/lib/heapinfo/process_info.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+
 module HeapInfo
   # For {Process} to record basic process information.
   #
@@ -7,7 +8,7 @@ module HeapInfo
   class ProcessInfo
     # Methods to be transparent to +process+.
     # e.g. +process.libc+ alias to +process.info.libc+.
-    EXPORT = %i(libc ld heap program elf stack bits auxv).freeze
+    EXPORT = %i[libc ld heap program elf stack bits auxv].freeze
 
     # @return [Integer] 32 or 64.
     attr_reader :bits
@@ -47,8 +48,10 @@ module HeapInfo
     # Heap will not be mmapped if the process not use heap yet, so create a lazy loading method.
     # Will re-read maps when heap segment not found yet.
     #
+    # Special handling here because heap might not be initialized in the beginning.
+    #
     # @return [HeapInfo::Segment] The {Segment} of heap.
-    def heap # special handle because heap might not be initialized in the beginning
+    def heap
       @heap ||= Segment.find(load_maps, '[heap]')
     end
 
@@ -70,7 +73,7 @@ module HeapInfo
     def parse_auxv(str)
       auxv = {}
       sio = StringIO.new(str)
-      fetch = ->() { Helper.unpack(@bits / 8, sio.read(@bits / 8)) }
+      fetch = -> { Helper.unpack(@bits / 8, sio.read(@bits / 8)) }
       loop do
         type = fetch.call
         val = fetch.call

data/lib/heapinfo/segment.rb

@@ -19,6 +19,17 @@ module HeapInfo
       format("%-28s\tbase @ #{Helper.color(format('%#x', base))}\n", Helper.color(name.split('/')[-1]))
     end
 
+    # To support +addr - h.libc+.
+    # Treat all operations are manipulating on +base+.
+    #
+    # @param [Object] other
+    #   Any object.
+    #
+    # @return [(Object, Integer)]
+    def coerce(other)
+      [other, base]
+    end
+
     # Helper for creating a {HeapInfo::Segment}.
     #
     # Search the specific <tt>pattern</tt> in <tt>maps</tt> and return a {HeapInfo::Segment} object.

data/lib/heapinfo/version.rb

@@ -1,4 +1,4 @@
 module HeapInfo
   # Current gem version.
-  VERSION = '1.0.2'.freeze
+  VERSION = '1.1.0'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heapinfo
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - david942j
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-04-06 00:00:00.000000000 Z
+date: 2018-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dentaku
@@ -25,75 +25,75 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: codeclimate-test-reporter
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.5'
+        version: '0.6'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.5'
+        version: '0.6'
 - !ruby/object:Gem::Dependency
-  name: rubocop
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.46'
+        version: '12.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.46'
+        version: '12.3'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.0'
+        version: '3.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.0'
+        version: '3.7'
 - !ruby/object:Gem::Dependency
-  name: simplecov
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.13.0
+        version: '0.52'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.13.0
+        version: '0.52'
 - !ruby/object:Gem::Dependency
-  name: codeclimate-test-reporter
+  name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: 0.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: 0.13.0
 description: |
   Create an interactive memory info interface while pwn / exploiting.
   Useful for rubiers writing exploit scripts.
@@ -145,7 +145,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.10
+rubygems_version: 2.6.14
 signing_key: 
 specification_version: 4
 summary: HeapInfo - interactive heap exploitation helper