​

Heap Visualization Tools

​

Available Tools

​

heap-viewer

​

Overview

​

Features

• Visual heap layout - Graphical representation of heap chunks
• Chunk inspection - Detailed metadata viewing
• Arena tracking - Monitor multiple arenas
• Tcache analysis - Examine tcache structures
• Freelist visualization - See fastbins, smallbins, largebins
• Integration with IDA - Seamless workflow within IDA Pro

​

Installation

# Clone the repository
git clone https://github.com/danigargu/heap-viewer.git

# Copy to IDA plugins directory
cd heap-viewer
cp -r heap_viewer.py ~/.idapro/plugins/
cp -r heap_viewer/ ~/.idapro/plugins/

# Or use IDA's plugin manager
# File -> Script file -> Navigate to heap_viewer.py

​

Using with how2heap Examples

​

Setup

1. Compile how2heap example with symbols

make base
# Binaries will have debug symbols for better analysis

2. Load in IDA Pro

idat64 ./fastbin_dup

3. Activate heap-viewer

• Go to View -> Open subviews -> Heap Viewer
• Or press Ctrl+Alt+H

​

Analyzing Techniques

// After malloc(8) calls
// heap-viewer shows allocated chunks in green

// After free(a)
// heap-viewer highlights the freed chunk
// Shows it in the fastbin freelist

// After free(a) is called twice
// heap-viewer displays the corrupted fastbin
// You can see the circular reference

​

Workflow Integration

​

Static Analysis Workflow

1. Identify heap operations

• Use IDA’s cross-references to find malloc/free calls
• heap-viewer can annotate these in the disassembly

2. Analyze chunk structures

• Right-click on memory addresses to view as heap chunks
• Inspect chunk metadata (size, flags, fd, bk pointers)

3. Track data flow

• Follow pointers between heap structures
• Understand relationships between chunks

​

Dynamic Analysis Workflow

1. Set breakpoints

# In IDA Python console
import idaapi
idaapi.add_bpt(0x400123)  # Address of critical operation

2. Run to breakpoint

• Debugger will pause at key moments
• heap-viewer updates with current heap state

3. Inspect heap

• View current chunk allocations
• Check freelist states
• Verify exploitation primitives

4. Single-step through exploitation

• Use F7 (step into) or F8 (step over)
• Watch heap state change in real-time

​

Limitations

• Requires IDA Pro (commercial software)
• Primarily supports glibc heap implementation
• May have compatibility issues with latest glibc versions
• Dynamic analysis requires IDA debugger setup

​

heaptrace

​

Overview

​

Features

• Symbolic addressing - Replaces addresses with readable names (e.g., chunk_0, chunk_1)
• Operation tracking - Logs all heap operations with timestamps
• Freelist visualization - Shows freelist state symbolically
• Lightweight - Minimal performance overhead
• No debugger required - Works through LD_PRELOAD

​

Installation

# Clone the repository
git clone https://github.com/Arinerron/heaptrace.git
cd heaptrace

# Build
make

# Install (optional)
sudo make install

​

Basic Usage

# Run any binary with heaptrace
./heaptrace ./your_binary

# Or use LD_PRELOAD
LD_PRELOAD=./heaptrace.so ./your_binary

# Save output to file
./heaptrace ./your_binary > heap_trace.log

​

Using with how2heap Examples

# Compile the example
make base

# Run with heaptrace
./heaptrace ./tcache_poisoning

[+] malloc(128) = chunk_0 (0x555555559260)
[+] malloc(128) = chunk_1 (0x5555555592f0)
[+] free(chunk_0)
[!] tcache[128]: chunk_0 -> NULL
[+] Corrupting chunk_0->next to point to target
[+] malloc(128) = chunk_0 (0x555555559260)
[+] malloc(128) = target (0x7fffffffdb00)
[!] SUCCESS: malloc returned target address!

​

Advanced Features

​

Filtering Output

# Show only malloc calls
./heaptrace ./binary | grep malloc

# Show only tcache operations
./heaptrace ./binary | grep tcache

# Track specific chunk
./heaptrace ./binary | grep chunk_3

​

Visualizing Freelists

[!] fastbin[32]: chunk_5 -> chunk_3 -> chunk_1 -> NULL
[!] tcache[64]: chunk_2 -> chunk_4 -> NULL
[!] unsorted_bin: chunk_7 <-> chunk_6 <-> NULL

• Fastbin dup creates circular references
• Tcache poisoning shows corrupted next pointers
• Double free appears as duplicate entries

​

Integration with how2heap Learning

​

Workflow for Learning New Techniques

1. Read the source code

cat glibc_2.35/house_of_botcake.c

2. Run with heaptrace

./heaptrace ./house_of_botcake > output.log

3. Analyze the trace

cat output.log
# Observe the sequence of operations
# See how chunks move between freelists

4. Correlate with source

• Match heap operations in trace with source code lines
• Understand the technique’s mechanism
• Verify exploitation primitives work as expected

​

Comparing Execution Traces

# Trace normal execution
./heaptrace ./binary > normal.log

# Trace with exploitation
./heaptrace ./binary_exploit > exploit.log

# Compare
diff -u normal.log exploit.log

​

Combining Tools for Maximum Insight

​

Recommended Workflow

​

Example: Comprehensive Analysis of house_of_spirit

1. Initial understanding with heaptrace

./heaptrace ./house_of_spirit
# Understand the allocation/free sequence
# Identify the fake chunk creation

2. Detailed inspection with GDB

gdb ./house_of_spirit
(gdb) break house_of_spirit.c:30
(gdb) run
(gdb) heap chunks
# Examine chunk metadata in detail
# Verify fake chunk passes size checks

3. Visual verification with IDA + heap-viewer

• Load binary in IDA Pro
• Use heap-viewer to see memory layout graphically
• Verify fake chunk is in the expected location
• Confirm malloc returns the target address

​

Automation Scripts

#!/usr/bin/env python3
import subprocess
import sys

def analyze_heap_trace(binary):
    """Run heaptrace and analyze output"""
    result = subprocess.run(
        ['./heaptrace', binary],
        capture_output=True,
        text=True
    )
    
    lines = result.stdout.split('\n')
    
    mallocs = [l for l in lines if 'malloc' in l]
    frees = [l for l in lines if 'free' in l]
    corruptions = [l for l in lines if 'Corrupt' in l]
    
    print(f"Total mallocs: {len(mallocs)}")
    print(f"Total frees: {len(frees)}")
    print(f"Detected corruptions: {len(corruptions)}")
    
    if corruptions:
        print("\nCorruptions detected:")
        for c in corruptions:
            print(f"  {c}")

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <binary>")
        sys.exit(1)
    
    analyze_heap_trace(sys.argv[1])

python3 analyze_trace.py ./fastbin_dup

​

Visualization Best Practices

​

For Learning

1. Start simple - Begin with basic allocations before complex techniques
2. Use heaptrace first - Get the big picture before diving into details
3. Draw diagrams - Sketch heap layouts on paper while observing traces
4. Take snapshots - Capture heap state at key moments

​

For CTF Competitions

1. Quick triage with heaptrace - Rapidly understand binary behavior
2. GDB for exploitation - Develop and test exploits interactively
3. Verify with visualization - Confirm exploitation primitives work

​

For Vulnerability Research

1. IDA for static analysis - Find potential heap vulnerabilities
2. heap-viewer for validation - Confirm vulnerabilities are exploitable
3. heaptrace for PoC - Generate clean proof-of-concept traces

​

Troubleshooting

​

heaptrace Issues

# Solution: Ensure LD_PRELOAD is working
LD_PRELOAD=./heaptrace.so ldd ./binary
# Should show heaptrace.so is loaded

# Solution: Compile with debug symbols
gcc -g -o binary binary.c

​

heap-viewer Issues

# Solution: Check IDA Python console for errors
# Ensure plugin path is correct
import sys
print(sys.path)

• Ensure you’re debugging a glibc-based binary
• Check that symbols are available
• Verify glibc version compatibility

​

Next Steps