Glibc heap exploitation helper
Model glibc chunk layout, bin behaviour, and tcache - the size classes and metadata that heap challenges turn on.
Open in ctfpalHeap exploitation is about the allocator’s metadata rather than the program’s data. glibc’s malloc stores bookkeeping inline with the allocations, so an overflow in one chunk rewrites the header of the next - and the allocator then acts on values you control.
Chunk layout
Each allocation is preceded by a header: the size of the previous chunk (when free) and its own size, whose low three bits are flags rather than size. PREV_INUSE is the one that matters most - clearing it tells the allocator the preceding chunk is free and can be consolidated with, which is the basis of several classic attacks.
| Bin | Sizes | Behaviour |
|---|---|---|
| tcache | Up to 1032 bytes | Per-thread, 7 entries per size, minimal checks |
| fastbin | Up to 128 bytes | Singly linked LIFO, no coalescing |
| unsorted | Any | Holds a libc pointer when in use - the standard leak source |
| small / large | Larger | Doubly linked, more integrity checks |
Modern glibc versions have hardened considerably: tcache entries carry keys against double-free, and since 2.32 the forward pointers are mangled against the heap address. Which attacks apply depends heavily on the version, so establish that first.
Related tools
ROP chain and payload builder
Assemble an exploit payload from padding, addresses, and raw bytes, with a live hexdump and offset ruler - the pwntools flat() workflow.
Libc base address calculator
Turn a leaked libc pointer into the library’s base address, then resolve any other symbol - the arithmetic every ret2libc exploit runs on.
ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Struct pack and unpack (p32, p64, u32, u64)
Convert integers to little-endian byte strings and back at 8, 16, 32, and 64 bits - the pwntools p32/p64 helpers without the install.