Giter Club home page Giter Club logo

heaptrace's Introduction

About

heaptrace is a heap debugger for tracking glibc heap operations in ELF64 (x86_64) binaries. Its purpose is to help visualize heap operations when debugging binaries or doing heap pwn.

screenshot.png

  • replaces addresses with easy-to-understand symbols
  • detects heap corruption and memory leakage issues
  • can debug gdb at any point (--break)
  • supports all ELF64 (x86_64) binaries regardless of ASLR or compiler settings (including stripped binaries)

Installation

Official Releases

See the .deb and .rpm release files, and a pre-compiled binary at the Releases page.

Arch User Repository (PKGBUILD)

Use your preferred AUR helper to install the heaptrace-git package.

$ trizen -S heaptrace-git

Compile from Source

$ git clone https://github.com/Arinerron/heaptrace.git && cd heaptrace
$ make
$ sudo make install
...
$ heaptrace ./target

Usage

You can specify arguments to heaptrace before specifying the binary name:

Usage:
  ./heaptrace [options...] <target> [args...]
  ./heaptrace [options...] --attach <pid>

Options:
  -p <pid>, --attach <pid>, --pid <pid>
	 Tells heaptrace to attach to the specified pid 
	 instead of running the binary from the `target` 
	 argument. Note that if you specify this argument 
	 you do not have to specify `target`.


  -b <expression>, --break=<expression>, --break-at=<expression>
	 Send SIGSTOP to the process when the specified 
	 `expression` is satisfied and attach the GNU debugger 
	 (gdb) to the process.

	 This argument supports complex expressions. Please 
	 See the documentation for more information: 
	 https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints


  -B <expression>, --break-after=<expression>
	 Similar to `--break`. Replaces the tracer 
	 process with gdb, but only after the heap function 
	 returns. See the documentation for more information: 
	 https://github.com/Arinerron/heaptrace/wiki/How-to-Create-Breakpoints


  -e <name=value>, --environ=<name=value>, --environment=<name=value>
	 Sets a single environmental variable. Useful for 
	 setting runtime settings for the target such as 
	 LD_PRELOAD=./libc.so.6 without having them affect 
	 heaptrace's runtime configuration. This option can 
	 be used multiple times.

  -s <sym_defs>, --symbols=<sym_defs>
	 Override the values heaptrace detects for the 
	 malloc/calloc/free/realloc/reallocarray symbols. 
	 Useful if heaptrace fails to automatically 
	 identify heap functions in a stripped binary. See 
	 the wiki for more info.


  -F, --follow-fork, --follow
	 Tells heaptrace to detach the parent and follow 
	 the child if the target calls fork(), vfork(), or 
	 clone().

	 The default behavior is to detatch the child and 
	 only trace the parent.


  -G <path>, --gdb-path <path>
	 Tells heaptrace to use the path to gdb specified 
	 in `path` instead of /usr/bin/gdb (default).


  -o <file>, --output=<file>
	 Write the heaptrace output to `file` instead of 
	 /dev/stderr (which is the default output path).


  -v, --verbose
	 Prints verbose information such as line numbers in
	 source code given the required debugging info is
	 stored in the ELF.


  -h, --help
	 Shows this help menu.

  • For example, if you wanted to automatically attach gdb at operation #3, you would execute heaptrace --break=3 ./my-binary. Please see the wiki documentation for more information on how to use this argument.
  • See the wiki documentation for more information on how to use the -s/--symbol argument to debug stripped binaries that heaptrace failed to automatically identify functions in.
  • Set the $NO_COLOR argument to remove ANSI color codes from output. This option is still in development and will be converted into an argument soon.

Support

I'm happy to help if you experience a bug or have any feedback. Please see the GitHub Issues page.

heaptrace's People

Contributors

arinerron avatar mysterywave avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.