Heap Layout Optimisation for Exploitation
summary
Claims an automatic pseudo-random blackbox search that manipulates heap layout by composing PHP fragments, discovers allocator interactions via PHP fragment fuzzing, and uses vulnerability templates to insert heap-manipulation sequences. Evaluation runs 500,000 candidate instances per case, solves most synthetic cases on dlmalloc and AVR Libc in seconds, but struggles with tcmalloc due to segregated storage and added noise. Applied to three real PHP CVEs: two reach optimal adjacency, one stops 16 bytes short. Code and report are published.
AI-written summary · about
chapters (27)
- 0:00Intro
- 4:14Constructing Primitives
- 6:13Reality ...
- 7:07Physical Heap Layout Optimisation (HLO)
- 7:49Problem Setting & Restrictions
- 8:33To Solve
- 9:03Challenges
- 10:14Heap Allocation Mechanisms and Policies
- 13:19An Algorithmic Approach
- 13:56Design Considerations
- 16:34Experimental Setup
- 17:18Noise
- 18:03Experiments
- 21:15Experimental Summary
- 21:31Automatic HLO for Real Programs
- 22:52Why a 'Skeleton'?
- 23:47Identifying Available Interaction Sequences
- 24:06Synthesising PHP Fragments
- 24:34Fuzzing for Allocator Interactions
- 25:34Fragmentation
- 26:57Black Box Random Search for PHP
- 27:21Finding Interesting Corruption Targets
- 29:03Vulnerability Templates
- 30:06Architecture
- 31:13Vulnerability - Targeted Corruption
- 31:24Evaluation
- 33:41Takeaways
related talks
21mAutomatic Heap Layout Manipulation for Exploitation
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
01h 00mIntroduction to memory exploitation
42mContemporary Automatic Program Analysis
39mGreybox Automatic Exploit Generation for Heap Overflows
32mPoking Holes in Information Hiding
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
43mThe Aftermath of a Fuzz Run: What to do about those Crashes?