Windows 10 Segment Heap Internals
summary
Describes Windows 10 Segment Heap internals: back end, VS, LFH and large-block paths, their data structures, free trees and best‑fit with “most committed” preference, and guard/encoding defenses. Shows a practical exploit chain against CVE-2016-0117 in the WinRT PDF library that uses Chakra ArrayBuffer allocations (including a 0x340‑byte pattern, 15 buffers with 8 kept busy/7 freed, and a 192 MB GC trigger) to plant a target address and produce a reliable arbitrary write in the Edge content process, demonstrated live with WinDbg.
AI-written summary · about
chapters (27)
- 0:00Intro
- 1:13Agenda: Windows 10 Segment Heap
- 2:33Architecture
- 5:06Configuration
- 5:35Edge Content Process Heaps
- 9:53Backend Page Range Descriptors Example
- 10:31Backend Free Tree
- 12:03Variable Size (VS) Allocation
- 12:36VS Subsegment
- 13:14VS Block Header
- 14:54VS Free Tree
- 15:47VS Allocation and Freeing
- 16:24Low Fragmentation Heap (LFH)
- 17:11LFH Buckets
- 17:47LFH Affinity Slots
- 19:46LFH Block Bitmap
- 20:35LFH Allocation and Freeing
- 23:39Internals: Summary
- 25:49Heap Address Randomization
- 26:02Guard Pages
- 26:42Function Pointer Encoding
- 27:15VS Block Sizes Encoding
- 27:54LFH Allocation Randomization
- 30:18WinRT PDF: PostScript Operand Stack
- 36:04Free Blocks Coalescing
- 40:08Case Study: Summary
- 41:07Conclusion
related talks
49mPaging All Windows Geeks – Finding Evil in Windows 10 Compressed Memory
52mA New CVE-2015-0057 Exploit Technology
40mCommSec D1 - The Life & Death of Kernel Object Abuse
46mD2T2 - Over The Edge: Pwning The Windows Kernel
34mUnderstand Heap Memory layout with pwndbg
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
58mDebugging one layer deeper
01h 24mWindows Native API