├── .gitmodules ├── Dockerfile ├── README.md ├── artifact ├── README.md ├── common.sh ├── other-allocators │ ├── .gitignore │ ├── DieHarder-5a0f8a52 │ │ ├── .gitignore │ │ └── run.sh │ ├── FreeGuard-bfdf6d9a │ │ ├── .gitignore │ │ └── run.sh │ ├── Guarder-9e85978a │ │ ├── .gitignore │ │ └── run.sh │ ├── dlmalloc-2.7.2 │ │ ├── .gitignore │ │ └── run.sh │ ├── dlmalloc-2.8.6 │ │ ├── .gitignore │ │ └── run.sh │ ├── jemalloc-5.2.1 │ │ ├── .gitignore │ │ └── run.sh │ ├── mesh-a49b6134 │ │ ├── .gitignore │ │ └── run.sh │ ├── mimalloc-1.0.8 │ │ ├── .gitignore │ │ └── run.sh │ ├── mimalloc-secure-1.0.8 │ │ ├── .gitignore │ │ └── run.sh │ ├── musl-1.1.24 │ │ ├── .gitignore │ │ └── run.sh │ ├── musl-1.1.9 │ │ ├── .gitignore │ │ └── run.sh │ ├── scudo-9.0.0 │ │ ├── .gitignore │ │ └── run.sh │ └── tcmalloc-2.7 │ │ ├── .gitignore │ │ └── run.sh └── ptmalloc2-glibc2.23 │ ├── .gitignore │ └── run.sh ├── build.sh ├── driver ├── .gitignore ├── Makefile ├── driver.c ├── minimize.py └── minimize_all.py ├── install_dependencies.sh ├── setup.sh ├── techniques ├── Makefile ├── dlmalloc-2.8.6 │ ├── .gitignore │ └── house-of-lily.c ├── malloc-lib.h └── ptmalloc2-glibc2.23 │ ├── .gitignore │ ├── fast-bin-to-other-bin.c │ ├── house-of-unsorted-einherjar.c │ ├── overlapping-chunks-smallbin.c │ └── unaligned-double-free.c └── tool ├── .gitignore └── afl.patch /.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "tool/villoc"] 2 | path = tool/villoc 3 | url = https://github.com/wapiflapi/villoc.git 4 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:16.04 2 | 3 | ADD . /src 4 | WORKDIR /src 5 | 6 | RUN apt update 7 | RUN apt install -y sudo 8 | 9 | RUN ./install_dependencies.sh 10 | RUN ./build.sh 11 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ArcHeap: Automatic Techniques to Systematically Discover New Heap Exploitation Primitives 2 | 3 | ## Environment 4 | - Tested on Ubuntu 16.04 64bit 5 | 6 | ## Installation 7 | ```bash 8 | $ ./setup.sh 9 | $ ./install_dependencies.sh 10 | $ ./build.sh 11 | ``` 12 | 13 | ## Installation using Docker 14 | ```bash 15 | $ ./setup.sh 16 | $ docker build -t archeap . 17 | $ docker run -it archeap /bin/bash 18 | ``` 19 | 20 | ## How to use 21 | Please check our [artifact](artifact). 22 | 23 | ## Trophies 24 | - [Overlapping chunks with double free in mimalloc](https://github.com/microsoft/mimalloc/issues/161) 25 | - [Overlapping chunks with double free in DieHarder](https://github.com/emeryberger/DieHard/issues/12) 26 | - [Overlapping chunks with negative size allocation in mesh](https://github.com/plasma-umass/Mesh/issues/62) 27 | - [Arbitrary chunks with overflow in ptmalloc2](https://github.com/shellphish/how2heap/pull/77) 28 | - [Several other techniques](techniques) 29 | 30 | ## Authors 31 | - Insu Yun (insu@gatech.edu) 32 | - Dhaval Kapil (me@dhavalkapil.com) 33 | - Taesoo Kim (taesoo@gatech.edu) 34 | 35 | ## Publications 36 | ``` 37 | @inproceedings{yun:archeap, 38 | title = {{Automatic Techniques to Systematically Discover New Heap Exploitation Primitives}}, 39 | author = {Insu Yun and Dhaval Kapil and Taesoo Kim}, 40 | booktitle = {Proceedings of the 29th USENIX Security Symposium (Security)}, 41 | month = aug, 42 | year = 2020, 43 | } 44 | ``` 45 | -------------------------------------------------------------------------------- /artifact/README.md: -------------------------------------------------------------------------------- 1 | # Artifact for ArcHeap 2 | 3 | ## Getting started 4 | 5 | First of all, we need to specify an initial seed for ArcHeap, which relies on 6 | [AFL](https://github.com/google/AFL). According to our experience, choice of 7 | this seed is not important since ArcHeap will eventually converge. So, we will 8 | use a dumb seed (e.g, AAAA). 9 | 10 | ```bash 11 | $ mkdir input 12 | $ echo "AAAA" > input/seed 13 | ``` 14 | 15 | After specifying the seed, we can run ArcHeap as same with AFL. If we don't 16 | specify any allocator, ArcHeap will use a system allocator by default (e.g., 17 | ptmalloc2 in Linux). 18 | 19 | ```bash 20 | # Run ArcHeap without any model for a system allocator 21 | $ ../tool/afl-2.52b/afl-fuzz -i input -o output ../driver/driver-fuzz @@ 22 | ``` 23 | 24 | Unfortunately, if we run ArcHeap without any model, it will converge to random, 25 | trivial exploit techniques. To discover more specific techniques, ArcHeap 26 | supports several model specifications, which can be defined using arguments of 27 | `driver-fuzz`. You can check available model specifications from its help 28 | message. It is worth noting that ArcHeap's specifications are exclusive, i.e., 29 | ArcHeap limits capabilities with specifications and its default mode allows 30 | every action. Here is an example to specify the model. 31 | 32 | ```bash 33 | $ ../driver/driver-fuzz -h 34 | Usage: ../driver/driver-fuzz [OPTION]... FILE [MAPFILE] 35 | -c : Disable a capability 36 | := HEAP_ADDR | CONTAINER_ADDR | BUFFER_ADDR | DEALLOC | HEAP_WRITE | BUFFER_WRITE 37 | -v : Disable a vulnerbility 38 | := OVERFLOW | OFF_BY_ONE_NULL | OFF_BY_ONE | WRITE_AFTER_FREE | DOUBLE_FREE | ARBITRARY_FREE 39 | -e : Disable an event 40 | := OVERLAP | RESTRICTED_WRITE_IN_CONTAINER | RESTRICTED_WRITE_IN_BUFFER | ARBITRARY_WRITE_IN_CONTAINER | ARBITRARY_WRITE_IN_BUFFER | ALLOC_IN_CONTAINER | ALLOC_IN_BUFFER 41 | -u : Set upper bound of allocation 42 | -l : Set lower bound of allocation 43 | -s : Set allocations sizes (e.g., 1,2,3) 44 | -a
: