~/CSC 472/Class 09

CSC 472 · Class 09

Heap Exploitation

25 knowledge points. Work through them in order, or jump to any topic.

//

Knowledge Points

01Why the Heap Matters → 02The Heap vs. the Stack → 03glibc malloc (ptmalloc2): The Big Picture → 04Anatomy of a Chunk → 05Allocated vs. Free Chunk Layout → 06The Bins: malloc's Free Lists → 07tcache: The Per-Thread Cache (glibc 2.26+) → 08tcache Hardening in Newer glibc → 09Use-After-Free (UAF): The Idea → 10UAF Timeline → 11A Minimal UAF in C → 12Double Free → 13tcache Poisoning: Arbitrary Allocation → 14tcache Poisoning, Visually → 15Safe-Linking: Blunting Poisoning (glibc 2.32) → 16Heap Overflow: Overrunning Into Metadata → 17Inspecting the Heap with pwndbg → 18A Disciplined Heap Workflow → 19From Primitive to Shell → 20Why the Hooks Went Away → 21Defenses: Hardening the Heap → 22The Real Fix: Memory-Safe Languages → 23Tie-In to Lab 6 → 24Summary → 25Next Class and Questions →