Class 09 · KP 17 / 25

Inspecting the Heap with pwndbg

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

$ gdb ./vuln
pwndbg> break main
pwndbg> run
pwndbg> heap          # list all chunks in the arena
pwndbg> bins          # show tcache / fastbins / unsorted / small / large
pwndbg> vis_heap_chunks   # colorized visual dump of chunks + metadata
pwndbg> tcache        # inspect the per-thread cache directly

heap walks the chunk list: address, size, flags.
bins tells you which free list a chunk landed in after a free — essential for planning reuse.
vis_heap_chunks draws fd/next pointers so you can see poisoning take effect.

Key Takeaway

Do not guess the heap layout — watch it. Free something, then re-run bins and vis_heap_chunks to confirm.