Heap debugging support commonly used in vulnerability analysis

We analyze heap vulnerabilities, such as heap overflow, UAF, and so on, and often enable some heap debugging support. Many people may have used these features, such as Gflags.exe, such as the +ust +DPH used in the analysis of UAF, and so on. But few people know exactly what these things are and how they work. Here I will explain these debugging mechanisms. Content reference from the "Software debugging", incidentally, personal feeling software debugging is a rare good book, the author is not only proficient in the kernel and the user layer also has in-depth understanding, personal feeling can and Windows internal listed as must-see bibliography.

First of all, how to open the heap debugging mechanism, we are most familiar with the method is to use the GFLAGS.EXE/I program name. exe + specific flag type. But in fact it is the key value of the corresponding process name read from the registry. This means that gflags is simply creating a new key value in the registry.

Before explaining the specific debugging support, make it clear that heap debugging support is provided by the heap allocation mechanism. Some readers may be less aware of the difference between heap allocations and memory allocations. Here, in fact, the virtual address space of a process is described by a "tree" data structure, and allocating a piece of virtual memory is the addition of nodes to the tree. The heap allocation mechanism is to apply a piece of virtual memory before using its own mechanism to distribute the memory. So the heap is a complete application layer behavior, in the kernel view, the heap is invisible, is transparent, the kernel just the process of virtual address data structure is how.

Before reading a few books to hear a noun called the debug heap, meaning that the debug heap under the non-debug heap is not the same, where the difference is not able to figure out. This time, it turns out that HTC HFC HPC is automatically enabled in the debug state. After the process is mounted, you can see which flag bits are in the WinDbg with the!gflag command.

• • • HFC: It is used to prevent two releases, and if two releases occur, two releases will be blocked. If a debugger is mounted at this point, a breakpoint is thrown.
    • UST: Used to track the heap allocation process. Many times we find a heap of memory, but we don't know who is allocating this heap of memory. UST is used to solve this problem, UST has its own piece of memory as a database. Each time the heap allocation function is called, the stack backtracking of the allocation function is saved into the database, so that you can see the stack backtracking if you want to know who is allocating the heap.

Heap debugging support commonly used in vulnerability analysis