scwuaptx / Pwngdb

gdb for pwn
GNU General Public License v3.0
888 stars 126 forks source link

angelheap failed to trace free() while using tracemalloc #32

Closed bruce30262 closed 1 year ago

bruce30262 commented 5 years ago

Environment

Detail

testing program:

/* gcc -o test test.c*/

#include <stdio.h>
#include <string.h>
#include <math.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
    char *p1 = malloc(20);
    char *p2 = malloc(30);
    char *p3 = malloc(40);
    char *p4 = malloc(50);
    char *p5 = malloc(60);
    char *p6 = malloc(3000);

    free(p1);
    free(p2);
    free(p3);
    free(p5);
    free(p4);
    free(p6);
    return 0;
}

While using tracemalloc on/off, angelheap successfully trace the malloc() function call, but not the free() call. This cause some error in parseheap and overlapped chunk detecting.

For some unknown reason, glibc did not run into _int_free() in glibc 2.27.
Any idea how to fix it ?

bruce30262 commented 5 years ago

@scwuaptx I think I've found the root cause.

Somehow in libc-2.27 _int_free() became inline in __libc_free() so it won't call _int_free, it just jump to a certain address in _libc_free() to free the memory.

To resolve the issuse, is it OK for us to trace the malloc/free call by setting the breakpoint in __libc_free() instead of _int_free() ?