Open avizack18 opened 1 week ago
Hello @avizack18,
Thank you for taking the time to write a detailed ticket.
I am curious what the practical benefits of parsing the allocator so deeply are in terms of supporting malware analysis and incident response versus just dumping out entire heap regions.
Generally with malware/IR, you want to target the regions to then have high-precision/context strings search, such as knowing you are searching the heap of a browser process of interest. I am not familiar with cases of needing to know specific allocations or allocation details when analyzing malware or user behaviour though - I only know the detailed structure examination when crafting or reversing exploits, which I feel a debugger is much better suited for.
I think its worth our time to add a plugin that automatically extracts entire heaps, but I am not sure about the detailed granular parsing work for the newer Win10+ allocators.
Overview
Request to implement a comprehensive HeapWalk functionality in Volatility 3 that supports both traditional Windows heap structures and the newer Windows 10 Segment Heap architecture.
References
HeapList implementation with simple _HEAP_SEGMENT & _HEAP_ENTRY support: https://raw.githubusercontent.com/abeDCP/HeapList/refs/heads/main/heaplist.py
Windows 10 Segment Heap internals whitepaper: https://www.blackhat.com/docs/us-16/materials/us-16-Yason-Windows-10-Segment-Heap-Internals-wp.pdf
Current Situation
Currently, basic heap analysis can be performed using implementations similar to the HeapList script (Reference 1), which handles:
_HEAP_SEGMENT
_HEAP_ENTRY
However, this doesn't address the complex Windows 10 Segment Heap structures introduced since Windows 10 and detailed in the Windows 10 Segment Heap Internals whitepaper (Reference 2).
Requested Features
1. Traditional Heap Support
_HEAP_SEGMENT
and_HEAP_ENTRY
2. Windows 10 Segment Heap Support
Implement support for all four components of the Windows 10 Segment Heap as detailed in Reference 2:
a) The Backend Allocator
_SEGMENT_HEAP
structureb) The Variable Size (VS) Allocation Component
c) The Low Fragmentation Heap (LFH)
d) The Large Blocks Allocation Component
Use Cases
Benefits