The overflowed memory is given a value such that a previous call to free() is simulated, causing next malloc() call to misinterpret that the memory was free'd before. This technique is what we would call as - Free Simulation.

1. Smashing Heap by Free Simulation
Sandip Chaudhari
sandipchaudhari@gmail.com
Acknowledgements
Thanks to everyone in my Security Team for their support and
encouragement, especially to Jonathan Leonard, Jeremy Jethro
and Nick Seidenman.
19-21 October 2006

2. Abstract
 The exploit can be achieved without the need of any call
to the free() function.
 The overflowed memory is given a value such that a
previous call to free() is simulated, causing next
malloc() call to misinterpret that the memory was free'd
before. We call this technique - Free Simulation.
 Though the Free Simulation technique demonstrated in
this paper, has been tried successfully on AIX, Solaris
and Windows XP SP2 it may be applicable on all systems
having in-band heap memory management.
Slide 2 / 38

3. Introduction
 Almost all the papers referenced in the References
section [1] through [7], discuss about heap overflows,
that seem to talk or provide sample code snippet where
free() is being called.
 What if free() is never called and the process takes in
user input that can lead to heap overflow? Is it still
possible to exploit such a process that never calls
free()? Answer to this is yes, and that's what this
presentation is all about.
Slide 3 / 38

4. Core Ideas
 Heap Overflow technique when the free() is being
called, is usually referred to as 4-byte overwrite.
 The core idea is “to attack the memory management
algorithm, first (publicly?) demonstrated by Solar
Designer for a heap overflow found in the Netscape
browser” [3], [1]. This attack on memory management
algorithm always necessarily involves pointer
assignment instructions.
Slide 4 / 38

5. Logical Constructs
 Lets refer to the primitive logical constructs involving these pointer
assignments, that get executed on a call to free()
[4 – Section: Anatomy of a Heap Overflow Exploit] & [5].
unlink() frontlink()
#define unlink(P, BK, FD) { #define frontlink(A, P, S, IDX, BK, FD) {
[1] FD = P->fd; [1] FD = start_of_bin(IDX);
[2] BK = P->bk; [2] while ( FD != BK && S < chunksize (FD) )
[3] FD->bk = BK; {
[4] BK->fd = FD; [3] FD = FD->fd;
} }
[4] BK = FD->bk; [5] FD->bk = BK->fd = P;
}
Note: Both the above macros are a set of logical statements that explain pointer assignments. Either or both
of these maybe executed on call to free(). “P” is the pointer that has been passed to be free'd.
Slide 5 / 38

6. What exactly is the
Free Simulation?
 Free Simulation is the allocation of address space on simulated
free region in the memory with our choice of length, and in
certain cases may be located anywhere we choose in the process
address space. Free Simulation can be differentiated broadly into 2
cases:
 Arbitrary buffer allocation – The heap datastructure pointers are
manipulated such that the simulated free buffer space, when allocated
can exist arbitrarily anywhere in process memory address space (Free
Simulation on AIX, Free Simulation on Solaris (<40 bytes buffer))
 Arbitrary address over-write (4-byte i.e word-size overwrite) –
The heap datastructure pointers are manipulated such that the pointer
assignments causes an address to be overwritten arbitrarily anywhere
in the process memory address space (Free Simulation on Solaris
(>=40 bytes buffer), Windows XP SP-2)
Slide 6 / 38

7. What exactly is the
Free Simulation? (contd.)
 An example of the usual state of heap with a few allocated
chunks.
Heap
allocated allocated allocated unallocated
Slide 7 / 38

8. What exactly is the
Free Simulation? (contd.)
Heap Lets try to represent heap state at the moment
of time when a number of chunks have been
headers malloc'ed and a few have been free'd.
allocated free'd allocated unallocated
Pointer to previously free'd chunk
Heap in-band header with pointers to
previously free'd chunks
Slide 8 / 38

9. What exactly is the
Free Simulation? (contd.)
 After the overflow and the Free Simulation
Heap
allocated allocated allocated unallocated
[overflow]
Pointer to previously free'd chunk
Stack Target
Simulated
free chunk
Slide 9 / 38

10. Conditional Triggers
 The conditional triggers are instructions in the malloc
call that check if there is some previous or last free'd
memory available (of appropriate size) that can be used
to allocate the new chunk.
 'if ( previous free'd chunk available && requested
size <= available free'd size ) then ...‘
 This logical free conditional primitive lies at the heart of
successful Free Simulation. It triggers the execution of
further pointer assignment instructions.
Slide 10 / 38

11. Free Simulation on Aix
0x00000000 else
pointer to previously
<__heaps+1040>:
free'd chunk [PPF] next free pointer
Heap – User specified size of chunk [NFP]
Malloc'ed else real size of previously
free'd chunk
Heap Data
<__heaps+1056>:
chunks total heap space allocated Structure
[MC] [HDS]
<__heaps+1064>:
Actual malloc'ed memory total number of heap
chunks malloc'ed
<__heaps+1068>:
pointer to current
0x00000000 else
chunk [CP]
pointer to previously
free'd chunk [PPF] <__heaps+1076>:
pointer to the address
Unallocated memory of pointer of
else size of previously
previous free chunk
free'd memory [PPPF]
Unallocated memory
Slide 11 / 38

12. Free Simulation on Aix (contd.)
 Usually, the PPF (Pointer to Previously Free’d chunk) is
NULL and NFP (Next Free Pointer) points to the last PPF
(NULL), indicating availability of free memory
 We will try to understand what happens if PPF is not
NULL, which is very important for the success of
exploitation by Free Simulation.
 The PPF which is usually NULL, is assigned the value of
the address of previously free'd chunk! The core idea is
to overflow the malloc() allocated chunk by 2 words
having the first word as an address so that it will be
now interpreted as PPF and second word as some
arbitrary size.
Slide 12 / 38

13. Free Simulation on Aix (contd.)
 How about pointing PPF to the stack? Possible?
Yes! In a way, we are smashing the heap,
simulating free() and then smashing the stack!
 Thus the simulated free space can be located
anywhere in the process writable memory
address space.
 The reason this is possible is because the
malloc() function trusts the address retrieved,
as a valid heap address for memory allocation.
Slide 13 / 38

14. Free Simulation
conditional trigger for Aix
if ( Pointer to Previously Free'd chunk [PPF] != NULL
&& requested_size <= chunk_size ) ... [A]
{
consider the value of PPF as an address of previously
free'd chunk and try to allocate memory on this free'd
chunk
}
The above [A] is mere a logical summary of conditional instructions or
statements. The “if” condition may have been actually implemented as
“while”. The conditional statements make it very clear that triggering Free
Simulation on Aix is quite easy.
Slide 14 / 38

15. Free Simulation on Solaris – I
[size < 40 bytes]
Available chunk size or
allocated chunksize |OR| 'ed with
flags. [bit0 and bit1] <List+4>:
Next Free chunk Pointer
Heap – 0x0 or junk
[alignment word]
or
Previous Free'd chunk Pointer Heap Data
Malloc'ed Data: if allocated
else, Next Free Pointer Structure
<freeidx>:
chunks [MC] [NFP]: if unallocated
else, Pointer to Previous Free'd
index or count of free'd chunk
in a bin's list [HDS]
chunk [PPF]: if free'd
Based on bit0 and bit1 of size
Actual malloc memory
<flist – flist+124>:
Available chunk size or List of free'd pointers
allocated chunksize |OR| 'ed with
flags. [bit0 and bit1]
0x0 or junk
[alignment word]
Next Free Pointer
[NFP]: if unallocated
else, Pointer to Previous Free'd <Lfree>:
chunk [PPF]: if free'd List of bins / nodes of flists
Based on bit0 and bit1 of size
Unallocated Memory
Slide 15 / 38

16. Free Simulation on Solaris – I
[size < 40 bytes] (contd.)
 On Solaris, 2 types of data-structures are involved in the
heap management, based on chunk size asked for. If
the requested chunk size is less than 40 bytes then
the linked-lists are involved and different section of
code gets executed, while for sizes greater than 40
bytes, binary search tree structure is maintained.
 The decision to allocate or consider the previously free'd
chunk of memory for allocation is based primarily on the
bit0 and the bit1 of the size word on the Solaris. The
size is specified in bytes and we get the last 2 bits free.
 bit0: 1 if chunk is allocated else 0.
 bit1: 1 if a previous block has been free'd in
local list of the bin else 0.
Slide 16 / 38

17. Free Simulation on Solaris – I
[size < 40 bytes] (contd.)
 The freelists are structured like lists in bins of various
chunk sizes.
 In case malloc finds that bit1 state is “1” it considers
that there is a previously free'd memory chunk. The
word next to the immediate next word is considered as
the address pointing to the previously free’d chunk.
 In case of Solaris, we overflow the allocated chunks'
boundary such that the bit1 of the size in the header of
next chunk is set to “1” and the word next to
immediate-next word maybe given the address where
we would like to overwrite, on the next memory write
operation.
Slide 17 / 38

18. Free Simulation on Solaris – I
[size < 40 bytes] (contd.)
 As before in AIX, again, the simulated free
space can be located anywhere in the process
writable memory address space.
 Again, the reason this is possible is because the
malloc() function trusts the address retrieved,
as a valid heap address for memory allocation.
Slide 18 / 38

19. Free Simulation
conditional trigger for Solaris - I
If ( size.bit1 equals 1 ) .... [B]
{
After size checks, consider address next to immediate-next
word as previously free'd chunk
and assign it to the Next Pointer of Heap Data Structure.
Again, after size checks this
simulated free space will be used to allocate memory on
any call to malloc() in the future.
}
As stated before in case of AIX, the above [B] is mere logical summary of
conditional instructions for Solaris. The conditional “if” is logical and it may
be a conditional “while” in actual implementation.
Slide 19 / 38

20. Free Simulation on Solaris – II
[size >= 40 bytes]
 “Once upon a free()” paper [8] published in Phrack magazine
demonstrates heap-overflow exploit by calls only to malloc() that further
calls realfree().
 The focus is on creation of the fake-chunk that leads to 4-byte overwrite
when the heap-management data is manipulated.
 The paper also clearly mentions that -- “Overflowed chunk must not be
the last chunk”.
 Again before, we will simulate free() by overflowing the last malloc'ed
chunk. This is achieved using the 4-byte overwrite technique.
 We take advantage of delayed free calls and achieve 4-byte overwrite in
the realfree()'s coalesce operation. This is similar to exploit mentioned in
[8] but differing by overflowing last malloc'ed chunk.
Slide 20 / 38

21. Free simulation on Solaris – II
[size >= 40 bytes] (contd.)
We will refer the opensolaris site [9] for source code to better understand the exploit.
Source: mallint.h
80 /* the proto-word; size must be ALIGN bytes */
81 typedef union _w_ {
82 size_t w_i; /* an unsigned int */
83 struct _t_ *w_p[2]; /* two pointers */
84 } WORD;
86 /* structure of a node in the free tree */
87 typedef struct _t_ {
88 WORD t_s; /* size of this element */
89 WORD t_p; /* parent node */
90 WORD t_l; /* left child */
91 WORD t_r; /* right child */
92 WORD t_n; /* next in link list */
93 WORD t_d; /* dummy to reserve space for self-pointer */
94 } TREE;
Few important macros.
Source: mallint.h
98 #define RSIZE(b) (((b)->t_s).w_i & ~BITS01)
112 /* set/test indicator if a block is in the tree or in a list */
113 #define SETNOTREE(b) (LEFT(b) = (TREE *)(-1))
114 #define ISNOTREE(b) (LEFT(b) == (TREE *)(-1))
121 #define NEXT(b) ((TREE *)(((char *)(b)) + RSIZE(b) + WORDSIZE))
Slide 21 / 38

22. Free simulation on Solaris – II
[size >= 40 bytes] (contd.)
Sections of functions relevant to our exploit
Source: malloc.c – realfree()
511 /* see if coalescing with next block is warranted */
512 np = NEXT(tp);
513 if (!ISBIT0(SIZE(np))) {
514 if (np != Bottom)
515 t_delete(np);
516 SIZE(tp) += SIZE(np) + WORDSIZE;
517 }
Source: malloc.c – t_delete()
756 /* if this is a non-tree node */
757 if (ISNOTREE(op)) {
758 tp = LINKBAK(op);
759 if ((sp = LINKFOR(op)) != NULL)
760 LINKBAK(sp) = tp;
761 LINKFOR(tp) = sp;
762 return;
763 }
Note, the above highlighted assignments in orange (760 and 761) are the two word assignments, where user
controlled data (8-byte overwrite in this case, but we will still refer it as 4-byte) can be injected. We can
summarize above operation in instructions as:
0xff2c7808 <t_delete+52>: st %o0, [ %o1 + 8 ]
0xff2c780c <t_delete+56>: st %o1, [ %o0 + 0x20 ]
Slide 22 / 38

23. Free simulation on Solaris – II
[size >= 40 bytes] (contd.)
Malloc'ed heap chunk and overflow
Allocated memory We have 2 structures involved: t1.t_* and t2.t_*
t1.t_s [ > - 4 < 0 ] t_s : Size. We assign this to - 2 so that np =
NEXT(p) will return np pointing to t1.t_j and bit0 is
t1.t_j t2.t_s
'0' for both t1.t_s and t2.t_s.
t1.t_p t2.t_j
t_j : As every pointer in this structure occupies 2 words
t1.t_j t2.t_p owing to alignment logic, we can consider all t_j as
t1
t1.t_l t2.t_j junk.
t1.t_j t2.t_l t_p : Pointer to previous node, can be junk for t1.t_p, and t2.t_p
t2
t1.t_r t2.t_j can be the address with which the return address on the
t1.t_j t2.t_r stack is to be replaced.
t_l : can be junk for t1.t_l but must be “-1” for t2.t_l, thus
t1.t_n t2.t_j
guarantee that malloc() would not interpret the node as a
t1.t_j t2.t_n
tree node but would interpret it as a list node.
t1.t_d t2.t_j t_r : can be completely ignored and hence can be junk.
t2.t_d t_n : t1.t_n can be junk but t2.t_n will be the address we would
like to overwrite – 8.
t_d : Maybe ignored and can be junk for both t1.t_d and
Unallocated memory t2.t_d.
Slide 23 / 38

24. Free Simulation
conditional trigger for Solaris - II
1. if ( size.bit0 equals 0 ) ....[C]
{
consider this as a free chunk, check if next chunk is also free and if
coalesce is possible.
}
2. if ( next chunk size.bit0 equals 0 )
{
Next chunk in contiguous memory block is free proceed with coalesce.
}
3. size should be such that NEXT(p) calculation will return our fake-chunk as next chunk.
4. The returned fake chunk should bypass is-bottom check [np != Bottom]. Would be
automatically taken care of.
5. The value of left-node pointer t_l of fake chunk must be '-1' for interpretation as list
node rather than tree node.
6. If ( value of left-node equals -1) ....[D]
{
interpret it as list-node and proceed further with coalesce operation
involving pointer assignments.
}
As stated before for AIX, the above [C] and [D] are mere logical summaries of conditional
instructions for Solaris. Step [C] indicates Free Simulation. The remaining steps including [D]
indicate the trigger to coalesce, the fake-chunk creation, and the coalesce operation that
involves pointer assignments for the linked-list.
Slide 24 / 38

25. Free Simulation - Windows XP SP2
 4-byte overwrite or arbitrary 4*n bytes
overwrite still possible on older windows =
(windows < XP-SP2)
 Since SP-2 MS introduced Heap Protection
 Is Free Simulation still possible on XP SP2?
Slide 25 / 38

26. Windows Heap Overflow Exploit
Research (Time Progression)
 Halvar Flake - "Third Generation Exploitation"
http://www.blackhat.com/presentations/win-usa-02/halvarflake-winsec02
 David Litchfield - "Windows Heap Overflows"
http://www.blackhat.com/presentations/win-usa-04/bh-win-04-litchfield/b
 Matt Conover, Oded Horowitz - "Reliable Windows Exploits"
http://cansecwest.com/csw04/csw04-Oded+Connover.ppt
 Alexander Anisimov - "Defeating Windows XP SP2 Heap protection
and DEP bypass"
http://www.maxpatrol.com/defeating-xpsp2-heap-protection.pdf
 Nicolas Falliere - A new way to bypass Windows heap protections
http://www.securityfocus.com/infocus/1846
 Brett Moore - Exploiting Freelist[0] on Windows XP Service Pack 2
http://www.securiteam.com/securityreviews/5MP020UHFI.html
Slide 26 / 38

27. Free Simulation – Windows XP SP2
 Presenters’ research did lead to possibility of heap
overflow exploitation on SP2 using Free Simulation. It
turned out though, to be very similar to something that
has been discussed in Brett Moore’s paper, with few
minor differences.
 Similar to the examples shown in previous slides, we will
be overwriting 4-byte word on stack address having a
function return address, with an address now pointing
to heap.
 The value overwritten is partially controlled, pointing
back to address containing the [stack’s address – 4].
Slide 27 / 38

28. Free Simulation – Windows XP SP2
Reaching Freelist[0]
 The malloc() calls try to allocate a chunk of requested
size in certain order shown below for chunks < 512k:
1. Lookaside (for size <1k)
2. Freelist [indices > 0] (for size <1k)
3. Freelist[0] (for size >1k or if none found in 1, 2 for <1k)
4. When not pointing to any free’d chunk, Freelist[0] points to the
free-region beyond last chuck. If such a case or when no free’d
chunk in Freelist[0] with size big enough of the requested size,
allocation takes place in the free-region, beyond last chunk
 Our focus would be to make malloc() reach Freelist[0]
and re-apply the concepts of Free-Simulation for
successful exploitation.
Slide 28 / 38

29. Free Simulation – Windows XP SP2
Library function calls
 Many library functions use malloc() internally.
These functions usually need varying chunk
sizes.
 Such functions form excellent candidates for this
exploit technique, as they have greater chance
of hitting Freelist[0].
Slide 29 / 38

30. Free Simulation – Windows XP SP2
Library function calls
 In our example we exploit the malloc() called by
printf() function.
 We will focus on exploitation and change of control flow
using only one overflow.
 Brett Moore’s paper aptly hints, that such technique if
used, needs the address to constitute a valid instruction
 We will see, one of the address of low level function on
stack called by malloc() itself does form valid instruction
that gets executed, in our example. Our shell-code
starts right from the next word!
Slide 30 / 38

31. Free Simulation – Windows XP SP2
Stack Heap HDS
HDS Header
Chunk Header Freelist[0]
Chunk Data
_heap_alloc_dbg Freelist[1]
malloc Shell Code
Lookaside[0]
Lookaside[1]
printf
Simulated
Free Chunk
Slide 31 / 38

32. Free Simulation – Windows XP SP2
Conditional Trigger
1. The allocation code must somehow reach Freelist[0]
3. Freelist[0] must point to the header of our simulated
free chunk
5. The simulated free chunk’s size must be greater than
the size of the requested chunk+8. This would trigger
the re-link and our 4-byte overwrite.
7. The stack address at the function return pointer is
overwritten with address pointing back to heap,
should be interpretable as valid instruction.
Slide 32 / 38

33. Free Simulation – Windows XP SP2
Demo!
 Though exploiting heap overflow using Free
Simulation on SP2 is still a possibility, Heap
Protection definitely puts forth many limitations.
Slide 33 / 38

34. Advantages of the Free Simulation
 Relatively easy to exploit.
 Provides a consistent and generic model to pursue the heap overflow-based exploits.
 For processes / applications where free() is never called, Free Simulation maybe the
best technique to exploit.
 Usually data-write follows after a chunk from malloc has been obtained, favoring
Free Simulation exploitation.
 Some heap algorithms do not actually free the memory at the free() call. This
delayed/lazy free() is feasible due to certain supportive free-structures like free-
list / flist (Solaris). Whenever a malloc() is called it internally calls free() or rather
the realfree() (especially on Solaris) that actually free's the memory. Hence focus on
malloc() calls might provide easier approach and save time.
 Usually, malloc() and realloc() calls are called more frequently compared to free().
 Exploitation can be triggered at a considerably earlier stage in a process's life cycle
because of the fact that the malloc() (memory allocation) always precedes free().
 Enables arbitrary overwrites anywhere in the process memory regions including
stack, heap, function pointers, Procedure Linkage Table.
Slide 34 / 38

35. Limitations of Free Simulation
 Usually works well and easily when the overflow
occurs in last malloc'ed chunk. For overflows in
in-between malloc'ed chunks, depends on
implementation of the memory allocation
algorithm.
 On Windows XP SP2, can be triggered only for
allocation of chunks in free-space pointed by the
Freelist[0].
Slide 35 / 38

36. Preventive Measures
 Best preventive measure is at the code-implementation level itself by
altogether avoiding or by careful usage of function calls that may
potentially lead to the memory overflows.
 Implementation of heap algorithm with total removal of in-band memory
management information between data can completely protect against any
manipulation. Many such implementations are already available for *nix
platforms and can be linked with the systems’ library. Some have also
integrated such protection schemes into default distros (OpenBsd).
 At system level NX [Non Executable pages], non-executable data region
(that includes heap with stack, on AIX – sedmgr), cookies, write protected
guard bands between heap data segments and heap management
structures, can make heap overflow exploitation almost impossible.
 Implementation and integration of such preventive measures by various
operating systems is already pushing (4*1) or (4*n) memory over-writes in
history.
Slide 36 / 38

37. References
• http://md.hudora.de/presentations/summerschool/2005-09-21/vansprundel-ctt-heapoverflows.pdf - Generic Heap
Overflow Exploitations.
• http://www.blackhat.com/presentations/win-usa-02/halvarflake-winsec02.ppt – Third Generation Exploitation.
• http://www.openwall.com/advisories/OW-002-netscape-jpeg/ - Solar Designer
• https://www.usenix.org/publications/library/proceedings/lisa03/tech/full_papers/robertson/robertson_html/ -
Run-time Detection of Heap-based Overflows (Anatomy of a Heap Overflow Exploit, Logical Constructs).
• http://doc.bughunter.net/buffer-overflow/heap-corruption.html
• http://www.w00w00.org/files/articles/heaptut.txt
• http://cansecwest.com/csw04/csw04-Oded+Connover.ppt
• http://www.phrack.org/phrack/57/p57-0x09 – Once Upon a free()
• http://cvs.opensolaris.org/source/ - Solaris source code on OpenSolaris website
 http://www.blackhat.com/presentations/win-usa-04/bh-win-04-litchfield/bh-win-04-litchfield.ppt David Litchfield -
"Windows Heap Overflows"
• http://www.maxpatrol.com/defeating-xpsp2-heap-protection.pdf Alexander Anisimov - “Defeating Windows XP SP2 Heap
protection and DEP Bypass”
 http://www.securityfocus.com/infocus/1846 Nicolas Falliere - A new way to bypass Windows heap protections
 http://www.securiteam.com/securityreviews/5MP020UHFI.html Brett Moore - Exploiting Freelist[0] on Windows XP
Service Pack
Slide 37 / 38

38. Questions
?
Slide 38 / 38