node/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb
def scan_libc(addr)
		raise 'no libc' if not addr

		return if @main_arena_ptr = @dbg.symbols.index('main_arena')

		unless trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim')
			@dbg.loadsyms 'libc[.-]'
			trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim')
		end
		raise 'cant find malloc_trim' if not trim

		d = @dbg.disassembler

		d.disassemble_fast(trim) if not d.di_at(trim)
		if d.block_at(trim).list.last.opcode.name == 'call'
			# x86 getip, need to dasm to have func_binding (cross fingers)
			d.disassemble d.block_at(trim).to_normal.first
		end
		d.each_function_block(trim) { |b|
			# mutex_lock(&main_arena.mutex) gives us the addr
			next if not cmpxchg = d.block_at(b).list.find { |di| di.kind_of? DecodedInstruction and di.opcode.name == 'cmpxchg' }
			@main_arena_ptr = d.backtrace(cmpxchg.instruction.args.first.symbolic.pointer, cmpxchg.address)
			if @main_arena_ptr.length == 1
				@main_arena_ptr = @main_arena_ptr[0].reduce
				break
			end
		}
		raise "cant find mainarena" if not @main_arena_ptr.kind_of? Integer
		@dbg.symbols[@main_arena_ptr] = 'main_arena'
	end
# we need to find the main_arena from the libc
# we do this by analysing 'malloc_trim'
we need to find the main_arena from the libc
we do this by analysing 'malloc_trim'
we need to find the main_arena from the libc we do this by analysing ' malloc_trim '
def scan_libc(addr)
		raise 'no libc' if not addr
		return if @main_arena_ptr = @dbg.symbols.index('main_arena')
		unless trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim')
			@dbg.loadsyms 'libc[.-]'
			trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim')
		end
		raise 'cant find malloc_trim' if not trim
		d = @dbg.disassembler
		d.disassemble_fast(trim) if not d.di_at(trim)
		if d.block_at(trim).list.last.opcode.name == 'call'
			d.disassemble d.block_at(trim).to_normal.first
		end
		d.each_function_block(trim) { |b|
			next if not cmpxchg = d.block_at(b).list.find { |di| di.kind_of? DecodedInstruction and di.opcode.name == 'cmpxchg' }
			@main_arena_ptr = d.backtrace(cmpxchg.instruction.args.first.symbolic.pointer, cmpxchg.address)
			if @main_arena_ptr.length == 1
				@main_arena_ptr = @main_arena_ptr[0].reduce
				break
			end
		}
		raise "cant find mainarena" if not @main_arena_ptr.kind_of? Integer
		@dbg.symbols[@main_arena_ptr] = 'main_arena'
	end
def scan_libc ( addr ) raise 'no libc' if not addr return if @main_arena_ptr = @dbg . symbols . index ( 'main_arena' ) unless trim = @dbg . symbols . index ( 'malloc_trim' ) || @dbg . symbols . index ( 'weak_malloc_trim' ) @dbg . loadsyms 'libc[.-]' trim = @dbg . symbols . index ( 'malloc_trim' ) || @dbg . symbols . index ( 'weak_malloc_trim' ) end raise 'cant find malloc_trim' if not trim d = @dbg . disassembler d . disassemble_fast ( trim ) if not d . di_at ( trim ) if d . block_at ( trim ) . list . last . opcode . name == 'call' d . disassemble d . block_at ( trim ) . to_normal . first end d . each_function_block ( trim ) { | b | next if not cmpxchg = d . block_at ( b ) . list . find { | di | di . kind_of? DecodedInstruction and di . opcode . name == 'cmpxchg' } @main_arena_ptr = d . backtrace ( cmpxchg . instruction . args . first . symbolic . pointer , cmpxchg . address ) if @main_arena_ptr . length == 1 @main_arena_ptr = @main_arena_ptr [ 0 ] . reduce break end } raise "cant find mainarena" if not @main_arena_ptr . kind_of? Integer @dbg . symbols [ @main_arena_ptr ] = 'main_arena' end
we need to find the main_arena from the libc
we do this by analysing 'malloc_trim'
we need to find the main_arena from the libc we do this by analysing ' malloc_trim '
# x86 getip, need to dasm to have func_binding (cross fingers) # mutex_lock(&main_arena.mutex) gives us the addr
addr