1. heap

• 1. heap
• 1.1. basics
• 1.1.1. the heap itself
• 1.1.2. arenas
• 1.1.3. chunks
• 1.1.4. bins
• 1.1.5. freelists
• 1.1.6. tcache
• 1.2. techniques
• 1.2.1. house of spirit
• 1.2.2. house of lore
• 1.2.3. house of force
• 1.2.4. house of einherjar
• 1.2.5. house of orange
• 1.2.6. house of roman
• 1.2.7. house of spirit
• 1.2.8. house of botcake
• 1.2.9. house of mind
• 1.2.10. house of prime
• 1.3. resources
• 1.3.1. Phrack
• 1.3.2. Azeria Labs
• 1.3.3. shellphish

1.1. basics

1.1.1. the heap itself

1.1.2. arenas

1.1.3. chunks

• Free / Allocated / Top

1.1.4. bins

• Fast / Unsorted / Small / Large

1.1.5. freelists

1.1.6. tcache

1.2. techniques

1.2.1. house of spirit

1.2.2. house of lore

1.2.3. house of force

1.2.4. house of einherjar

1.2.5. house of orange

1.2.6. house of roman

1.2.7. house of spirit

1.2.8. house of botcake

1.2.9. house of mind

1.2.10. house of prime

1.3. resources

1.3.1. Phrack

• Vudo malloc tricks
• Once upon a free()
• Malloc Des-Maleficarum
• Linux Kernel Heap Tampering Detection
• OSX heap exploitation techniques

1.3.2. Azeria Labs

• Arm Heap Exploitation
  • PART 1: UNDERSTANDING THE GLIBC HEAP IMPLEMENTATION
  • PART 2: UNDERSTANDING THE GLIBC HEAP IMPLEMENTATION
• HEAP EXPLOIT DEVELOPMENT – CASE STUDY FROM AN IN-THE-WILD IOS 0-DAY
• HEAP OVERFLOWS AND THE IOS KERNEL HEAP
• GROOMING THE IOS KERNEL HEAP

1.3.3. shellphish

• how2heap
  • lot's of small examples