67  Heap

rizin’s dm subcommands can also display a map of the heap which is useful for those who are interested in inspecting the heap and its content. Simply execute dmh to show a map of the heap:

[0x55c392ae1189]> dmh
Arena @ 0x7f10940c1b80
Chunk(status=free,      addr=0x55c3934c9290, size=0x50, flags=PREV_INUSE)
Chunk(status=allocated, addr=0x55c3934c92e0, size=0x90, flags=PREV_INUSE)
Chunk(status=free,      addr=0x55c3934c9370, size=0x20c90, flags=PREV_INUSE)[top][brk_start: 0x55c3934c9000, brk_end: 0x55c3934ea000]]

You can also see a graph layout of the heap:

[0x7fae46236ca6]> dmhg
Arena @ 0x7f10940c1b80
Heap Layout
┌────────────────────────────────────┐
│    Malloc chunk @ 0x55c3934c9290   │
│ size: 0x50 status: free            │
└────────────────────────────────────┘
    v
    │
    │
┌────────────────────────────────────┐
│    Malloc chunk @ 0x55c3934c92e0   │
│ size: 0x90 status: allocated       │
└────────────────────────────────────┘
    v
    │
    └──┐
       │
   ┌───────────────────────────────┐
   │  Top chunk @ 0x55c3934c9370   │
   └───────────────────────────────┘

To get information about bins of the main arena use the dmhd command.

[0x55c392ae1189]> dmhd
Tcache bins in Main Arena @ 0x7f10940c1b80
Tcache_bin[03] Items: 1
 -> Chunk(addr=0x55c3934c9290, size=0x50, flags=PREV_INUSE)

Fast bins in Arena @ 0x7f10940c1b80
Fast_bin[01] [size: 0x20] Empty bin
Fast_bin[02] [size: 0x30] Empty bin
Fast_bin[03] [size: 0x40] Empty bin
Fast_bin[04] [size: 0x50] Empty bin
Fast_bin[05] [size: 0x60] Empty bin
Fast_bin[06] [size: 0x70] Empty bin
Fast_bin[07] [size: 0x80] Empty bin

Unsorted bin in Arena @ 0x7f10940c1b80
Found 0 chunks in unsorted bin

Small bins in Arena @ 0x7f10940c1b80
Found 0 chunks in 0 small bins

Large bins in Arena @ 0x7f10940c1b80
Found 0 chunks in 0 large bins

Other heap commands can be found under dmh, check dmh? for the full list.

[0x00000000]> dmh?
Usage:  dmh   # Memory map heap
| dmh                                          List the chunks inside the heap segment
| dmh @[malloc_state]                          List heap chunks of a particular arena
| dmha                                         List all malloc_state instances in application
| dmhb @[malloc_state]                         Display all parsed Double linked list of main_arena's or a particular arena bins instance
| dmhb [bin_num|bin_num:malloc_state]          Display parsed double linked list of bins instance from a particular arena
| dmhbg [bin_num]                              Display double linked list graph of main_arena's bin [Under development]
| dmhc @[chunk_addr]                           Display malloc_chunk struct for a given malloc chunk
| dmhd [tcache|unsorted|fast|small|large]      Display description of bins in the main_arena
| dmhf @[malloc_state]                         Display all parsed fastbins of main_arena's or a particular arena fastbinY instance
| dmhf [fastbin_num|fastbin_num:malloc_state]  Display parsed single linked list in fastbinY instance from a particular arena
| dmhg                                         Display heap graph of heap segment
| dmhg [malloc_state]                          Display heap graph of a particular arena
| dmhi @[malloc_state]                         Display heap_info structure/structures for a given arena
| dmhj                                         List the chunks inside the heap segment in JSON format
| dmhm                                         List all elements of struct malloc_state of main thread (main_arena)
| dmhm @[malloc_state]                         List all malloc_state instance of a particular arena
| dmht                                         Display all parsed thread cache bins of all arena's tcache instance
| dmhv @[malloc_state]                         List heap chunks of a particular arena along with hexdump of first 0x10 bytes
| dmh?                                         Show map heap help

Rizin supports Glibc, Jemalloc < 5.0 and Windows heap.