Windows 10 Nt Heap Exploitation (Chinese version)

Windows Heap Exploitation
Angelboy

Windows Heap Exploitation
• Windows Memory Allocator

• NT heap

• BackEnd

• Exploitation

• FrontEnd

• LowFragmentationHeap

• Exploitation

Windows memory allocator
• Win 10 的 memory allocator 非常複雜，基本上主要有下列列兩兩種

• Nt Heap

• Default memory allocator

• SegmentHeap

• Win10 中全新的 memory allocator 機制

• 部分系統程式及 UWP 會使⽤用

• Nt Heap 中⼜又可分

• 後端管理理器 (Back-End)

• 前端管理理器 (Front-End)


• 基本上是為了了不讓記憶體過於破碎，相同⼤大⼩小的記憶體區塊分配到⼀一定數
量量後就會使⽤用 (連續分配相同記憶體區塊 18 次)

• Size <= 0x4000

• ⽬目前會以 win 10 (1809) 為主

• OS build - 17763.379

• 之後版本可能不⼀一定完全正確

• 結構常常改動很⼤大，有個概念念後，到新的發⾏行行版本，需要⾃自⼰己去追⼀一下結
構

• Overview
Kernel32.dll
HeapAlloc
HeapFree
msvcrt140.dll
malloc
free
ntdll.dll
RtlAllocateHeap
RtlFreeHeap
ntdll.dll
RtlpAllocateHeap
RtlpFreeHeap
ntdll.dll
RtlpLowFragHeapAlloc
RtlpLowFragHeapFree
Kernel
Front-End
Back-End

• 在 LFH 沒啟⽤用下，我們呼叫 malloc
Kernel32.dll
HeapAlloc
HeapFree
msvcrt140.dll
malloc
free
ntdll.dll
RtlAllocateHeap
RtlFreeHeap
ntdll.dll
RtlpAllocateHeap
RtlpFreeHeap
Kernel
Back-End

• 啟⽤用 LFH 後，第⼀一次或 LFH 能⽤用的⽤用完時 
會先跟 Back-End 要⼀一⼤大塊空間來來管理理
Kernel32.dll
HeapAlloc
HeapFree
msvcrt140.dll
malloc
free
ntdll.dll
RtlAllocateHeap
RtlFreeHeap
ntdll.dll
RtlpAllocateHeap
RtlpFreeHeap
ntdll.dll
RtlpLowFragHeapFree
Kernel
Front-End
Back-End

• 啟⽤用 LFH 之後分配相同⼤大⼩小時，會直接給 
Front-End 管理理
Kernel32.dll
HeapAlloc
HeapFree
msvcrt140.dll
malloc
free
ntdll.dll
RtlAllocateHeap
RtlFreeHeap
ntdll.dll
RtlpLowFragHeapFree
Front-End

• HEAP 可分為

• Process Heap

• Default heap

• 整個 process 共享，呼叫 api 時會⽤用到

• 會存在 _PEB 結構中

• CRT 中的函式時也會⽤用到

• 存在 crt_heap

• HEAP 可分為

• Private heap

• 另外創建的 heap

• HeapCreate

• Core data structure

• _HEAP_ENTRY (chunk)

• Malloc 出來來的基本結構

• 在前後端分配器中，長相會不太⼀一樣，但都是同⼀一個名字

data
chunk header
chunk header
data
_HEAP
chunk header
.
.
.
malloc return value

• Core data structure

• _HEAP

• 整個 memory allocator 中最核⼼心的結構，⽤用來來管理理該 heap

• 每個 Heap 都會有⼀一個 _HEAP 通常在 heap 開頭

• _HEAP

• EncodeFlagMask

• Heap 初始化後會設置為
0x100000 在判斷是否要 encode
該 heap 中 chunk 的 header

• Encoding (_HEAP_ENTRY)

• ⽤用來來與 chunk header 做 xor 的
cookies
…
EncodeFlagMask0x7c
0x80
0x138
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
0x150
0x198
FrontEndHeapUsageData0x1a8
…

• _HEAP

• BlocksIndex (_HEAP_LIST_LOOKUP_)

• Back-End 中，重要的結構之⼀一，⽤用
來來管理理 Back-End 中的 chunk ，後
⾯面會詳細敘述

• FreeList (_HEAP_ENTRY)

• 串串接 Back-End 中的所有 free chunk
，類似 unsorted bin

• Sorted list
…
EncodeFlagMask0x7c
0x80
0x138
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
0x150
0x198
…

• _HEAP

• FrontEndHeap

• 指向管理理 FrontEnd 的 Heap 的結構

• FrontEndHeapUsageData

• 指向⼀一個對應各⼤大⼩小 chunk 的陣列列

• 紀錄各種⼤大⼩小 chunk 使⽤用次數，到
達某個程度時會去 enable 該對應⼤大
⼩小 chunk 的 Front-End allocator
…
EncodeFlagMask0x7c
0x80
0x138
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
0x150
0x198
…

• Nt Heap



Nt heap
• Nt Heap


• Data structure

• 分配機制


• 分為三種狀狀況

• Allocated chunk

• Freed chunk

• VirtualAlloc chunk

Nt heap

• PreviousBlockPrivateData

• 基本上可為前⼀一塊 chunk 的 data，因
為 chunk 必須對⿑齊 0x10

• Size

• Chunk 的 size 但存入⽅方式並不是直接
存 size ⽽而是存 (size >>4) 後的值
User Data
PreviousBlockPrivateData
(8byte)
Size (2byte)
Flag (1byte)
SmallTagIndex (1byte)
PreviousSize (2byte)
SegmentOffset (1byte)
Unusedbyte (1byte)
Inused

Nt heap

• Flag

• 表⽰示該 chunk 是否 inused

• SmallTagIndex

• 前⾯面三個 byte 的 Checksum(三個
byte 做 xor)，之後拿 header 出來來時會
驗證
User Data
(8byte)
Size (2byte)
Flag (1byte)
Unusedbyte (1byte)
Inused

Nt heap

• PreviousSize

• 相鄰的前⼀一塊 chunk 的 Size ，這邊ㄧ
樣是 (Size >> 4) 過後的數值

• SegmentOﬀset

• 某些情況下⽤用來來找 segment 的
User Data
(8byte)
Size (2byte)
Flag (1byte)
Unusedbyte (1byte)
Inused

Nt heap

• Unusedbyte

• 紀錄 user malloc 後所剩 chunk 的空間

• 可以⽤用來來判斷 chunk 的狀狀態判斷 chunk
是 FrontEnd or BackEnd

• User Data

• User 所使⽤用的區塊
User Data
(8byte)
Size (2byte)
Flag (1byte)
Unusedbyte (1byte)
Inused

Nt heap

• Flink

• 指向 linked list 中下⼀一塊 chunk

• Blink

• 指向 linked list 中上⼀一塊 chunk

• Unusedbyte

• 恆為 0
User Data
(8byte)
Size (2byte)
Flag (1byte)
Unusedbyte (1byte)
freed
Flink
Blink

Nt heap
• _HEAP_VIRTUAL_ALLOC_ENTRY (mmap
chunk)

• Flink

• 指向下⼀一塊 VirtualAlloc 出來來的 chunk

• Blink

• 指向上⼀一塊 VirtualAlloc 出來來的 chunk
User Data
Size (2byte)
Flag (1byte)
Unusedbyte (1byte)
inused
Flink
Blink
…

Nt heap
• _HEAP_VIRTUAL_ALLOC_ENTRY (mmap
chunk)

• Size

• 這邊的 size 指的是 unused size，且
沒有 shift 過

• Unusedbyte

• 恆為 4
User Data
Size (2byte)
Flag (1byte)
Unusedbyte (1byte)
inused
Flink
Blink
…

Nt heap
• FreeLists (_HEAP_ENTRY)

• 在 Free 完⼀一塊 chunk 後，會將該 chunk 放到 FreeLists 中，並會依照⼤大
⼩小決定插在 FreeLists 中的位置
Flink
Blink
Chunk header (0x70)
Flink
Blink
Chunk header (0x110)
Flink
Blink

Nt heap
Flink
Blink
Chunk header (0x70)
Flink
Blink
Flink
Blink
PreviousBlockPrivateDat
…
EncodeFlagMask0x7c
0x80
0x138
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
0x150
0x198
…
Flink
Blink
_HEAP

Nt heap
• Remark

• 關於 header encoding

• 所有的 chunk 都會經過 xor 過，在存 chunk header 時，會將整個
header^(_HEAP->Encoding) 在存入

• decode 時會驗證 check sum 確保沒被改掉

• 驗證⽅方式為 encode_header^(_HEAP->Encoding) 後的值，前 3 byte
xor 後和第 4 byte 比對

Nt heap
• BlocksIndex (_HEAP_LIST_LOOKUP)

• 主要⽤用來來管理理各種不同⼤大⼩小的 freed chunk 的結構，⽅方便便在配置記憶體
時，能快速的找到適合的 chunk

Nt heap

• ExtendedLookup (_HEAP_LIST_LOOKUP)

• 指向下⼀一個 ExtendedLookup

• 通常下⼀一個會管理理更更⼤大塊 chunk 所⽤用的
結構

• ArraySize

• 該結構會管理理的，最⼤大 chunk 的⼤大⼩小，
通常為 0x80 (實際上是 0x800)
BlocksIndex
ExtendedLookup0x0
ArraySize0x8
…
ItemCount (4 bytes)
OutofRangeItems (4 bytes)
0x10
0x14
BaseIndex0x18
ListHead
ListsInUseUlong
ListHint
0x20
0x28
0x30

Nt heap

• ItemCount

• ⽬目前該結構所管理理的 chunk 數

• OutofRangeItems

• 超出該結構所管理理⼤大⼩小的 chunk 的
數量量
BlocksIndex
ExtendedLookup0x0
ArraySize0x8
…
ItemCount (4 bytes)
0x10
0x14
BaseIndex0x18
ListHead
ListsInUseUlong
ListHint
0x20
0x28
0x30

Nt heap

• BaseIndex

• 該結構所管理理的 chunk 的起始 index，
⽤用來來從 ListHint 找適合⼤大⼩小的 free
chunk ⽤用的，下⼀一個 BlocksIndex 將從
這個 index 的最⼤大值作為 BaseIndex

• ListHead (_HEAP_ENTRY)

• FreeList 的 Head
BlocksIndex
ExtendedLookup0x0
ArraySize0x8
…
ItemCount (4 bytes)
0x10
0x14
BaseIndex0x18
ListHead
ListsInUseUlong
ListHint
0x20
0x28
0x30

Nt heap

• ListsInUseUlong

• ⽤用在判斷 ListHint 中是否有適合⼤大⼩小的
chunk，是⼀一個 bitmap

• ListHint

• 重要結構，⽤用來來指向相對應⼤大⼩小的 chunk
array

• 其⽬目的就在於更更快速找到適合⼤大⼩小的 chunk 
⼤大⼩小為 0x10 為⼀一個間隔
BlocksIndex
ExtendedLookup0x0
ArraySize0x8
…
ItemCount (4 bytes)
0x10
0x14
BaseIndex0x18
ListHead
ListsInUseUlong
ListHint
0x20
0x28
0x30

…
EncodeFlagMask
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
FrontEndHeapUsageDat
…
_HEAP
BlocksIndex
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
PreviousBlockPrivate
Flink
Blink
Flink
Blink
Chunk header(0x160)
PreviousBlockPrivat
ListHint
Flink
Flink
Flink
ListHint[7]
ListHint[0x11]
ListHint[0x16]
000001…1…1000000000
ListsInUseUlong

Nt heap
• Allocate (RtlpAllocateHeap)

• 基本上分為三種

• Size <= 0x4000

• 0x4000 < size <= 0xﬀ000

• Size > 0xﬀ000

Nt heap

• Size <= 0x4000

• 基本上主要分配都會在 RtlpAllocateHeap

• 接著會去看該 size 對應到的 FrontEndHeapStatusBitmap 使否有啟⽤用 LFH

• 沒有的話會對對應到的 FrontEndHeapUsageData 加上 0x21

• 並且檢查值是否超過 0xﬀ00 或者 & 0x1f 後超過 0x10 
通過條件就會啟⽤用 LFH

Nt heap

• Size <= 0x4000

• 接下來來會先看對應到的 ListHint 是否有值，會以 ListHint 中的 chunk 為優先

• 如果有適合剛好的 chunk 在 ListHint 上則移除 ListHint，並且會看該 chunk 的 Flink ⼤大⼩小是否
剛好也是同樣 size

• 是的話就將 LintHint 填上 Flink

• 不是則清空

• 最後則 unlink 該 chunk 把這塊 chunk 從 linked list 中移除返還給使⽤用者，並將 header xor
回去

Nt heap

• Size <= 0x4000

• 如果沒有剛好適合的

• 從比較⼤大的 ListHint 中找，有找到比較⼤大的後如果該 chunk 將會從 ListHint 則移除之，
並看下⼀一塊 chunk size 有沒有剛好⼤大⼩小，有則補上，並且 unlink 將該 chunk 移除
freelist

• 最後將該 chunk 做切割，剩下的⼤大⼩小重新加入 Freelist ，如果可以放進 ListHint 就會放
進去

• 然後回傳切好的 chunk 給使⽤用者，這邊也會對切割後跟回傳使⽤用者的 chunk header xor

Nt heap

• Size <= 0x4000

• 如果 FreeList 中都沒有

• 嘗試 ExtendHeap 加⼤大 heap 空間

• 再從 extend 出來來的 chunk 拿

• 接著後⾯面⼀一樣切割，放回 ListHint，xor header

Nt heap

• 0x4000 < size <= 0xﬀ000

• 除了了沒有對 LFH 相關的操作外，其餘都跟 0x4000 ⼀一樣

Nt heap

• Size > 0xﬀ000 (VirtualMemoryThreshold << 4)

• 直接使⽤用 ZwAllocateVirtualMemory

• 類似 mmap 直接給⼀一⼤大塊，並且會插入 _HEAP->VirtualAllocdBlocks
這個 linked list 中

• 這個 linked list 是串串接該 Heap VirtualAllocate 出來來的區段⽤用的

Nt heap
• Free (RtlpFreeHeap)

• 可分為

• Size <= 0xﬀ000

• Size > 0xﬀ000

Nt heap

• Size <= 0xﬀ000

• 會先檢查 alignment、利利⽤用 unused byte 判斷該 chunk 狀狀態

• 如果是非 LFH 下，會對對應到的 FrontEndHeapUsageData 減 1

• 接著會判斷前後的 chunk 是否為 freed ，是的話就合併

• 此時會把可以合併的 chunk 做 unlink ，並從 ListHint 移除

• 移除⽅方式與前⾯面相同，看看下⼀一塊是不是同樣⼤大⼩小，是的話補上 ListHint

Nt heap

• Size <= 0xﬀ000

• 合併完後， update size & prevsize ，然後會看看是不是最前跟最後，
是就插入，不⾏行行插入就從 ListHint 中插入，並且 update ListHint，插入
時也會對 linked list 做檢查

• 但這檢查不會 abort

• 其原因主要因為不做 unlink 寫入

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Free(Q)
Size (0x11)
Flag (0x1)
SmallTagIndex (0x10)
Prevsize (0x7)

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Find Prevchunk
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Prevchunk =
Chunk address
-
(prevsize << 4)

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Find Prevchunk
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Prevchunk =
chunk addr - 0x70

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Decode prevchunk 
header
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check checksum
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
SmallTagInex == 
(size & 0xﬀ)
xor
(size >> 8)
xor
Flag

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check checksum
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
7 == 
0x7^0x0^0x0

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check 
linked list
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
P->Flink->Blink ==  
P->Blink->Flink ==  
P

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Find  
BlocksIndex
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Find suitable  
BlocksIndex
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
Check
P->size < ArraySize

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check 
ListHint
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
Check
ListHint[7] ==
Prevchunk

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check 
ListHint
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
Check
prevchunk->Flink ==
ListHead
成立的話會準備 update 
ListHint

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check 
ListHint[7]->Flink
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
decode
prevchunk->Flink
And check
the checksum
由於前⼀一張 slide 不成立
要去驗 Flink 的 size

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check 
ListHint[7]->Flink
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
Size ==  
prevchunk->Flink->size
如果相等，直接將 ListHint
換成下⼀一塊

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Update 
ListHint[7]
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
ListHint[7] = 
prevchunk->Flink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Flink
Blink
Chunk header (0x70)
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Unlink 
prevchunk
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x7)
Flag (0x0)
SmallTagIndex (0x7)
Prevchunk->Blink->Flink 
= Prevchunk->Flink 
Prevchunk->Flink->Blink
= Prevchunk->Blink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Update 
prevchunk 
and next chunk
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex (0x7)
Prevchunk->size = 
0x11 + Prevchunk->size(7)
R->Prevsize = 0x18
P
Flink
Blink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Check 
next chunk
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex (0x7)
檢查下⼀一塊 chunk 
使否 freed
P
Flink
Blink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Find suitable 
BlocksIndex 
For P
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex (0x7)
Check 
P->Size < ArraySize
P
Flink
Blink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Search 
insert 
point
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex (0x7)
Check 
P->size <
ListHead->Blink->Size 
P->size <
ListHead->Flink->Size
P
Flink
Blink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Insert 
linked list
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex (0x7)
Check 
S->Blink->Flink 
== S
If not pass it will not  
abort 
But it will not unlink
P
Flink
Blink

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Update 
ListHint
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex (0x7)
If LintHint[0x18] == NULL 
LintHint[0x18] = P
P
Flink
Blink
FlinkListHint[0x18]

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Update 
header
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0x18)
Flag (0x0)
SmallTagIndex =  
(size >> 8) ^ 
(size & 0xﬀ) ^ 
Flag
P
Flink
Blink
FlinkListHint[0x18]

ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
Flink
Blink
Chunk header(0x110)
PreviousBlockPrivat
FlinkListHint[7]
Flink
Blink
Chunk header(0x70)
PreviousBlockPrivat
merge chunk
P
Q
R
S
Encode 
header
Size (0x11)
Flag (0x1)
Prevsize (0x7)
Size (0xda)
Flag (0xab)
P->header ^ 
_HEAP->Encoding
P
Flink
Blink
FlinkListHint[0x18]

Nt heap

• Size > 0xﬀ000

• 檢查該 chunk 的 linked list 並從 _HEAP->VirtualAllocdBlocks 移除

• 接著使⽤用 RtlpSecMemFreeVirtualMemory 將 chunk 整個 munmap 掉

Back-End Exploitation
• Unlink

• 基本上與 Linux 中的 unlink 很類似，繞過⽅方法也差不多

• 簡⽽而⾔言之就是利利⽤用從 linked listed 移除 node 的⾏行行為來來做有限制的寫入

• 要注意的是在會 decode 的地⽅方，都要讓他正常 decode

• 也就是 check sum 要過

• 另外⼀一點是 Flink 及 Blink 並不是指向 chunk 開頭，⽽而是直接指向 User data 部分，也就是
不太需要做偏移偽造 chunk

• 所以找到⼀一個指向該 userdata 的 pointer 讓他繞過 double linked list 的驗證就好了了

• Unlink

• Q->Blink->Flink = Q->Flink

• Q->Flink->Blink = Q->Blink
Flink
Blink
Chunk header (0x70)
Flink
Blink
Flink
Blink
QP R

• Unlink

• Q->Blink->Flink = Q->Flink

• Q->Flink->Blink = Q->Blink
Flink
Blink
Chunk header (0x70)
Flink
Blink
QP R

A
A
Chunk header(0x50)
PreviousBlockPrivat
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
UAF
T
A

A
A
Chunk header(0x50)
PreviousBlockPrivat
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
Free(Q)
T
A

Q
A
Q
Chunk header(0x50)
PreviousBlockPrivat
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
A
ListHead
QListHint[0x11]
free(S)
Update ListHint

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
A
S
SListHint[0x11]
Q
ListHead

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
A
S
SListHint[0x11]
Q
ListHead
Let’s corrupt the heap !

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
free(P)

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
Check next chunk  
is free

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
Decode  
chunk Q

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead(&Q-8)->Blink
==
(&Q)->Flink
== Q

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead(&Q-8)->Blink
==
(&Q)->Flink
== Q
Flink
Blink

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead*(&Q)
==
*(&Q)
== Q

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead*(&Q)
==
*(&Q)
== Q
Pass the check !!

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
Find  
BlockIndex

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
Check 
ListHint[0x11]

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead由於 S != Q 
所以不會對 ListHint 
做任何處理理

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
Data Pointer
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
Unlink !!
Q->Blink->Flink
= Q->Flink
Flink
Blink

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
&Q - 8
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHeadUnlink !!
Q = &Q-8

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
&Q - 8
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHead
Unlink !!
Q->Flink->Blink
= Q->Blink
Flink
Blink

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHeadUnlink !!
Q = &Q

S
A
Q
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
P
Q
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
&Q - 8
&Q
SListHint[0x11]
Q
ListHeadUpdate  
chunk size

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHeadUpdate  
chunk size
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
Search insert point
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHeadFind the last one
And decode it
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
P
Find the ﬁrst one
And decode it

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
我們要插在 A 前
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
Check 
A->Blink->Flink
== A
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
Check 
Q->Flink
== A
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHeadFailed 
不過不會 abort
只是不會 insert
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
Update  
ListHint
P

S
A
Chunk header(0x50)
PreviousBlockPrivat
S
Chunk header(0x110)
PreviousBlockPrivat
R
S
P
&Q
R
S
T
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint
BlockIndex
ListHint
T
A
SListHint[0x11]
Q
ListHead
P
PListHint[0x22]

• Edit Q

• 我們可以把 Q 周圍的 pointer 寫掉

• 最後可達成任意記憶體讀寫
P
&Q
R
S
T

• Edit Q

• 我們可以把 Q 周圍的 pointer 寫掉

• 最後可達成任意記憶體讀寫

• 可對 Target 1 - 4 做寫入
P
Target 1
Target 2
Target 3
Target 4

• After arbitrary memory reading and writing

• Leak

• ntdll.dll

• PebLdr

• binary address

• Kernel32.dll


• Leak

• kernelbase

• KERNELBASE!BasepFilterInfo

• Stack address


• Leak

• ntdll.dll

• _HEAP_LOCK

• _HEAP->LockVariable.Lock

• CriticalSection->DebugInfo

• 指向 ntdll


• Leak

• ntdll!PebLdr

• _PEB_LDR_DATA

• 可找出所有 DLL 的位置

• 不過缺點是最後⼀一兩兩個 byte 可能是 0

• 可先找出 binary base 從 IAT 找 kernel32


• Leak

• BinaryBase

• 從 IAT 找出 Kernel32 位置


• Leak

• Kernel32

• 重要 dll 很多常⽤用 function 都在這 (CreateFile, ReadFile,WriteFile)

• IAT

• 獲得 kernelbase.dll 位置


• Leak

• kernelbase

• KERNELBASE!BasepFilterInfo

• 指向 Heap 上的結構

• 裡⾯面有⾼高機率會有 stack pointer

• https://j00ru.vexillium.org/2016/07/disclosing-stack-data-from-the-default-
heap-on-windows/


• Leak

• 如果 BasepFilterInfo 中沒有 stack address

• 因 BasepFilterInfo 內容會有 stack address 是因為未初始化因素，所
以有機會沒有 stack address

• 可以從 PEB 往前或往後算 1 個 page ，通常會是 TEB 位置，上⾯面繪
有 stack 尾段的位置，可以藉由該位置找出 retrun address


• Write

• Return address

• Control RIP

• ROP to VirtualProtect/VirtualAlloc

• Jmp to shellcode

• Nt Heap


• ⽬目前 win10 主要使⽤用


• 在非 Debug 下才會 enable

• Size < 0x4000

• Nt Heap


• Data Structure

• 分配機制

LFH
• FrontEndHeap (_LFH_HEAP)

• HEAP (_HEAP)

• 指向對應到的 _HEAP

• Buckets (_HEAP_BUCKET)

• ⽤用來來尋找配置⼤大⼩小對應到 Block ⼤大⼩小
的陣列列結構
…
Heap0x18
0x2a4
…
Buckets
SegmentInfoArray
…
…
LocalData
0x4a8
0xcc0

LFH
• FrontEndHeap (_LFH_HEAP)

• SegmentInfoArray
(_HEAP_LOCAL_SEGMENT_INFO)

• _HEAP_LOCAL_SEGMENT_INFO array，
不同⼤大⼩小對應到不同的 Segment_info 結
構，主要管理理對應到的 Subsegment 的資訊

• LocalData (_HEAP_LOCAL_DATA)

• 其中有個欄欄位指向 LFH 本⾝身，通常⽤用來來找
回 LFH
…
Heap0x18
…
Buckets
SegmentInfoArray
…
…
LocalData
0x2a4
0x4a8
0xcc0

LFH
• Buckets (_HEAP_BUCKET)

• BlockUnits

• 要分配出去的⼀一個 block ⼤大⼩小 >> 4

• SizeIndex

• 使⽤用者需要的⼤大⼩小 >> 4
BlockUnits
Buckets
SizeIndex
…
BlockUnits
SizeIndex
…
…
…
Buckets[0]
Buckets[1]

LFH

• LocalData (_HEAP_LOCAL_DATA)

• 對應到 _LFH_HEAP->LocalData ⽅方便便
從 SegmentInfo 找回 _LFH_HEAP

• BucketIndex

• 對應到的 BucketIndex
LocalData
SegmentInfoArray[x]
ActiveSubsegment
CachedItems
…
BucketIndex
…

LFH

• ActiveSubsegment (_HEAP_SUBSEGMENT)

• 極為重要結構

• 對應到分配出去的 Subsegment

• 其⽬目的在於管理理 Userblock

• 記錄了了剩餘多少 chunk

• 該 Userblock 最⼤大分配數等等
SegmentInfoArray[x]
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…

LFH

• CachedItems (_HEAP_SUBSEGMENT)

• _HEAP_SUBSEGMENT array

• 存放對映到該 SegmentInfo 且還有可
以分配 chunk 給 user 的Subsegment

• 當 ActiveSubsegment ⽤用完時，會從
這邊填充，置換掉 ActiveSubsegment
SegmentInfoArray[x]
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…

LFH
…
Heap
…
…
…
LocalData
0x18
0x2a4
0x4a8
0xcc0
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
_HEAP_LOCAL_SEGMENT_INFO
…
EncodeFlagMask
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
FrontEndHeapUsageData
…
_HEAP
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…

LFH

• LocalInfo

• 指回對應到的
LocalInfo
ActiveSubsegment
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
0x0
0x8
0x20
0x24
0x28
0x2a

LFH

• UserBlock (_HEAP_USERDATA_HEADER)

• LFH 的記憶體分配池

• 也就是要分配出去的 Chunk (Block)
所在位置

• 開頭會有些 metadata 管理理這些 chunk

• 重要結構
LocalInfo
ActiveSubsegment
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
0x0
0x8
0x20
0x24
0x28
0x2a

LFH

• AggregateExchg (_INTERLOCK_SEQ)

• ⽤用來來管理理對應到的 UserBlock 中還有
多少 freed chunk

• LFH ⽤用這個判斷是否還從該
UserBlock 分配

• 同時也有 Lock 的作⽤用
LocalInfo
ActiveSubsegment
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
0x0
0x8
0x20
0x24
0x28
0x2a

LFH

• BlockSize

• 在該 UserBlock 中每個 Block (chunk)的⼤大⼩小

• BlockCount

• 在該 UserBlock 中 Block 的總數

• SizeIndex

• 該 UserBlock 對應到的 SizeIndex
LocalInfo
ActiveSubsegment
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
0x0
0x8
0x20
0x24
0x28
0x2a

LFH
• AggregateExchg (_INTERLOCK_SEQ)

• Depth

• 該 UserBlock 所剩下的 Freed chunk 數量量

• Lock

• 就是 Lock
AggregateExchg
Depth0x0
Hint (15bit)
Lock (1bit)
0x8

LFH

• SubSegment

• 指回對應的 Subsegment

• EncodeOﬀsets

• ⽤用來來驗證 chunk header 是否有被改過

• BusyBitmap

• 記錄該 UserBlock 哪些 chunk 有在⽤用的
bitmap
SubSegment
UserBlock
…
EncodedOffsets
BusyBitmap
0x8
0x18
0x20
chunk header
chunk header
chunk header

LFH

• Block (chunk)

• LFH 回傳給使⽤用者的 chunk
SubSegment
UserBlock
…
EncodedOffsets
BusyBitmap
0x8
0x18
0x20
chunk header
chunk header
chunk header

LFH

• SubSegmentCode

• Encode 過的 metadata ⽤用來來推回
userblock 的位置

• PreviousSize

• 該 chunk 在 UserBlock 中的 index
User Data
(8byte)
SubSegmentCode (4byte)
Unusedbyte (1byte)
Inused

LFH

• Unusedbyte

• Unusedbyte & 0x80 is true
User Data
(8byte)
Unusedbyte (1byte)
Inused

LFH

• Unusedbytes

• 恆為 0x80

• ⽤用來來判斷是否為 LFH 的 Free chunk
User Data
(8byte)
Unusedbyte (1byte)
Freed

LFH
• Remark

• 關於 EncodedOﬀsets

• 在 UserBlock 初始化時設置，其算法為下⾯面四個值的 xor

• (sizeof(userblock header) | (BlockUnit*0x10 << 16))

• LFHkey

• Userblock address

• _LFH_HEAP address

LFH
• Remark

• 關於 LFH header encoding

• 所有的 chunk header 在初始化時都會經過 xor 過，算法為下⾯面個值的 xor

• _HEAP address

• LFHkey

• Chunk address >> 4

• ((chunk address) - (UserBlock address)) << 12

LFH
…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
_HEAP_USERDATA_HEADER
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…

• Nt Heap


• 初始化

• 在 FrontEndHeapUsageData[x] & 0x1f > 0x10 時，下⼀一次的 allocate 會對 LFH 做出初始化

• 會先 ExtendFrontEndUsageData 及增加更更⼤大的 BlocksIndex (0x80-0x400)

• 建立 FrontEndHeap

• 初始化 SegmentInfoArrays[idx]

• 接下來來在 allocate 相同⼤大⼩小的 chunk 就會開始使⽤用 LFH

• LFH(初始化)

• malloc(0x40) * 16
…
0x210
此時可 enable LFH 範圍為
index 0x0 - 0x80

• LFH(初始化)

• malloc(0x40) (第 17 次)
…
0x231 0x231 & 0x1f > 0x10

• LFH(初始化)
…
0x231
heap->CompatibilityFlag |= 0x20000000
設置上這個 ﬂag 後
下次 allocate 時會去初始化LFH

…
EncodeFlagMask
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
…
_HEAP
0x231
BlocksIndex
ExtendedLookup
ArraySize
…
ItemCount (4 bytes)
BaseIndex
ListHead
ListsInUseUlong
ListHint

• LFH(初始化)

• malloc(0x40) (第 18 次)

• ExtendFrontEndUsageData 及增加更更⼤大的 BlocksIndex
(0x80-0x400) ，並設置對應的 bitmap

• 並在該對應的 FrontEndHeapUsageData 寫上對應的
index，此時可 enable LFH 範圍變為 (idx: 0-0x400)

• 建立並初始化 FrontEndHeap (mmap)

• 初始化 SegmentInfoArrays[idx]

• 在 SegmentInfoArrays[BucketIndex] 填上 segmentInfo
…
0x4

…
EncodeFlagMask
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
…
_HEAP
0x251 0x4
BlocksIndex
ExtendedLookup
ArraySize(0x80)
…
ItemCount (4 bytes)
BaseIndex (0x0)
ListHead
ListsInUseUlong
ListHint
BlocksIndex
ExtendedLookup
ArraySize (0x400)
…
ItemCount (4 bytes)
BaseIndex (0x80)
ListHead
ListsInUseUlong
ListHint

…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
…
EncodeFlagMask
Encoding
…
BlocksIndex
…
FreeList
…
FrontEndHeap
…
…
_HEAP
0x251 0x4

• LFH(初始化)

• malloc(0x40) (第 19 次)

• Allocate Userblock 並初始化

• 設置對應的 chunk

• 設置對應的 ActiviteSubsegment

• 隨機返回其中的⼀一個 chunk
Userblock metadata
Chunk 00
Chunk 01
…
Chunk MaxBlockCount

…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…

• LFH

• Allocate (RtlpLowFragHeapAllocFromContext)

• 先看看 ActiveSubsegment 中是否有可分配的 chunk

• 從 ActiveSubsegment->depth 判斷

• 如果沒有則會從 CachedItem 找，有找到的話會把 ActiveSubsegment
換成 CachedItem 中的 SubSegment

…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
Find SegementIfoArray by bucket->SizeIndex

…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
Check ActiveSubsegment

…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
Check ArgregateExchg.Depth not 0

…
Heap
…
…
…
LocalData
Buckets[x]
SegmentInfoArray[x]
BlockUnits
SizeIndex
…
_LFH_HEAP
_HEAP_BUCKET
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
LocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
Check Userblock

• LFH


• 取得 RtlpLowFragHeapRandomData[x] 上的直

• 下⼀一次會從 RtlpLowFragHeapRandomData[x+1] 取

• x 為 1 byte ，當下次輪輪回 x 則會 x = rand() %256 繼續取

• RtlpLowFragHeapRandomData 為⼀一個 random 256 byte 的陣列列

• 範圍為 0x0 - 0x7f

• LFH


• 最獲得的 index 為

• RtlpLowFragHeapRandomData[x]*maxidx >> 7

• 如果 collision 則往後取最近的

• 檢查 (unused byte & 0x3f) !=0 (表⽰示 chunk 是 freed)

• 最後設置 index 及 unused byte 就返回給使⽤用者

….
….
….
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
• Get an index

• RtlpLowFragHeapRandomData[x]*maxidx >> 7

• 檢查該 index 對映到的 bitmap 是否為 0

• 是 0 則返回對映的 bitmap

• 非 0 擇取最近的下⼀一個
chunk header

….
….
….
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
• 算出來來的 index 發現已⽤用過

• 會取下⼀一個

• 並設置對映的 bitmap
chunk header

• LFH

• Free (RtlFreeHeap)

• Update unused byte in chunk header

• Find the index of the Chunk and reset Userblock->BusyBitmap

• Update ActiveSubsegment->AggregateExchg

• 如果 Free 的 chunk 不屬於當前 ActiveSubsegment 則會看看能不能放
進 cachedItems ，可以放就放進去

LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
• Free

• ⽤用 chunk header 尋找
UserBlock

LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
• Free

UserBlock

• 找回對映的 SubSegment

LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
Depth
Hint (15bit)
Lock (1bit)
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_INTERLOCK_SEQ
• Free

UserBlock

• 找回對映的 SubSegment

• 設置 unused byte = 0x80

• 清除對映的 bitmap

• Update AggregateExchg

LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_HEAP_USERDATA_HEADERLocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
_HEAP_SUBSEGMENT
Depth (1)
Hint (15bit)
Lock (1bit)
_INTERLOCK_SEQ
CachedItems
ActiveSubsegmet
不等於 Free 掉 chunk 的 
SubSegment

LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
_HEAP_SUBSEGMENT
SubSegment
…
EncodedOffsets
BusyBitmap
chunk header
chunk header
chunk header
_HEAP_USERDATA_HEADERLocalData
ActiveSubsegment
CachedItems
…
BucketIndex
…
LocalInfo
UserBlock
…
AggregateExchg
BlockSzie
BlockCount
…
SizeIndex
…
_HEAP_SUBSEGMENT
Depth (1)
Hint (15bit)
Lock (1bit)
_INTERLOCK_SEQ
CachedItems
CachedItems[0]

LFH Exploitation
• Reuse attack

• 假設我們有 Use after free 的漏洞洞

• 但因為 LFH 的隨機性，導致無法預側下⼀一塊 chunk 會在哪，使得我們
很難利利⽤用

• 這時可以填滿 Userblock 的⽅方式，在 free 掉其中⼀一塊，那麼下次該
chunk 必定會拿到同⼀一塊，我們可以利利⽤用這個特性，拿到 overlap
chunk 做進⼀一步利利⽤用

LFH Exploitation
• normal case

• malloc(sizeof(A))
Userblock header

LFH Exploitation
• normal case

• malloc(sizeof(B))
Userblock header
fptr

LFH Exploitation
• normal case

• free(A)
Userblock header B
fptr

LFH Exploitation
• normal case

Userblock header B
fptr

LFH Exploitation
• normal case

Userblock header B
fptr
Hard to use

LFH Exploitation
• Reuse attack

Userblock header

LFH Exploitation
• Reuse attack

• malloc(sizeof(B)) x 6
Userblock header
fptr

LFH Exploitation
• Reuse attack

• free(A)
Userblock header
B
B B B
fptr B B

LFH Exploitation
• Reuse attack

Userblock header
B
B B B
fptr B B

LFH Exploitation
• Reuse attack

• A->fptr
Userblock header
B
B B B
fptr B B

LFH Exploitation
• Reuse attack

• A->fptr
Userblock header
B
B B B
fptr B B
Hĳack the control ﬂow !

Reference
• https://github.com/saaramar/
35C3_Modern_Windows_Userspace_Exploitation

• http://illmatics.com/Understanding_the_LFH.pdf

• https://github.com/saaramar/Deterministic_LFH

Thank you for listening
!189
angelboy@chroot.org @scwuaptx
!189

Windows 10 Nt Heap Exploitation (Chinese version)

More Related Content

What's hot (20)

Similar to Windows 10 Nt Heap Exploitation (Chinese version) (20)

Recently uploaded (20)

Windows 10 Nt Heap Exploitation (Chinese version)