Heappo

Heappo 🦛 is a PyKD based extensions for WinDBG which aids Heap Exploitation by logging the followings:

Tutorial and background here

Features

Runs on both Py2/Py3 and x86/x64 Timestamps :)

Tracing:

RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
VirtualAlloc

Paramenters

Custom allocation size
External log file

To do:

~~Add VirtualAlloc~~
Group functions by same usr-ptr (and possibly same return pointer/caller)
Log file in mona.py format

Requirements

Python2.7 OR Python3.6 x64
PyKD x64/32
WinDbg :)

Installation and Setup

From within WinDBG

 .load pykd
 !py heappo.py <heap_alloc_size> log=<on/off> 
 
 # Example
 !py heappo.py 0x40 log=on

Sample Outputs

0:001> !py c:\users\matteo\desktop\heappo.py null log=on
2020-03-25 09:23:48.954000, VirtualAlloc(0x0L , 0x2800000L , 0x2000L , 0x4L) = 0x510000 - From: 0x401034
2020-03-25 09:24:52.166000, VirtualAlloc(0x0L , 0xa00000L , 0x1000L , 0x4L) = 0x2d10000 - From: 0x40104b

0:014> !py c:\users\matteo\desktop\heappo.py 0x40 log=on
2020-03-25 09:26:11.463000, RtlAllocateHeap(0x5c0000L , 0x0L , 0x40L) = 0x6435c8 - From: 0x7124b36e
2020-03-25 09:26:14.224000, RtlAllocateHeap(0x5c0000L , 0x0L , 0x40L) = 0x6435c8 - From: 0x7124b36e
2020-03-25 09:26:17.048000, RtlAllocateHeap(0x5c0000L , 0x0L , 0x40L) = 0x6435c8 - From: 0x7124b36e
2020-03-25 09:26:17.048000, RtlAllocateHeap(0x5c0000L , 0x0L , 0x40L) = 0x6435c8 - From: 0x7124b36e
2020-03-25 09:26:27.204000, RtlAllocateHeap(0x5c0000L , 0x0L , 0x40L) = 0x642a40 - From: 0x761c0636

Sample Graph

Credits

Greatly inspired by Sam Brown project

r0t0tiller / heappo