Heap

radare2’s dm subcommands can also display a map of the heap which is useful for those who are interested in inspecting the heap and its content. Simply execute dmh to show a map of the heap:

  1. [0x7fae46236ca6]> dmh
  2.   Malloc chunk @ 0x55a7ecbce250 [size: 0x411][allocated]
  3.   Top chunk @ 0x55a7ecbce660 - [brk_start: 0x55a7ecbce000, brk_end: 0x55a7ecbef000]

You can also see a graph layout of the heap:

  1. [0x7fae46236ca6]> dmhg
  2. Heap Layout
  3.     .────────────────────────────────────.
  4.     │    Malloc chunk @ 0x55a7ecbce000   │
  5.     │ size: 0x251                        │
  6.     │  fd: 0x0, bk: 0x0                  │
  7.     `────────────────────────────────────'
  8.         │
  9.     .───'
  10.     │
  11.     │
  12.   .─────────────────────────────────────────────.
  13.   │    Malloc chunk @ 0x55a7ecbce250            │
  14.   │ size: 0x411                                 │
  15.   │  fd: 0x57202c6f6c6c6548, bk: 0xa21646c726f  │
  16.   `─────────────────────────────────────────────'
  17.       │
  18.   .───'
  19.   │
  20.   │
  21. .────────────────────────────────────────────────────.
  22. │  Top chunk @ 0x55a7ecbce660                        │
  23. │ [brk_start:0x55a7ecbce000, brk_end:0x55a7ecbef000] │
  24. `────────────────────────────────────────────────────'

Another heap commands can be found under dmh, check dmh? for the full list.

  1. [0x00000000]> dmh?
  2. |Usage:  dmh # Memory map heap
  3. | dmh                 List chunks in heap segment
  4. | dmh [malloc_state]  List heap chunks of a particular arena
  5. | dmha                List all malloc_state instances in application
  6. | dmhb                Display all parsed Double linked list of main_arena's bins instance
  7. | dmhb [bin_num|bin_num:malloc_state]          Display parsed double linked list of bins instance from a particular arena
  8. | dmhbg [bin_num]     Display double linked list graph of main_arena's bin [Under developemnt]
  9. | dmhc @[chunk_addr]  Display malloc_chunk struct for a given malloc chunk
  10. | dmhf                Display all parsed fastbins of main_arena's fastbinY instance
  11. | dmhf [fastbin_num|fastbin_num:malloc_state]  Display parsed single linked list in fastbinY instance from a particular arena
  12. | dmhg                Display heap graph of heap segment
  13. | dmhg [malloc_state] Display heap graph of a particular arena
  14. | dmhi @[malloc_state]Display heap_info structure/structures for a given arena
  15. | dmhm                List all elements of struct malloc_state of main thread (main_arena)
  16. | dmhm [malloc_state] List all malloc_state instance of a particular arena
  17. | dmht                Display all parsed thead cache bins of main_arena's tcache instance
  18. | dmh?                Show map heap help

To print safe-linked lists (glibc >= 2.32) with demangled pointers, the variable dbg.glibc.demangle must be true.