Included in the boilerplate code that GLIBC provides is a dynamic memory allocator known as malloc.
Dynamic memory allocators are used when a program can't know the size or number of objects it needs prior
to runtime.
And malloc's job is simply to dish out so-called "chunks" of this dynamic memory to processes at runtime.
And those chunks come from large contiguous regions of memory known as heaps.
There's nothing special about heap memory,
they are simply large, contiguous blocks of memory that malloc requests from the kernel.
If you've ever dealt with strings in C, you've almost certainly used malloc. In C++
you're a little more abstracted;
the new() and delete() operators are thin wrappers around malloc, as are by extension make_shared() and
make_unique() etc.
Even if your code doesn't explicitly invoke malloc, chances are one of the library functions you're
using does. Basic operations like starting a new thread, opening a file or dealing with I/O
all use malloc under the hood.
So the fact that malloc is so widely used, combined with the fact that it's used in languages like
C and C++ for which memory corruption is still an issue,
both make it a great target for exploitation,
and that's what we're doing throughout the course.
Now, I mentioned the first publicly disclosed heap exploit was in 1998,
but all that involved was overwriting some user data on the heap. And overwriting, for example, a function
pointer on the heap via an overflow is no different to doing the same thing on the stack or elsewhere.
We're going to focus on so-called "generic" heap exploitation techniques that to the greatest extent possible
leverage malloc's internal operations against itself.
The idea being that once you've learned a technique, if you find a heap-related bug in a program that
fits the constraints of that technique, you could use it for an info leak, denial of service or even
arbitrary code execution.
To summarize, programs can use the malloc memory allocator at runtime to request chunks of heap memory,
which is no different to any other type of memory.
malloc is used nearly everywhere and we're going to learn how to exploit it.
In the next video, we'll set up our environment.