k4lizen

Adding mallocng support to pwndbg

Pwndbg has support for visualizing the allocator state of glibc malloc. This feature has evolved over the years and is currently in a really good place UX-wise, providing many useful ways to perform allocator inspection.

My GSoC 2025 project was about adding support for visualizing the state of the allocator that musl uses. In particular, the "new" allocator implementation: mallocng (released around 2020).

The journey

Glibc malloc is not the only allocator that Pwndbg supports. In userspace, jemalloc is supported (the implementation comes from a previous GSoC!) and in kernel space the linux SLUB allocator is supported. The current Pwndbg design essentially completely separates the allocator implementations. They track state separately, are invoked by separate commands, and controlled by separate configu

k4lizen

Improving Documentation

The documentation in pwndbg is currently lacking and there are multiple facets that could be improved. The README itself could be made shorter with sections being factored out to their own documents/pages accessable via the https://pwndbg.re/ website. Both the https://pwndbg.re/ landing page and https://pwndbg.re/pwndbg/ are generated from the README, using different workflows - they should be merged into one. There are also some bugs like markdown not being rendered properly in certain sections.

The commands page (generated from here) should be combed through so that any missing commands are added or outdated commands updated. Ideally the page should be reworked to show the same help that is shown in the debugger (defined in the command source code and thus always up-to-date) and additionally have longer explanations, common use-cases and examples (sometimes with pictures). Simple examp

k4lizen

#!/bin/bash
# Compress initramfs with the included statically linked exploit
in=$1
out=$(echo $in | awk '{ print substr( $0, 1, length($0)-2 ) }')
gcc $in -static -o $out || exit 255
mv $out initramfs
pushd . && pushd initramfs
find . -print0 | cpio --null --format=newc -o 2>/dev/null | gzip -9 > ../initramfs.cpio.gz
popd

k4lizen

#!/bin/bash
# Decompress a .cpio.gz packed file system
rm -rf ./initramfs
mkdir initramfs
cd initramfs
cp ../initramfs.cpio.gz .
gunzip ./initramfs.cpio.gz
cpio -idm < ./initramfs.cpio
rm initramfs.cpio
echo "Done"

k4lizen

# for exit funcs
def shift_right_carry(number: int, shift_amount: int) -> int:
  for i in range(shift_amount):
  if (number & 1) == 0:
    number = number >> 1
  else:
    number = (number >> 1) | 0x8000000000000000
  return number

def shift_left_carry(number: int, shift_amount: int) -> int:

k4lizen

from ctypes import CDLL

libc = CDLL("libc.so.6")
now = int(floor(time.time()))

libc.srand(now)

print(libc.rand())

k4lizen

# from https://hackmd.io/@pepsipu/SyqPbk94a
from pwn import *

def create_ucontext(
    src: int,
    rsp=0,
    rbx=0,
    rbp=0,
    r12=0,
    r13=0,

k4lizen

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
#  mayhem/datatypes/elf.py
#
#  Redistribution and use in source and binary forms, with or without
#  modification, are permitted provided that the following conditions are
#  met:
#
#  * Redistributions of source code must retain the above copyright

k4lizen

#!/bin/sh
# dependencies: docker and https://github.com/BurntSushi/ripgrep
libc_renamed=libc.so.6
ldlinux_renamed=ld-linux.so
if distro=$(rg -or '$1$2' -- '(?:--from=|FROM )(debian|ubuntu)(\S+)?' Dockerfile); then
    if container=$(docker container create "$distro"); then
        if libs=$(docker run "$distro" ldd /bin/true); then
            libs=$(printf %s "$libs" | awk 'NF == 4 {print $3}; NF == 2 {print $1}')
            for lib in $libs; do
                case $lib in

k4lizen

#!/usr/bin/env python
from pwn import *

HOST = "example.com"
PORT = 1337
using_aslr = False

exe = context.binary = ELF('./chal', checksec=False)
# libc = ELF('./libc.so.6', checksec=False)
# ld = ELF('./ld-linux-x86-64.so.2', checksec=False)