Malloc Playground

Overview

The malloc playground is an interactive tool designed for learning and experimenting with heap memory allocation behavior. It provides a simple command-line interface to allocate, free, and inspect memory chunks in real-time.

This tool is perfect for understanding malloc behavior before attempting exploitation techniques.

Building and Running

Compile the program

gcc malloc_playground.c -o malloc_playground

Run the playground

./malloc_playground

The program will display its PID (process ID) for attaching debuggers like GDB.

Start experimenting

Use the available commands to allocate and free memory, then observe the behavior.

Available Commands

The playground supports multiple commands for interacting with heap memory:

Basic Commands

# Allocate n bytes and store the pointer
malloc 64
==> OK, 0x5555557592a0

# Free the most recent allocation, or specific index
free
==> ok

# Free pointer at index 2
free 2
==> ok

# Write a string to the most recent or specific allocation
write hello
==> ok, wrote hello

write world 0
==> ok, wrote world

List and Inspection Commands

# List all active pointers with their data
0 - 0x5555557592a0 - hello - 64
1 - 0x555555759300 - world - 32
==> ok

# List all pointer slots (including empty)
0 - 0x5555557592a0 - hello - 64
1 - 0x0 - (null) - 0
...
==> ok

# Free all allocations and reset
==> ok, array cleared

glibc-Specific Commands

These commands are only available when compiled with glibc on Linux systems.

# Display malloc statistics
Arena 0:
system bytes     = 135168
in use bytes     = 1024
Total (incl. mmap):
system bytes     = 135168
in use bytes     = 1024
max mmap regions = 0
max mmap bytes   = 0

# Display detailed malloc information in XML format
<malloc version="1">
  <heap nr="0">
    <sizes>
      ...
    </sizes>
  </heap>
</malloc>

# Enable heap consistency checking
==> OK

# Check integrity of specific allocation or all
mprobe
==> check_all ok

Source Code

Here’s the complete source code for the malloc playground:

Note: The write command has a potential buffer overflow vulnerability (no bounds checking). This is intentional for educational purposes.

malloc_playground.c

#include <inttypes.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#ifdef __GLIBC__
# include <malloc.h>
# include <mcheck.h>
void print_mcheck_status(enum mcheck_status s)
{
	fprintf(stderr, "%s\n", (s == MCHECK_DISABLED) ? "N/A, you didn't enable mcheck()" :
			   (s == MCHECK_OK) ? "No inconsistency detected" :
			   (s == MCHECK_HEAD) ? "Memory preceding an allocated block was clobbered" :
			   (s == MCHECK_TAIL) ? "Memory following an allocated block was clobbered" :
			   (s == MCHECK_FREE) ? "A block of memory was freed twice" :
			   "unknown memory check code!");
}
void report_mcheck_fail(enum mcheck_status s)
{
	fprintf(stderr, "*** PROGRAM WOULD ABORT: "); print_mcheck_status(s);
}
#endif

#define MAX_PTR_NUM 20;

char **ptrArray;

int main(int argc, char ** argv) {
	int num;
	int ptrNumber = -1;
	int maxPtr = MAX_PTR_NUM;
	int sizeArg;
	char sizeTable[maxPtr];

	char buffer[1000];
	char cmd[1000];
	char arg1[100];
	char arg2[100];

	memset(sizeTable, 0, maxPtr);
	memset(cmd, 0, 1000);
	memset(arg1, 0, 100);
	memset(arg2, 0, 100);

	fprintf(stderr, "pid: %d\n", getpid());
	ptrArray = malloc(sizeof(char*) * 20);
	for (int i = 0; i < maxPtr; i++){
		ptrArray[i] = 0;
	}
	while (1) {
		fprintf(stderr, "> ");
		fgets(buffer, sizeof(buffer), stdin);
		num = sscanf(buffer, "%s %s %s\n", cmd, arg1, arg2);
		if (strcmp(cmd, "malloc") == 0) {
			if (ptrNumber < maxPtr){
				sizeArg = atoi((const char *) &arg1);
				void *result = malloc(sizeArg);
				ptrNumber++;
				sizeTable[ptrNumber] = sizeArg;
				ptrArray[ptrNumber] = result;
				strcpy(result, "none");
				fprintf(stderr, "==> OK, %p\n", result);
			}
			else{
				printf("Max pointer reached, free or restart");
			}
		} else if (strcmp(cmd, "free") == 0) {
			if (ptrNumber > -1){
				if (num == 1){
					free((void*) ptrArray[ptrNumber]);
					ptrArray[ptrNumber] = 0;
					sizeTable[ptrNumber] = 0;
					fprintf(stderr, "==> ok\n");
					ptrNumber -= 1;
				}
				else if (num == 2){
					int tmpArg = atoi((const char *) &arg1);
					ptrArray[tmpArg] = 0;
					sizeTable[tmpArg] = 0;
					free((void *) ptrArray[tmpArg]);
					ptrNumber -= 1;
					fprintf(stderr, "==> ok\n");
				}
			}
			else{
				fprintf(stderr, "==> list empty :/\n");

			}
		} else if (strcmp(cmd, "write") == 0) {
			if (num == 1){
				printf("write: write value [pointer index]\n");
			}
			else if (num == 2){
				int len = strlen((const char *) &arg1);
				strcpy(ptrArray[ptrNumber], (const char *) &arg1);
				fprintf(stderr, "==> ok, wrote %s\n", ptrArray[ptrNumber]);
			}
			else if (num == 3){
				int len = strlen((const char *) &arg1);
				int tmpArg2 = atoi((const char *) &arg2);
				strcpy(ptrArray[tmpArg2], (const char *) &arg1);
				fprintf(stderr, "==> ok, wrote %s\n", ptrArray[tmpArg2]);
			}
		} else if (strcmp(cmd, "listp") == 0) {
			printf("\n");
			for (int i = 0; i < 20; i++){
				if (ptrArray[i]){
					printf("%d - %p - %s - %d\n", i, ptrArray[i], ptrArray[i], sizeTable[i]);
				}
			}
			fprintf(stderr, "==> ok\n");
		} else if (strcmp(cmd, "listpall") == 0) {
			int tmpIndex = 0;
			printf("\n");
			for (int i=0; i < maxPtr; i++){
				printf("%d - %p - %s - %d\n", tmpIndex, ptrArray[tmpIndex], ptrArray[tmpIndex], sizeTable[i]);
				tmpIndex++;
			}
			fprintf(stderr, "==> ok\n");
		} else if (strcmp(cmd, "clearlist") == 0) {
			ptrNumber = -1;
			for (int i = 0; i < maxPtr; i++){
				free(ptrArray[i]);
				ptrArray[i] = 0;
				memset(sizeTable, 0, maxPtr);
		}
			fprintf(stderr, "==> ok, array cleared\n");
#ifdef __GLIBC__
		} else if (strcmp(cmd, "usable") == 0) {
			fprintf(stderr, "usable size: %zu\n", malloc_usable_size((void*) arg1));
		} else if (strcmp(cmd, "stats") == 0) {
			malloc_stats();
		} else if (strcmp(cmd, "info") == 0) {
			malloc_info(0, stdout);
			printf("Ptrptr %d\n", ptrNumber);
		} else if (strcmp(cmd, "mcheck") == 0) {
			fprintf(stderr, "==> %s\n", mcheck(report_mcheck_fail) == 0 ? "OK" : "ERROR");
		} else if (strcmp(cmd, "mcheck_pedantic") == 0) {
			fprintf(stderr, "==> %s\n", mcheck_pedantic(report_mcheck_fail) == 0 ? "OK" : "ERROR");
		} else if (strcmp(cmd, "mprobe") == 0) {
			if (num > 1) {
				print_mcheck_status(mprobe((void*) arg1));
			} else {
				mcheck_check_all();
				fprintf(stderr, "==> check_all ok\n");
			}
#endif
		} else {
			puts("Commands: malloc n, free p, usable p, stats, info, mprobe [p], mcheck, mcheck_pedantic, ");
			puts("Commands: [BETA]  write str, listp, listpall, clearlist\n");
		}
	}
}

Example Session

Here’s a typical session demonstrating basic heap behavior:

Session 1: Basic allocation and reuse

pid: 12345
> malloc 64
==> OK, 0x555555759260
> malloc 32
==> OK, 0x5555557592a0
> malloc 64
==> OK, 0x5555557592e0
> listp

0 - 0x555555759260 - none - 64
1 - 0x5555557592a0 - none - 32
2 - 0x5555557592e0 - none - 64
==> ok
> free 1
==> ok
> malloc 32
==> OK, 0x5555557592a0  # Same address reused!

Notice how the freed chunk at index 1 is immediately reused when we allocate the same size again. This demonstrates first-fit allocation.

Use Cases

Learning

Understand how malloc reuses freed chunks and organizes memory

Experimentation

Test allocation patterns before implementing exploits

Debugging

Use with GDB to inspect heap state visually

Teaching

Demonstrate heap concepts in a controlled environment

Tips for Using the Playground

Attach a debugger: The program prints its PID so you can attach GDB:

gdb -p <PID>

Then use GDB commands like heap chunks (with gef/pwndbg) to visualize the heap.

Use mcheck early: Enable mcheck before making allocations to catch corruption:

> mcheck
==> OK
> malloc 64
...

Experiment with tcache: Allocate and free 7 chunks of the same size to fill a tcache bin, then observe what happens with the 8th chunk.

Get Started

Fundamentals

Fastbin Techniques

Tcache Techniques

House Techniques

Bin & Chunk Manipulation

Advanced Techniques

Glibc Versions

Tools & Resources

Malloc Playground

Overview

Building and Running

Available Commands

Basic Commands

List and Inspection Commands

glibc-Specific Commands

Source Code

Example Session

Use Cases

Learning

Experimentation

Debugging

Teaching

Tips for Using the Playground

Next Steps

First Fit

Heap Basics

​Overview

​Building and Running

​Available Commands

​Basic Commands

​List and Inspection Commands

​glibc-Specific Commands

​Source Code

​Example Session

​Use Cases

Learning

Experimentation

Debugging

Teaching

​Tips for Using the Playground

​Next Steps

First Fit

Heap Basics

Overview

Building and Running

Available Commands

Basic Commands

List and Inspection Commands

glibc-Specific Commands

Source Code

Example Session

Use Cases

Tips for Using the Playground

Next Steps