The malloc function allocates a chunk of memory in C programs for storing variables and complex data structures. malloc takes a single input: the size of the chunk to allocate in bytes. But what happens when you ask for zero bytes of memory? My partner Stephen and I assumed malloc(0) would simply fail. A video by Billy Ellis, an iOS security researcher, demonstrated that it is not the case. He explained that on macOS/iOS, malloc(0) creates a 16-byte allocation. If that is the case on Apple platforms, we wondered how other allocators and operating systems may react.
A CTF challenge called library had me dipping my toes in glibc heap memory exploitation. After giving the challenge my best attempt, I decided to review the provided python pwntools solution and reimplement it using the Golang-based brkit. Throughout this process, I tested out creating various visual aids to make it easier to reason about the Python code’s logic. Picturing how the heap layout evolved at each step of the exploit made a huge difference in my comprehension of the technique used. In this blog post, I want to share what I tried and what the experience taught me.
In 2020, I started speedrunning the game Mirror’s Edge and quickly felt connected and welcomed into its small, close-knit community. I accumulated many hours in the game over the years, dedicating time to improving my skills, participating in tournaments, and exploring ways to enhance the overall experience. With a growing interest in computer security, I applied my knowledge to enhance one of the community’s favorite modifications: the open-source Multiplayer Mod. I researched improving the mod’s security and usability by removing its need for a privileged program which abused Windows administrator privileges. I demonstrated these improvements in a proof of concept project that relies on a Windows hacking technique called phantom DLL hijacking.