rapid7/metasploit-framework — pull request #3055 by wchen-r7 (2014-03-03 18:17:49+00:00)
Title: Add HeapLib2

HeapLib2 is a heap-grooming library written in JavaScript. With this, you can create more predictable heap allocations in newer browsers such as Internet Explorer 10 and Internet Explorer 11, also free them. HeapLib2 is written by Chris Valasek. There is no formal licensing for the library except for:

"I’d love feedback, comments, suggestions, etc. If you use this library, feel free to buy me a beer if and when you see me." - http://blog.ioactive.com/2013/11/heaplib-20.html

Some confirmation about the license:
https://twitter.com/_sinn3r/status/438455571113451520

So we comply:
https://twitter.com/todb/status/438861639933108224

Ticket [SeeRM: #8769]
https://dev.metasploit.com/redmine/issues/8769

### Verification Steps###

- [ ] Make sure you have Internet explorer 10. Specifically, I tested it on IE+10/Win 7 SP1.
- [ ] Make sure you have WinDBG on your Windows box.
- [ ] Make sure you have symbols setup for WinDBG. An example of your symbol file path: ```C:\Windows\Symbols\; SRV*C:\Symbols_net*http://msdl.microsoft.com/download/symbols```
- [ ] Use the test example found in ```test/modules/auxiliary/test/heaplib2.rb```, and run it.
- [ ] Start Internet Explorer, and attach WinDBG to it. You will see two PIDs for IE, usually the second one is the one you want.
- [ ] Browse to the URL given by your test module
- [ ] When you see the "free is about to happen" alert, break (or press [CTRL]+[BREAK])
- [ ] Issue WinDBG command: ```dd mshtml!g_hProcessHeap L1```, which will give you IE's default process heap. It's probably something like: 00xxxxxx (x means unknown)
- [ ] Once you got hProcessheap, issue this WinDBG command to inspect the heaps: ```!heap -stat -h 001b0000``` (in this example: 0x001b0000 is my process heap)
- [ ] Make sure you see size 40010, that's allocated by the library.
- [ ] Issue this WinDBG command to dump all 0x040010 allocations: ```!heap -flt s 40010```
- [ ] You will see a ton of allocations. Mine looks like this (remember the first allocation because we'll use that for the next verification):

```
0:019> !heap -flt s 40010
_HEAP @ 1b0000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
06180060 8003 0000 [00] 06180068 40010 - (free)
```

- [ ] Issue this WinDBG command to make sure you see your data: ```db 06180068```. For example:

```
06180068 c4 00 1b 00 18 06 ee 07-41 41 41 41 41 41 41 41 ........AAAAAAAA
06180078 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
06180088 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
06180098 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
061800a8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
061800b8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
061800c8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
061800d8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
```

- [ ] Issue command ```g``` to cotinue.
- [ ] Press "OK" for the "free is about to happen" alert message
- [ ] At this point allocations should be freed. ```db``` the same address again, it should look like this:

```
0:018> db 06180068
06180068 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
06180078 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
06180088 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
06180098 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
061800a8 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
061800b8 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
061800c8 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
061800d8 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
```