Research / Article

heapLib 2.0

Explore heapLib2: a JavaScript library for predictable memory allocations in Internet Explorer. Learn how to use it effectively.

Chris Valasek·Nov 15, 2013·2 min read
chris valasekhackheap hackingheap manipulationinfosec
  • heapLib2.js => The JavaScript library that needs to be imported to use heapLib2
  • heapLib2_test.html => Example usage of some of the functionality that is available in heapLib2
  • html_spray.py => A Python script to generate static HTML pages that could potentially be used to heap spray (i.e. heap spray w/o JavaScript)
  • html_spray.html => An example of a file created with html_spray.py
  • get_elements.py => An IDA Python script that will retrieve information about each DOM element with regards to memory allocation in Internet Explorer. Use this Python script when reversing mshtml.dll. Yes, this is really bad. I’m no good at IDAPython. Make sure to check the ‘start_addr’ and ‘end_addr’ variables in the .py file. If you are having trouble finding the right address do a text search in IDA for “<APPLET>” and follow the cross reference. You should see similar data structure listings for HTML tags. The ‘start_addr’ should be the address above the reference to the string “A” (anchor tag).
  • demangler.py => Certainly the worst C++ name demangler you’ll ever see.

Want the research before the news cycle?

Get in touch