iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
iOS Kernel Heap Armageddon - Hakim
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
kern_os_malloc()<br />
• kern_os_malloc() is very similar to _MALLOC()<br />
• it also adds the blocksize as additional heap meta data<br />
• it also refuses to allocate 0 byte sizes<br />
• new and new[] simply wrap around it<br />
• special case: new[0] will allocate 1 byte<br />
size + 4<br />
⎧<br />
⎪<br />
⎪<br />
⎪<br />
⎨<br />
⎪<br />
⎪<br />
⎪<br />
⎩<br />
size<br />
data<br />
Stefan Esser • <strong>iOS</strong> <strong>Kernel</strong> <strong>Heap</strong> <strong>Armageddon</strong> REVISITED • July 2012 •<br />
28