{"id":4132,"date":"2016-06-21T15:56:50","date_gmt":"2016-06-21T07:56:50","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4132"},"modified":"2016-06-21T15:57:01","modified_gmt":"2016-06-21T07:57:01","slug":"shadow-firefox-heap-exploitation-tool-jemalloc","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/06\/shadow-firefox-heap-exploitation-tool-jemalloc\/","title":{"rendered":"shadow &#8211; Firefox Heap Exploitation Tool (jemalloc)"},"content":{"rendered":"<p>shadow is a new, extended (and renamed version) of a Firefox heap exploitation tool, which is quite a swiss army knife for Firefox\/jemalloc heap exploitation.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/06\/shadow-Firefox-Heap-Exploitation-Tool-jemalloc-640x392.png\" alt=\"shadow - Firefox Heap Exploitation Tool (jemalloc)\" width=\"640\" height=\"392\" class=\"aligncenter size-medium wp-image-4190\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/06\/shadow-Firefox-Heap-Exploitation-Tool-jemalloc-640x392.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/06\/shadow-Firefox-Heap-Exploitation-Tool-jemalloc-1024x627.png 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/06\/shadow-Firefox-Heap-Exploitation-Tool-jemalloc.png 1026w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>If you want to dive in really deep to this tool, and the technicalities behind it check this out &#8211; <a href=\"https:\/\/census-labs.com\/media\/the_shadow_over_firefox_infiltrate_2015.pdf\">OR&#8217;LYEH? The Shadow over Firefox<\/a> [PDF]<\/p>\n<h3>Support<\/h3>\n<p>shadow has been tested with the following:<\/p>\n<ul>\n<li>Windows 8.1 x86-64<\/li>\n<li>Windows 7 SP1 x86 and x86-64<\/li>\n<li>WinDBG 6.3.9600.17200 x86 (since Firefox stable is x86-only currently)<\/li>\n<li>pykd version 0.3.0.36<\/li>\n<li>Many different Firefox releases, but extensively with: 31.7.0-esr, 35.0.1, 36.0.1, 38.0.5, 39.0, 40.0, 43.0. 44.0.<\/li>\n<\/ul>\n<h3>Usage<\/h3>\n<p>When you issue a jemalloc-specific command for the first time, shadow parses all jemalloc metadata it knows about and saves them to a Python pickle file. Subsequent commands use this pickle file instead of parsing the metadata from memory again in order to be faster.<\/p>\n<p>When you know that the state of jemalloc metadata has changed (for example when you have made some allocations or have triggered a garbage collection), use the jeparse command to re-parse the<br \/>\nmetadata and re-create the pickle file.<\/p>\n<h3>Symbol Support<\/h3>\n<p>The symbol command allows you to search for SpiderMonkey and DOM classes (and structures) of specific sizes. This is useful when you&#8217;re trying to exploit use-after-free bugs, or when you want to position interesting victim objects to overwrite\/corrupt.<\/p>\n<p>In the &#8220;auxiliary&#8221; directory you can find a small PDB parsing utility named symhex. Run it on &#8220;xul.pdb&#8221; to generate the Python pickle file that shadow expects in the &#8220;pdb&#8221; directory (as &#8220;pdb\/xul-VERSION.pdb.pkl&#8221;). Before running symhex make sure you have registered &#8220;msdia90.dll&#8221;.<\/p>\n<p>You can download shadow here:<\/p>\n<p><a href=\"https:\/\/github.com\/CENSUS\/shadow\/archive\/master.zip\">shadow-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/CENSUS\/shadow\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>shadow is a new, extended (and renamed version) of a Firefox heap exploitation tool, which is quite a swiss army knife for Firefox\/jemalloc heap exploitation. If you want to dive in really deep to this tool, and the technicalities behind it check this out &#8211; OR&#8217;LYEH? The Shadow over Firefox [PDF] Support shadow has been [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"shadow is a new, extended (and renamed version) of a Firefox heap exploitation tool, which is quite a swiss army knife for Firefox\/jemalloc exploitation.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10,9,29],"tags":[556],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4132"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4132"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4132\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4132"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}