House of Spirit and allocator version matrix

Mechanism

House of Spirit introduces a fabricated chunk into an allocator free list so a later allocation can return controlled nonheap storage. It needs control over the pointer passed to free and enough nearby bytes to satisfy size, alignment, and integrity checks. The technique describes a family of allocator paths; the tcache and fastbin variants have different requirements.

Practical method

Choose the exact glibc version and matching how2heap file. Calculate internal chunk size from the requested size and word size. Establish alignment and the metadata inspected by the selected free path. Observe the cache occupancy before freeing the fake pointer, then inspect the next allocation result.

variant                    key condition
fastbin-oriented           sane fake size and next-size metadata
tcache-oriented            applicable cache size/count and checks
glibc_2.36 how2heap file    fills tcache before fastbin-oriented free

Interpreting evidence

The intended proof is equality between the later returned allocation and the prepared fake region. That result grants placement of an allocation, not automatically arbitrary code execution; the application must subsequently write useful data there.

Pitfalls and limits

Do not conflate the pedagogical stack region with a universal target. malloc and calloc can traverse different allocator paths. Safe-linking and integrity checks vary with version and selected bin.

Selected licensed upstream examples

Shared x86-64 fake-chunk size fields from both demonstrations. The first size selects a 0x40 internal chunk; the following size passes the relevant neighboring-chunk sanity check in the illustrated fastbin path. These numbers describe the selected examples, not a universal allocator configuration.

fake_chunks[1] = 0x40; // this is the size
fake_chunks[9] = 0x1234; // nextsize

Attribution: Shellphish how2heap; MIT. Selected lines, explanatory notes added. Pinned upstream file · Pinned upstream file.

The glibc 2.23 example predates tcache. Its later malloc(0x30) follows the demonstrated fastbin reuse path. The pointer supplied to free points to the fabricated user-data area, after the prepared header. This excerpt is incomplete and intentionally not an executable exploit.

a = &fake_chunks[2];
free(a);

Attribution: Shellphish how2heap; MIT. Selected lines, explanatory notes added. Pinned upstream file.

The glibc 2.36 example first fills tcache with seven matching frees, then demonstrates fastbin-oriented placement using calloc. This allocation route differs from simply calling malloc once: the upstream example notes that malloc needs eight calls in its prepared state. Preserve the route and cache occupancy when comparing versions.

void *victim = &fake_chunks[2];
free(victim);
void *allocated = calloc(1, 0x30);

Attribution: Shellphish how2heap; MIT. Selected lines, explanatory notes added. Pinned upstream file.