Windows Heap

win2000 Heap

• Third Generation Exploitation - Smashing the Heap under Win2k (ppt)
  • pdf
• 堆溢出学习笔记 (Win2K) (上) | 雪泥鴻爪

Lookaside List (LAL)

• 類似 tcache 不會合併

Freelist

Variable Size Allocation (VS)

Low Fragmentation Heap (LFH)

https://illmatics.com/Understanding_the_LFH.pdf

Segment Heap

us-16-Yason-Windows-10-Segment-Heap-Internals.pdf

Reference

• FFRI Monthly Research History and Current State of Heap Exploit
• Blackhat USA 2009 Practical Windows XP/2003 Heap Exploitation

---

Heap PWN Binary Exploitation Windows