2.42 support

[Kyle-Kyle]

angelheap cannot handle the new tcache design in 2.42. The issue is that tcache now has "small" tcache and "large" tcache, which means the layout is a bit different from the flat layout like before. so the mp_->tcache_bins is gone, which is something angelheap uses to determine whether tcache is enabled or not: https://github.com/scwuaptx/Pwngdb/blob/master/angelheap/angelheap.py#L554

Leading to angelheap thinking tcache is not enabled.

[Kyle-Kyle]

also, now tcache->num_slots counts downwards: https://elixir.bootlin.com/glibc/glibc-2.42/source/malloc/malloc.c#L3397
As in, they are initialized to 7 and counts down to 0

[Kyle-Kyle]

My hack to force it to work on 2.42. I hope it helps.

diff --git a/angelheap/angelheap.py b/angelheap/angelheap.py
index 1d78417..4b9a123 100644
--- a/angelheap/angelheap.py
+++ b/angelheap/angelheap.py
@@ -551,7 +551,7 @@ def get_tcache():
     if capsize == 0 :
         arch = getarch()
     try :
-        tcache_max_bin = int(gdb.execute("x/" + word + " &mp_.tcache_bins",to_string=True).split(":")[1].strip(),16)
+        tcache_max_bin = int(gdb.execute("x/" + word + " &mp_.tcache_small_bins",to_string=True).split(":")[1].strip(),16)
         try :
             tcache_enable = True
             tcache = int(gdb.execute("x/" + word + "&tcache",to_string=True).split(":")[1].strip(),16)
@@ -596,7 +596,7 @@ def get_tcache_count() :
         cmd = "x/" + word + hex(tcache + i*capsize)
         c = int(gdb.execute(cmd,to_string=True).split(":")[1].strip(),16)
         for j in range(int(capsize / tcache_counts_size)):
-            tcache_count.append((c >> j * 8*tcache_counts_size) & 0xff)
+            tcache_count.append((7-(c >> j * 8*tcache_counts_size)) & 0xff)
 
 
     
@@ -612,7 +612,7 @@ def get_tcache_entry():
     if capsize == 0 :
         arch = getarch()
     if tcache and tcache_max_bin :
-        entry_start = tcache + tcache_max_bin * tcache_counts_size
+        entry_start = tcache + (tcache_max_bin+3*8//2) * tcache_counts_size
         for i in range(tcache_max_bin):
             tcache_entry.append([])
             chunk = {}

[Kyle-Kyle]

I guess the best way to resolve the address of tcache_perthread_struct->tcache_entry is to do a symbol lookup.

[Kyle-Kyle]

also, now tcache_perthread_struct may not be at the top of the heap, angelheap does not handle this case well even with my changes.