4 tools for any MCP-compatible LLM agent:
heap_start — launch binary with instrumentation
heap_send — send data, get structured heap state
heap_check — force corruption validation
heap_observe — get current state
Works with Claude Code, SWE-agent, EnIGMA, or any MCP client.
Returns structured JSON with addresses, bins, risk score, corruptions.
Risk scoring in heaptrm tool: pre-corruption exploit prediction
20 challenges, 10 trials each, same process for observe+exploit.
Easy (full leak): 100% vs 100% (no advantage).
Medium (partial/no leak): 83% vs 40% (+43%).
Hard (no leak, noise): 67% vs 0% (+67%).
heaptrm provides decisive advantage when binary lacks address leaks.
Benchmark results: observe-once fails (stale addresses across processes)
Correct architecture is observe+act in same session via heaptrm JSON protocol.
LLM benchmark scaffolding ready for API-backed runs.
Key finding: observation must happen in same process as exploitation.
20-challenge suite benchmark: heaptrm 65% vs blind 25% overall
- HEAPTRM_QUARANTINE=0 (default): faithful allocator behavior for exploit dev
- HEAPTRM_QUARANTINE=1: defensive mode with UAF canary detection
- tcache_poison primitive only reported when actual corruption detected
(safe-linking makes normal fd look external)
Add exploit demo: step-by-step tcache poison through heaptrm tool
- Automatic hex address extraction from binary output (for leak detection)
- Process exit detection (exited field in response)
- Removed unused changes field, added addresses field
- Unified response construction via make_response()
- check: sends SIGUSR1 to force heap validation, detects corruption from
writes that don't trigger malloc/free (UAF, overflow via memcpy)
- recv: captures binary stdout (address leaks, menu output)
- send: now includes captured output in response
- Harness registers SIGUSR1 handler for on-demand validation
heaptrm CLI: compiled Rust binary for LLM-assisted heap exploitation
749KB binary. JSON protocol on stdin/stdout:
- send: pipe data to target binary, get heap observation
- observe: get current heap state with chunks, bins, primitives
- quit: clean exit
Includes primitive detection (tcache_poison, double_free, corruption),
auto-finds/compiles v2 harness, manages target process lifecycle.
Add HeapObserver: structured heap state for LLM exploit generation
Rich observations with chunk adjacency, freelist contents, corruption
events, reachable exploit primitives, and natural-language summaries.
Designed as the feedback signal for LLM-in-the-loop exploitation.
CVE benchmark: 4/5 real CVE patterns detected, 0 false positives
Tested against CVE-2021-3156, CVE-2021-4034, CVE-2023-6246, CVE-2024-2961,
CVE-2023-4911 vulnerability patterns. Off-by-one null byte (Baron Samedit)
is the one miss — lands in chunk padding on glibc 2.39.
HeapTRM fuzzer: mutation-based fuzzing guided by heap corruption detection
Standalone fuzzer using v2 harness as oracle. Found all 3 vuln types
(overflow, UAF, double-free) in 21s from simple seeds. 96 exec/s,
1985 corruption-triggering inputs generated.
Tuned verdict logic: F1=1.0 on CVE patterns, zero false positives
V2 harness now delays free() and fills with canary (0xFD). Detects
UAF writes by checking canary integrity on every subsequent operation.
Closes the UAF gap (test 3). Also adds goal.md with roadmap.
