Heap inspection without libc debug symbols

The commands for heap inspection currently requires libc debug symbols. However, when the binary is modified with patchelf to use a specific interpreter like this file:

$ file target
target: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter ./ld-2.27.so, for GNU/Linux 3.2.0, BuildID[sha1]=b722ce3ea0937340d3a56165c760ac5ef9ae0014, not stripped

$ ldd target
	linux-vdso.so.1 (0x00007fff3b7b4000)
	./libc-2.27.so (0x00007f774a9c4000)
	./ld-2.27.so => /lib64/ld-linux-x86-64.so.2 (0x00007f774afbd000

Then, pwndbg is unable to use heap commands even though libc6-dbg and libc6-dbg:i386 are installed:

pwndbg> heap
heap: This command only works with libc debug symbols.
They can probably be installed via the package manager of your choice.
See also: https://sourceware.org/gdb/onlinedocs/gdb/Separate-Debug-Files.html

E.g. on Ubuntu/Debian you might need to do the following steps (for 64-bit and 32-bit binaries):
sudo apt-get install libc6-dbg
sudo dpkg --add-architecture i386
sudo apt-get install libc-dbg:i386

This is also mentioned in #924.

The solution I found is to use patchelf to change interpreter. However, when I try to use gef, I realized that it is able to run heap commands on this file without changing the interpreter:

GEF can simply work in all conditions without requiring debug symbols. I have investigated how they do this a little bit. Here is their heap_base function:

It looks like they are parsing the heap base address from the memory. I suggest implementing the same strategy.

This is also useful for systems like arch linux where there is no debug symbols package available and you have to build the package with debugging options yourself.

[disconnect3d]

Yes, this works now with set resolve-heap-via-heuristic on. There are still some improvements we can make to this, but it should generally work in more cases than in GEF afaik.

[gsingh93]

@disconnect3d @lebr0nli can this be closed now? Or is there more work to be done on using heap commands without debug symbols?