  Heap exploitation techniques to abuse the metadata of allocators have been
widely studied since they are application independent and can be used in
restricted environments that corrupt only metadata. Although prior work has
found several interesting exploitation techniques, they are ad-hoc and manual,
which cannot effectively handle changes or a variety of allocators.
  In this paper, we present a new naming scheme for heap exploitation
techniques that systematically organizes them to discover the unexplored space
in finding the techniques and ArcHeap, the tool that finds heap exploitation
techniques automatically and systematically regardless of their underlying
implementations. For that, ArcHeap generates a set of heap actions (e.g.
allocation or deallocation) by leveraging fuzzing, which exploits common
designs of modern heap allocators. Then, ArcHeap checks whether the actions
result in impact of exploitations such as arbitrary write or overlapped chunks
that efficiently determine if the actions can be converted into the
exploitation technique. Finally, from these actions, ArcHeap generates
Proof-of-Concept code automatically for an exploitation technique.
  We evaluated ArcHeap with real-world allocators --- ptmalloc, jemalloc, and
tcmalloc --- and custom allocators from the DARPA Cyber Grand Challenge.
ArcHeap successfully found 14 out of 16 known exploitation techniques and found
five new exploitation techniques in ptmalloc. Moreover, ArcHeap found several
exploitation techniques for jemalloc, tcmalloc, and even for the custom
allocators. Further, ArcHeap can automatically show changes in exploitation
techniques along with version change in ptmalloc using differential testing.
