I have picked two examples of usafe of the memtool interactive CLI. The example programs are taken from tests - look there for source code.
Annotations begin with "#"
Commands available in interactive mode:
? help
Available operations:
attach - [PID] attempts to attach to a process.
run - "[path to executable]" runs a new process, waits 5 seconds and attaches to it.
detach - Detached from attached process.
status - [-m|-u|-l|-a] Prints current session to stdout. Use -m for map, -u for unloaded symbols and -l for loaded symbols, -a for glibc malloc analysis result.
thread - [decimal TID/PID] Prints analysis status for TID/PID.
map - Parse /proc/pid/maps file.
symbol - Requires maps. Loads all symbols for all object files in memory.
help - Shows available commands on stdout.
exit - Stops the execution
lookup - [-e] "[text]" searches symbols matching text. Use -e if you want only exact matches.
peek - [typename] [hexa pointer] Peeks ans bind a memory to any of following types: ["malloc_state", "malloc_chunk", "_heap_info", "tcbhead_t", "dtv_pointer", "link_map", "r_debug", "link_map_private"]
addr - [hexa pointer] Prints all entities that contain given address with offsets.
analyze - Attempts to enumerate heap chubnks
chunk - [hexa pointer] Attempts to load address as chunk and dumps it
tcb - Locates and prints Thread Control Block for traced thread
word - [decimal count] [hex pointer] [-a] Dumps given amount of 64bit words; Use [-a] if you want the result in ASCII (`count` will load be 8*count bit instad of 64*count bit). (Note: data are not adjusted for Big Endian.)
tbss - "symbol name" "file name" Attempts to locate tbss symbol in a file
errnoGot - "glibc file name" Attempts to parse `errno` location from disassembly in order to verify results of other heuristics.
reveal - [hexa pointer] Applies macro `REVEAL_PTR`
Source code: MainHeapTests.testMallocFastbinFrees()
mikolas@MIKI-U-NTBK:~/Developer/ptrace/memtool$ .build/debug/memtool # Notice, that since we are going to inspect a child process, we don't need `sudo`.
? run "/tmp/execMainHeapTeststestMallocFastbinFrees" # Run a binary and wait for 5 seconds
? status # look at the status, the number on the first line is the PID of the traced process
=== Session [17383]
Map:
[not loaded]
Unloaded Symbols:
[not loaded]
Symbols:
[not loaded]
Threads:
===
? map # Load LAP map of the traced process
? symbol # Load symbols for executables of the traced process
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/libc.so.6 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/libc.so.6 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: MemtoolCore is not validated for Glibc version used by this program! # Notice, that the MemtoolCore is not validated for my version. This may lead to issues. Always open a Github Issue with the Glibc version for validation.
? analyze # Runs Glibc analyzer
? status -a # Prints result of analysis
Region(range: 0x000055e4a3a16000 ..< 0x000055e4a3a16290, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.mainHeap])) # This is the location of the main heap
Region(range: 0x000055e4a3a16290 ..< 0x000055e4a3a162e0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)])) # Chunks with rebound .heapTCache are freed
Region(range: 0x000055e4a3a162e0 ..< 0x000055e4a3a16330, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)]))
Region(range: 0x000055e4a3a16330 ..< 0x000055e4a3a16380, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)]))
Region(range: 0x000055e4a3a16380 ..< 0x000055e4a3a163d0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)]))
Region(range: 0x000055e4a3a163d0 ..< 0x000055e4a3a16420, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)]))
Region(range: 0x000055e4a3a16420 ..< 0x000055e4a3a16470, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)]))
Region(range: 0x000055e4a3a16470 ..< 0x000055e4a3a164c0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapTCache), explored: true, origin: [GlibcMallocStateOrigin.mainHeap, GlibcMallocStateOrigin.tlsTCacge(pthreadId: 17383)]))
Region(range: 0x000055e4a3a164c0 ..< 0x000055e4a3a16510, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapFastBin), explored: true, origin: [GlibcMallocStateOrigin.mainHeap]))
Region(range: 0x000055e4a3a16510 ..< 0x000055e4a3a16560, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapFastBin), explored: true, origin: [GlibcMallocStateOrigin.mainHeap])) # Chunks with rebound .heapFastBin are also freed
Region(range: 0x000055e4a3a16560 ..< 0x000055e4a3a165b0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.mainHeap])) # This chunk is active
? chunk 0x000055e4a3a16560 # We can look at the data inside of the active chunk
=== Chunk [0x000055e4a3a16570] # Notice, that the address is at + 0x10. This is because the user space of the chunk starts there. The header starts at + 0x0
Header:
malloc_chunk(mchunk_prev_size: 4918848066104279617, mchunk_size: 81, fd: Optional(0x4443424144434241), bk: Optional(0x4443424144434241), fd_nextsize: Optional(0x4443424144434241), bk_nextsize: Optional(0x4443424144434241)) # Since the chunk is active, some fields of the header are not valid. For example, pointer fd valua 0x4443424144434241 is obviously invalid.
Payload:
0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44
===
Content as ascii: # For convenience, the content is also printed as ASCII
ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
? chunk 0x000055e4a3a16290 # We can also look at a free chunk. This freed chunk is in tcache.
=== Chunk [0x000055e4a3a162a0]
Header:
malloc_chunk(mchunk_prev_size: 0, mchunk_size: 81, fd: Optional(0x000000055e4a3a16), bk: Optional(0x39cb738a2cb733d2), fd_nextsize: Optional(0x4443424144434241), bk_nextsize: Optional(0x4443424144434241)) # Notice, that some of the data inside the header are valid and some aren't. For example, fd is now a valid (albeit obfuscated) pointer. But bk is still invalid value.
Payload:
0x16 0x3a 0x4a 0x5e 0x05 0x00 0x00 0x00 0xd2 0x33 0xb7 0x2c 0x8a 0x73 0xcb 0x39 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44
===
Content as ascii:
\u{16}:J^\u{05}\0\0\0\u{00D2}3\u{00B7},\u{008A}s\u{00CB}9ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
? Source code: ThreadedHeapsTests.testMallocBinFrees()
? detach # We can kill the previous program and run a new one
? run "/tmp/execThreadedHeapsTeststestMallocBinFrees"
? status
=== Session [22401]
Map:
[not loaded]
Unloaded Symbols:
[not loaded]
Symbols:
[not loaded]
Threads: # Notice, that unlike previous tests, there are other threads
22402 22403 22404
===
? map
? symbol
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/libc.so.6 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: Symbol for file /usr/lib/x86_64-linux-gnu/libc.so.6 failed to match regex: 0000000000000000 l df *ABS* 0000000000000000
Warning: MemtoolCore is not validated for Glibc version used by this program!
? analyze # We perform all the operations needed for analysis
? thread 22402 # Using `status -a` would print A LOT of information, we can print analysis result just for a one thread, for example the thread 22402. Notice, that PID (22401) is a valid value for this operation
View for PID/TID [22402]:
Region(range: 0x00007fc484000030 ..< 0x00007fc4840008c8, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocState, explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484000000 ..< 0x00007fc484000030, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.heapInfo, explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)])) # Notice, that on thread heaps, there are some more book-keeping structures
Region(range: 0x00007fc4840008d0 ..< 0x00007fc484000b60, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484000b60 ..< 0x00007fc4840014b0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapBin), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc4840014b0 ..< 0x00007fc484001e00, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484001e00 ..< 0x00007fc484002750, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapBin), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484002750 ..< 0x00007fc4840030a0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc4840030a0 ..< 0x00007fc4840039f0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapBin), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc4840039f0 ..< 0x00007fc484004340, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484004340 ..< 0x00007fc484004c90, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapBin), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484004c90 ..< 0x00007fc4840055e0, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc4840055e0 ..< 0x00007fc484005f30, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapBin), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
Region(range: 0x00007fc484005f30 ..< 0x00007fc484006880, properties: GlibcMallocInfo(rebound: GlibcMallocAssumedRebound.mallocChunk(GlibcMallocChunkState.heapActive), explored: true, origin: [GlibcMallocStateOrigin.threadHeap(base: 140482004910128)]))
? peek _heap_info 0x00007fc484000000 # We can inspect the book-keeping chunk via `peek` operation
BoundRemoteMemory<_heap_info>(segment: Range(140482004910080..<140482004910128), buffer: __C._heap_info(ar_ptr: Optional(0x00007fc484000030), prev: nil, size: 135168, mprotect_size: 135168, pagesize: 4096, pad: (0, 0, 0, 0, 0, 0, 0, 0)))
? chunk 0x00007fc484004340 # And print one of the freed chunks. Notice, that all header fields are valid for chunk which is on .heapBin
=== Chunk [0x00007fc484004350]
Header:
malloc_chunk(mchunk_prev_size: 0, mchunk_size: 2385, fd: Optional(0x00007fc4840030a0), bk: Optional(0x00007fc4840055e0), fd_nextsize: nil, bk_nextsize: nil)
Payload:
0xa0 0x30 0x00 0x84 0xc4 0x7f 0x00 0x00 0xe0 0x55 0x00 0x84 0xc4 0x7f 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x41 0x42 0x43 0x44 0x50 0x09 0x00 0x00 0x00 0x00 0x00 0x00
===
Content as ascii:
\u{00A0}0\0\u{0084}\u{00C4}\u{7F}\0\0\u{00E0}U\0\u{0084}\u{00C4}\u{7F}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDP\t\0\0\0\0\0\0
? Notice, that you can find even more arenas and chunks by using status -a than if you use view for all available TIDs and the PID. Some threads might have already been disposed, but the data those threads allocated might be still alive.