(self, index, arena_addr=None)
return (chain_fd, chain_bk, is_chain_corrupted)
Modeled after glibc's bin_at function - so starts indexing from 1
        https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/trusty/eglibc/trusty-security/view/head:/malloc/malloc.c#L1394

        bin_at(1) returns the unsorted bin

        Bin 1          - Unsorted BiN
        Bin 2 to 63    - Smallbins
        Bin 64 to 126  - Largebins

        Returns: tuple(chain_from_bin_fd, chain_from_bin_bk, is_chain_corrupted) or None
Modeled after glibc's bin_at function - so starts indexing from 1
        https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/trusty/eglibc/trusty-security/view/head:/malloc/malloc.c#L1394
Modeled after glibc s bin_at function - so starts indexing from 1 https : // bazaar . launchpad . net / ~ubuntu - branches / ubuntu / trusty / eglibc / trusty - security / view / head : / malloc / malloc . c#L1394
def bin_at(self, index, arena_addr=None):
        """
        Modeled after glibc's bin_at function - so starts indexing from 1
        https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/trusty/eglibc/trusty-security/view/head:/malloc/malloc.c#L1394

        bin_at(1) returns the unsorted bin

        Bin 1          - Unsorted BiN
        Bin 2 to 63    - Smallbins
        Bin 64 to 126  - Largebins

        Returns: tuple(chain_from_bin_fd, chain_from_bin_bk, is_chain_corrupted) or None
        """
        index = index - 1
        arena = self.get_arena(arena_addr)

        if arena is None:
            return

        normal_bins = arena['bins']
        num_bins    = normal_bins.type.sizeof // normal_bins.type.target().sizeof

        bins_base    = int(normal_bins.address) - (pwndbg.arch.ptrsize* 2)
        current_base = bins_base + (index * pwndbg.arch.ptrsize * 2)

        front, back = normal_bins[index * 2], normal_bins[index * 2 + 1]
        fd_offset   = self.chunk_key_offset('fd')
        bk_offset   = self.chunk_key_offset('bk')

        is_chain_corrupted = False

        get_chain = lambda bin, offset: pwndbg.chain.get(int(bin), offset=offset, hard_stop=current_base, limit=heap_chain_limit, include_start=True)
        chain_fd = get_chain(front, fd_offset)
        chain_bk = get_chain(back, bk_offset)

        # check if bin[index] points to itself (is empty)
        if len(chain_fd) == len(chain_bk) == 2 and chain_fd[0] == chain_bk[0]:
            chain_fd = [0]
            chain_bk = [0]

        # check if corrupted
        elif chain_fd[:-1] != chain_bk[:-2][::-1] + [chain_bk[-2]]:
            is_chain_corrupted = True

        return (chain_fd, chain_bk, is_chain_corrupted)
def bin_at ( self , index , arena_addr = None ) : index = index - 1 arena = self . get_arena ( arena_addr ) if arena is None : return normal_bins = arena [ 'bins' ] num_bins = normal_bins . type . sizeof // normal_bins . type . target ( ) . sizeof bins_base = int ( normal_bins . address ) - ( pwndbg . arch . ptrsize * 2 ) current_base = bins_base + ( index * pwndbg . arch . ptrsize * 2 ) front , back = normal_bins [ index * 2 ] , normal_bins [ index * 2 + 1 ] fd_offset = self . chunk_key_offset ( 'fd' ) bk_offset = self . chunk_key_offset ( 'bk' ) is_chain_corrupted = False get_chain = lambda bin , offset : pwndbg . chain . get ( int ( bin ) , offset = offset , hard_stop = current_base , limit = heap_chain_limit , include_start = True ) chain_fd = get_chain ( front , fd_offset ) chain_bk = get_chain ( back , bk_offset ) # check if bin[index] points to itself (is empty) if len ( chain_fd ) == len ( chain_bk ) == 2 and chain_fd [ 0 ] == chain_bk [ 0 ] : chain_fd = [ 0 ] chain_bk = [ 0 ] # check if corrupted elif chain_fd [ : - 1 ] != chain_bk [ : - 2 ] [ : : - 1 ] + [ chain_bk [ - 2 ] ] : is_chain_corrupted = True return ( chain_fd , chain_bk , is_chain_corrupted )