[lldb-dev] How to tell if an address belongs to the heap?

[Vangelis Tsiatsianas via lldb-dev]

Thank you for your thorough and timely response, Pavel! 🙂

Your suggestions might actually cover completely what I am attempting to achieve. 

Unfortunately, I am not able to disclose the exact reason I need it, but I want to track all heap writes, in order to detect modifications in the heap and save both the old and the newly written value.

For now, this translates to tracking common x86 assembly instructions (mov{l, w, d, q}) for a single thread ―supporting more “exotic” instructions like SIMD, multiple architectures or threads is not currently a goal.

Another method could also be an LLVM instrumentation pass, however I would like to avoid recompiling and modifying the binary, thus I focus on LLDB, even if I end up missing a few writes that way.

I was initially looking for a more complete, cross-platform solution (see: http://lists.llvm.org/pipermail/llvm-dev/2019-November/136876.html <http://lists.llvm.org/pipermail/llvm-dev/2019-November/136876.html>), but the solution proved to be too time consuming for the timeframe I have available for my master’s (ending in March).


― Vangelis


> On 7 Feb 2020, at 01:20, Pavel Labath <labath at google.com> wrote:
> 
> In general, getting this kind of information is pretty hard, so lldb does not offer you an out-of-the-box solution for it, but it does give you tools which you can use to approximate that.
> 
> If I wanted to do something like this, the first thing I'd try to do is run "image lookup -a 0xaddr". If this doesn't return anything then the address does not correspond to any known module. This rules out code, global variables, and similar. Then you can run through all of the threads and do a "memory region $SP", which will give you bounds of the memory allocation around the stack pointer. If your address is in one of these ranges, then it's a stack address. Otherwise, it's probably heap (though you can never be 100% sure of that).
> 
> However, it's not fully clear to me what it is that you're trying to do here. Maybe if you explain the higher level problem that you're trying to solve, we can come up with a better solution.
> 
> pl
> 
> On Thu, 6 Feb 2020 at 07:40, Vangelis Tsiatsianas via lldb-dev <lldb-dev at lists.llvm.org <mailto:lldb-dev at lists.llvm.org>> wrote:
> Hi everyone,
> 
> I am looking for a way to tell whether a memory address belongs to the heap or not.
> 
> In other words, I would like to make sure that the address does not reside within any stack frame (even if the stack of the thread has been allocated in the heap) and that it’s not a global variable or instruction.
> 
> Checking whether it is a valid or correctly allocated address or a memory-mapped file or register is not a goal, so accessing it in order to decide, at the risk of causing a segmentation fault, is an accepted solution.
> 
> I have been thinking of manually checking the address against the boundaries of each active stack frame, the start and end of the instruction segment and the locations of all global variables.
> 
> However, I would like to ask where there are better ways to approach this problem in LLDB.
> 
> Thank you very much, advance! 🙂
> 
> 
> ― Vangelis
> 
> _______________________________________________
> lldb-dev mailing list
> lldb-dev at lists.llvm.org <mailto:lldb-dev at lists.llvm.org>
> https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev <https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-dev>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/lldb-dev/attachments/20200207/6e5973a1/attachment.html>