1

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer.

How can I know if this buffer allocate in stack/ heap?

0

If it's address is above or equal to the stack pointer (esp/rsp), it's on the stack
otherwise, it's on the heap or was on a previous stack-frame (and now is out of scope and should not be used)

If you want to know but just looking at the address: if the address starts with 0x7f, it's on the stack.
That might not always be right though, a program can control the value of the stack pointer and can decide to change it (not likely but feasible)

  • thank you ,but I talking about static analyze – Keystone Jan 19 at 19:58
0

If you want to find out statically, you have to inspect the call site to your function and see where the buffer argument comes from.

You may have to go back multiple layers until you either clearly see it's on the stack (if the address of a local memory area is passed in), or it comes from a call like VirtualAlloc, malloc, new, HeapAlloc (VirtualAlloc and HeapAlloc being Windows-specific APIs), in which case the memory is located on the heap.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.