When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer.
How can I know if this buffer allocate in stack/ heap?
0
Add a comment
|
2 Answers
If it's address is above or equal to the stack pointer (esp/rsp), it's on the stack
otherwise, it's on the heap or was on a previous stack-frame (and now is out of scope and should not be used)
If you want to know but just looking at the address: if the address starts with 0x7f, it's on the stack.
That might not always be right though, a program can control the value of the stack pointer and can decide to change it (not likely but feasible)
If you want to find out statically, you have to inspect the call site to your function and see where the buffer argument comes from.
You may have to go back multiple layers until you either clearly see it's on the stack (if the address of a local memory area is passed in), or it comes from a call like VirtualAlloc, malloc, new, HeapAlloc (VirtualAlloc and HeapAlloc being Windows-specific APIs), in which case the memory is located on the heap.
-
Heapalloc calls VirtualAlloc if allocation request size is greater than a threshold level (iirc requests >512 KB) and heapAlloc doesn't require a system call as it allocates within a preallocated heap area virtualalloc transitions from umode to kmode for allocation and it allocation is of page level granularity so a virtual alloced memory isnt traceable in !heap algos– blabbCommented Mar 22, 2019 at 10:41