I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?

  • If the data is always at the same address, you could use a breakpoint at that address trough a debugger (Olly, Immunity, Cheat engine) and see what function accesses that part of the memory. If it has a dynamic address I'ld examine what's in that memory location, and try to figure out when/what put's it there. Start with setting a global breakpoint on memory related APIs. Mar 11 '15 at 20:53

If you are using a debugger like gdb, you could set a hardware breakpoint at the heap address. From the gdb manual:

hbreak args

Set a hardware-assisted breakpoint. ... These targets will generate traps when a program accesses some data or instruction address that is assigned to the debug registers.

After setting a hardware breakpoint, the debugger will trap when the memory is accessed for a read or a write.


If you are debugging PE executable (Windows), you can use the !heap -p options of WinDbg.

You can read about it here.

Note that you will have to enable it using gflags.exe - It's also mentioned in the document above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.