I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?
If you are using a debugger like gdb, you could set a hardware breakpoint at the heap address. From the gdb manual:
Set a hardware-assisted breakpoint. ... These targets will generate traps when a program accesses some data or instruction address that is assigned to the debug registers.
After setting a hardware breakpoint, the debugger will trap when the memory is accessed for a read or a write.
If you are debugging
PE executable (Windows), you can use the
!heap -p options of
You can read about it here.
Note that you will have to enable it using
gflags.exe - It's also mentioned in the document above.