Skip to main content

Return to Answer

added 1 character in body
Source Link
3CEZVQ
3CEZVQ
  • 43k
  • 11
  • 92
  • 100

It's not easy.

You can hook malloc, free, realloc globally in the application. Corresponding articles on Stackoverflow: How to use __malloc_hook?, An alternative for the deprecated __malloc_hook functionality of glibc.

In that hocks yourYou can retrieve a caller address from that hooks using __builtin_return_address and compare it with addresses of shared libraries. Maybe you have to examine a deeper frame address to get a proper address in a library, not an address of libc++. Read this Stackoverflow article __builtin_return_address returns null for index >0?.

It's not easy.

You can hook malloc, free, realloc globally in the application. Corresponding articles on Stackoverflow: How to use __malloc_hook?, An alternative for the deprecated __malloc_hook functionality of glibc.

In that hocks your can retrieve a caller address using __builtin_return_address and compare it with addresses of shared libraries. Maybe you have to examine a deeper frame address to get a proper address in a library, not an address of libc++. Read this Stackoverflow article __builtin_return_address returns null for index >0?.

It's not easy.

You can hook malloc, free, realloc globally in the application. Corresponding articles on Stackoverflow: How to use __malloc_hook?, An alternative for the deprecated __malloc_hook functionality of glibc.

You can retrieve a caller address from that hooks using __builtin_return_address and compare it with addresses of shared libraries. Maybe you have to examine a deeper frame address to get a proper address in a library, not an address of libc++. Read this Stackoverflow article __builtin_return_address returns null for index >0?.

Source Link
3CEZVQ
3CEZVQ
  • 43k
  • 11
  • 92
  • 100

It's not easy.

You can hook malloc, free, realloc globally in the application. Corresponding articles on Stackoverflow: How to use __malloc_hook?, An alternative for the deprecated __malloc_hook functionality of glibc.

In that hocks your can retrieve a caller address using __builtin_return_address and compare it with addresses of shared libraries. Maybe you have to examine a deeper frame address to get a proper address in a library, not an address of libc++. Read this Stackoverflow article __builtin_return_address returns null for index >0?.