I am searching for an way to randomize or define patterns for the allocated memory for C++ applications using G++ or Clang on Linux systems. (e.G. re implementing malloc)
The goal is to define allocated memory patterns which is otherwise undefined by the C++ Standard.
The background/aim of this question is not to search for memory issues for which also other solutions exist.
I found the solution I was looking for (here with 0xFF fixed initialization):
#include <stdio.h>
#include <dlfcn.h>
#include <malloc.h>
extern void abort();
void *malloc(size_t size) {
void * (*ptr)(int);
void * handle = (void*) -1;
ptr = (void *) dlsym(handle, "malloc");
if (ptr == NULL) {
printf("Opps\n");
abort();
}
void *alloc = (*ptr)(size);
size_t alloc_size = malloc_usable_size(alloc);
for(int i=0;i<alloc_size;++i){
*((__int8_t*)alloc+i) = 0xff;
}
return alloc;
}
void *realloc(void *alloc, size_t size) {
void * (*ptr)(void *, int);
void * handle = (void*) -1;
size_t old_size = malloc_usable_size(alloc);
ptr = (void *) dlsym(handle, "realloc");
if (ptr == NULL) {
printf("Opps\n");
abort();
}
alloc = (*ptr)(alloc, size);
size_t new_size = malloc_usable_size(alloc);
for(int i=old_size;i<new_size;++i){
*((__int8_t*)alloc+i) = 0xff;
}
return alloc;
}
to compile and execute it:
$ cat run.sh
#!/bin/bash
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$HOME/src/rand_alloc/ LD_PRELOAD=librand_alloc.so $*
$ cat Makefile
all:
gcc -Wall file.c -fPIC -shared -o librand_alloc.so -lc -ldl
Main inspiration from: https://www.stev.org/post/chowtooverridemallocfree
On some targets the code is causing issues, assuming due to non-zeroed memory
Don't assume. Profile. If reads from uninitialized memory are your problem you could install a signal handler for SIGSEGV, then when your program is at a state where you can start "probing" it use mprotect to mark all pages in the data segment as PROT_NONE and then inside the SIGSEGV handler re-add the PROT_READ and PROT_WRITE flags as required, taking notes which parts of your program did access which portion of the address space. But this will give you only coarse granularity and fail miserably for memory allocated from pools like malloc and new do.
Valgrind is exactly the tool for the job you have at hand.
Afaik Linux is "faking" malloc't memory which didn't belong to the process before to zero
On Linux ever since kernel version 2.6.33 memory allocated directly using mmap will always be initialized to zero. This is not so much a "fake" zero, rather than Linux will initially map to an all-zero page at first, so that reads come out as zero and upon the first write request a fresh page will be allocated, cleared to zero and replace the placeholder page map.
