1

I was testing the malloctrace example shown on the official Intel PIN website: https://software.intel.com/sites/landingpage/pintool/docs/98484/Pin/html/index.html#FunctionArguments

I have a very simple testing binary file with the source code of:


int main()
{
    char *buf = malloc(sizeof(char)*50);
    //printf("Buf addr: %p\n", buf); // sanity check
    char *bar_buf = malloc(sizeof(char)*50);
    //printf("Bar_buf addr: %p\n", bar_buf); // sanity check
    free(buf);
    free(bar_buf);
}

Upon executing the above malloctrace example with this simple binary file, the output looks like this:

...
malloc(0x32) <- first malloc
malloc(0x32) <- second malloc
  returns 0x55cb2b4222e0
free(0x55cb2b4222a0) <- free of first malloc
free(0x55cb2b4222e0) <- free of second malloc

Interestingly enough, for whatever reason, the first malloc does not return the address it obtains from the malloc call, similar to what is shown for the second malloc.

What I am expecting is the return value for the first malloc is 0x55cb2b4222a0 as that is the input argument to the free(buf) for the test source code.

I have done some additional instrumentation and testing (such as checking all read/write to the memory location) to conclude that this is simply that Intel PIN cannot find the proper instrumentation point to insert the profiling code after the first malloc, but I was nevertheless wondering if anyone else had to face this issue, and potentially know the solution to solving this "missing instrumentation" problem.

Jay
  • 373
  • 1
  • 10
  • So your output is just missing any `returns` line after the first `malloc`? What compiler (and options) did you use to build the executable, on what OS? If Linux, I wonder if lazy dynamic linking is what makes the first call special? Try compiling with `gcc -O2 -fno-plt` to use early binding (and inline the indirect call via the GOT, instead of using a PLT). Not sure if that reasoning or workaround would also apply to MacOS. – Peter Cordes Dec 28 '22 at 22:36
  • Hello @PeterCordes, thank you for your reply. The compiler I'm using is `gcc version 9.4`, and I did not use any special options to compile the above example (`gcc scanf_ex.c -o scanf_ex`). I have tried compiling with the early binding method, as you suggested, but that did not work, and the Intel PIN wouldn't instrument properly to the program afterward. Regardless, thank you for your input. I am also wondering/investigating a bit finer granularity of what is happening with the first `malloc` call. – Jay Dec 29 '22 at 00:46

0 Answers0