MemBrush: A practical tool to detect custom memory allocators in C binaries

Many reversing techniques for data structures rely on the knowledge of memory allocation routines. Typically, they interpose on the system´s malloc and free functions, and track each chunk of memory thus allocated as a data structure. However, many performance-critical applications implement their own custom memory allocators. As a result, current binary analysis techniques for tracking data structures fail on such binaries. We present MemBrush, a new tool to detect memory allocation and deallocation functions in stripped binaries with high accuracy. We evaluated the technique on a large number of real world applications that use custom memory allocators.