Intercept malloc and free with LD_PRELOAD

Topic Overview

LD_PRELOAD Function Interception

LD_PRELOAD is a Linux mechanism that loads a specified shared library before all others, allowing you to intercept and wrap dynamic library functions without modifying the original program.

How It Works

Set the environment variable before running a program:

cCopy
Loading…

Your interceptor defines a function with the same signature as the target (for example malloc), calls the real version via dlsym(RTLD_NEXT, "malloc"), and adds custom logging or counting.

Common use cases:

• Memory tracking: intercept malloc/free to detect leaks
• File system virtualization: intercept open/read/write
• Testing: simulate allocation failures

For This Exercise

You will document how LD_PRELOAD can intercept malloc and free calls to add logging. This technique is widely used in debugging, testing, and security research to observe program behavior without source code access.

Building an Interceptor

Compile your interceptor as a shared library with -shared -fPIC and link -ldl. Export a malloc wrapper that logs the size and caller address, then forwards to the real malloc via dlsym. This pattern appears in debugging tools like Valgrind's interceptors and in security research to monitor API usage without recompiling the target. The interceptor must be thread-safe if the target uses pthreads.

Write a C program that simulates an LD_PRELOAD malloc/free interceptor with leak accounting.

Requirements:

• Parse n operations: "a SIZE" (malloc) or "f ID" (free allocation #ID, 1-based)
• malloc: round the size up to a multiple of 16, assign the address 0x1000 plus the sum of all previously rounded sizes, print "[INTERCEPT] malloc(SIZE) = 0xADDR", and track it as live
• free of a live allocation: mark dead, print "[INTERCEPT] free(0xADDR)"; free of an already-freed or out-of-range id prints "[INTERCEPT] free(0xADDR) -> invalid" (0x0 when the id was never allocated) and counts as a double free
• Summarize with exactly five lines: "total mallocs: M", "total frees: F" (successful frees only), "peak live bytes: P" (sum of rounded sizes of live allocations at any point), "leaked: L bytes in K allocations" (live at exit), "double frees: D"