I'm working on some LLVM instrumentation and I would like to identify load and store instructions that write to heap memory.
Right now I am able to identify calls to malloc etc. and I can tell when heap memory is being allocated. Is there anything in LLVM IR that distinguishes between loads/stores to stack vs heap? My assumption is that there isn't.
The approach I was thinking of using was to keep track of the memory addresses returned by malloc at runtime, and then instrument calls to getelementptr where at runtime I see if the base address is one that has been allocated by malloc. I would also instrument any loads/stores that use the pointer returned by a getelementptr where the instrumentation code would only run if the address is a heap address.
The question I have is how can I identify such loads/stores? Does LLVM construct a data-dependency graph or something of that nature that I can query to identify these instructions? Basically I want to identify all loads/stores that use the pointer returned by a particular getelementptr instruction.
Of course, if there is a much easier way to do this please let me know. I'm quite new at this.