Kernel Mode Driver Memory Tracking via Advanced Pool Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Legacy tools lack a reliable mechanism for determining memory usage and detecting memory leaks in kernel mode drivers, especially in server systems where drivers are not frequently unloaded.

Innovation Solution

An advanced pool tracking (APT) tool that traces memory allocation and freeing requests in kernel mode, records relevant parameters, and reports allocation history over time, allowing for real-time monitoring and snapshot analysis to detect potential memory leaks without requiring driver unloading.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If legacy tools are used to determine memory usage, then memory usage can be determined when driver is unloaded, but the mechanism is unreliable for server systems where drivers are not frequently unloaded

Engineering Contradiction:

Improvememory usage determination reliabilityVSAvoidapplicability to server systems

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary actions by tracing and recording memory allocation requests as they occur during driver execution, rather than waiting until the driver is unloaded. This allows memory usage data to be collected and analyzed while the driver is still active, making the tool reliable for server systems where drivers remain loaded continuously.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If driver unloading is required to determine memory usage, then legacy tools can provide memory usage data, but continuous monitoring during execution is not possible

Engineering Contradiction:

Improvememory usage measurementVSAvoiddriver execution continuity

Core Design Contradiction:

Measurement precisionVSDuration of action of moving object

Solution Approach 1:

The system enables continuous monitoring of memory allocation by tracing requests as they occur during driver execution. The allocation history is recorded continuously over time, allowing precise measurement of memory usage patterns without interrupting or requiring driver unloading, thus maintaining continuous driver operation.

Inventive Principle:

Principle #20Continuity of useful action

3Reliability

If memory allocation requests are traced during driver execution, then continuous monitoring and leak detection are enabled, but additional tracking overhead is introduced

Engineering Contradiction:

Improvememory leak detection accuracyVSAvoidtracking mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system introduces an intermediary tracing mechanism that intercepts memory allocation requests between the driver and the memory manager. This intermediary layer records allocation parameters (such as allocation size, address, and timestamp) without requiring complex modifications to the driver itself, enabling reliable leak detection while managing complexity through a dedicated tracking component.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12067421B2Advanced memory tracking for kernel mode drivers

Publication Date: 2024.08.20 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Described are examples for tracking memory usage of a driver. A memory allocation request related to the driver to allocate a portion of memory for the driver can be traced in a kernel mode of an operating system. One or more associated allocation parameters can be recorded, and an allocation history of the driver over a period of time can be reported during execution of the driver and based on the one or more allocation parameters indicated by the memory allocation request.