Memory Corruption Diagnosis via Pattern Expression Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for diagnosing memory corruption in computing systems are inefficient, often imposing performance overhead, requiring manual analysis by skilled programmers, and may miss data section corruption due to limited monitoring capabilities.
Innovation Solution
A method that generates pattern expression (PE) headers for common datatypes, stores them in tables, and uses a dump utility to match corrupted data against these tables to autonomously identify the source of memory corruption, providing comprehensive coverage of both header and data sections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of memory corruption is performed by skilled programmers, then diagnosis accuracy can be achieved, but time consumption and operational complexity increase significantly
Solution Approach 1:
The system performs automatic memory corruption diagnosis through self-service mechanisms. The memory monitoring module autonomously detects corruption events, captures core dumps, and the analysis module automatically processes these dumps to identify corruption sources. This eliminates the need for manual programmer intervention while maintaining high diagnosis accuracy, thereby resolving the contradiction between diagnosis precision and time consumption.
Solution Approach 2:
The patent introduces an intermediary analysis module that acts as a mediator between the memory corruption event and the programmer. This module includes a core dump processing unit and a corruption source identification unit that automatically analyze memory dumps and identify the root cause of corruption. This intermediary system handles the complex analysis work that would otherwise require skilled programmers, reducing both time consumption and operational complexity while maintaining diagnosis accuracy.
2Difficulty of detecting and measuring
If comprehensive memory monitoring is implemented to cover both header and data sections, then detection capability improves, but system complexity and resource overhead increase
Solution Approach 1:
The memory monitoring system is segmented into distinct functional modules: a memory monitoring module that divides memory into header and data sections for separate monitoring, a core dump generation module, and an analysis module. This segmentation allows comprehensive coverage of both memory sections while managing system complexity through modular design, where each module has a specific, manageable function.
Solution Approach 2:
The analysis module serves as an intermediary that processes the raw data from comprehensive memory monitoring without requiring the entire monitoring system to be overly complex. It selectively processes core dumps only when corruption is detected, using pattern matching techniques to identify corruption sources efficiently. This intermediary approach enables comprehensive detection capability while keeping resource overhead manageable by processing only relevant data.
3Measurement precision
If pattern expression tables are generated and stored for all common datatypes, then diagnosis accuracy improves, but memory usage and processing overhead increase
Solution Approach 1:
The system implements local quality by creating pattern expression tables specific to each common datatype (e.g., integers, floats, strings, structures). Each datatype has its own optimized pattern matching rules stored in separate tables. This allows the system to achieve high diagnosis accuracy by using datatype-specific patterns while managing memory usage efficiently, as only the necessary patterns for each datatype are stored rather than a single large universal table.
Data Source
AI summary
According to one embodiment, a method, computer system, and computer program product for memory corruption diagnosis is provided. The present invention may include generating a pattern expression (PE) header file, wherein a plurality of common datatypes associated with a software program are pre-defined. The invention may further include generating a PE for each of the plurality of common datatypes, and generating a PE table by merging the generated PEs for each of the plurality of common datatypes. Upon discovery that memory corruption has occurred, the invention may include transmitting a recorded state of the software program as a core dump file to a server, and using a dump utility to identify overlay content of the core dump file. Lastly, the invention may include identifying a possible source program of the memory corruption by matching the PE tables against the illegally-written overlay content.


