Shadow Memory Encoding for Runtime Memory Safety Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing memory safety analysis tools are limited in their ability to detect memory violations, particularly when a program accesses memory through a pointer that does not point to the correct memory block, due to insufficient metadata capturing the bounds and length of allocated memory blocks.

Innovation Solution

A shadow memory encoding scheme that tracks the boundaries and lengths of allocated memory blocks by using primary and secondary shadow memory regions, where each byte in the application memory is mapped to corresponding bytes in the shadow memory, allowing for the encoding of memory block lengths, offsets, and initialization status.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing memory safety analysis tools use simple shadow memory without block boundary tracking, then the device complexity is reduced, but the ability to detect memory violations through pointers is insufficient

Engineering Contradiction:
Improvememory safety detection accuracyVSAvoidshadow memory structure complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The shadow memory is segmented into multiple regions: a first shadow memory region for tracking allocated blocks with boundaries and lengths, and a second shadow memory region for tracking uninitialized blocks. This segmentation allows the system to maintain comprehensive metadata for accurate memory safety detection while organizing complex information in a structured manner that improves manageability and processing efficiency.

Inventive Principle:
Principle #1Segmentation

2Measurement precision

If the shadow memory encodes detailed block metadata (length, offset, boundaries), then the measurement precision of memory access legality is improved, but the use of energy increases

Engineering Contradiction:
Improvememory access legality determinationVSAvoidruntime analysis energy consumption
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system changes the encoding parameters of shadow memory based on block characteristics. For allocated blocks, it stores length and boundary information; for uninitialized blocks, it uses a separate tracking mechanism. This parameter adaptation allows precise memory access validation while minimizing redundant data storage and processing, thereby reducing energy consumption during runtime analysis.

Inventive Principle:
Principle #35Parameter changes

3Reliability

If the system tracks all memory blocks with full metadata, then the reliability of detecting improper pointer access is improved, but the productivity of runtime analysis is reduced

Engineering Contradiction:
Improveimproper access detectionVSAvoidruntime analysis speed
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary classification of memory blocks into allocated and uninitialized categories during allocation time, storing essential metadata (boundaries, lengths) in the first shadow memory region. This preliminary action enables fast runtime validation without requiring complex analysis during actual memory access checks, thus maintaining high reliability while improving productivity.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3333714B1A computer-implemented method and a system for encoding a stack application memory state using shadow memory
Publication Date: 2020.02.12 COMMISSARIAT A LENERGIE ATOMIQUE ET AUX ENERGIES ALTERNATIVES
  • EP3333714B1 patent drawingFigure 1
  • EP3333714B1 patent drawingFigure 2~3
  • EP3333714B1 patent drawingFigure 4

AI summary

The invention proposes a method that allows tracking boundaries of allocated memory blocks while still capturing byte-level properties. This is achieved with a particular shadow memory encoding scheme which captures boundaries and lengths of allocated memory blocks. Analyzing the shadow memory state allows detecting memory safety issues. In particular, for a memory location given by its address a, the proposed invention allows computing the following information: whether a has been allocated, whether a has been initialized, the start (base) address of the memory block a belongs to, the byte-length of the memory block a belongs to, the byte offset of a within its block. Such information allows for detection of specific memory safety issues at runtime.