INSTRUMENTING SOFTWARE FOR ENHANCED DIAGNOSABILITY

• US 20070174826A1
• Filed: 04/02/2007
• Published: 07/26/2007
• Est. Priority Date: 05/09/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guarraci, Brian
• Granted Patent: US 8,141,052 B2
• Time in Patent Office: Days
• US Class Current: 717/140
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

Systems and methods are provided for instrumenting compiled software to include diagnostic information such that an origin of a call to one or more routines may be more easily identified. For example, a system is provided which unassembles or uncompiles software into a more readily identifiable instructional form, which is then searched to identify various calls to various routines of interest. Portions of the identified calls are then modified with diagnostic information that will identify the call. This diagnostic information and the call are then recorded so that the call may be subsequently traced back to its origin when, for example, an error occurs.

Claims

1. In a computer system comprising an operating system and compiled software that calls one or more routines, a method of providing a more robust system with enhanced error diagnosis capabilities by instrumenting the compiled software to include diagnostic information so that when a routine writes data beyond a memory allocation an origin of a call to the routines may be more easily and uniquely identified, the method comprising acts of:

unassembling the compiled software into a plurality of instructions;

searching the unassembled software for one or more instructions that identify at least one call to a routine of interest, wherein the at least one call comprises a parameter portion and a routine portion;

modifying at least one of the parameter portion or the routine portion of the at least one call with diagnostic information including a unique tag identifier that uniquely identifies the at least one call to the routine of interest when the at least one call requests allocation of memory; and

recording the diagnostic information and the at least one call so that the at least one call may subsequently be identified from within the routine of interest if the routine writes data beyond any allocated memory.

2. The method of claim 1, wherein the act of modifying replaces the at least one call with a new call to a new routine, and wherein the new routine calls the at least one call.

3. The method of claim 1, wherein the act of unassembling the compiled software into a plurality of instructions is performed at the time of loading the compiled software by the operating system.

4. The method of claim 2, wherein the acts of modifying and recording are performed at the time of loading the compiled software by the operating system.

5. The method of claim 1, wherein the act of unassembling the compiled software is performed prior to the time of loading the compiled software by the operating system.

6. The method of claim 5, wherein the acts of modifying and recording are performed prior to the time of loading the compiled software by the operating system.

7. The method of claim 5, further comprising the act of:

retrieving information about the one or more instructions that identify the at least one call to a routine of interest, wherein the act of modifying is performed at the time of loading the compiled software by the operating system.

8-18. -18. (canceled)

19. In a computer system comprising an operating system and compiled software that calls one or more routines, a method of providing a more robust system with enhanced error diagnosis capabilities by instrumenting the compiled software to include diagnostic information so that when a routine writes data beyond a memory allocation an origin of a call to the one or more routines may be more easily identified, the method comprising steps for:

producing a plurality of software instructions from the compiled software;

identifying, from the plurality of instructions produced from the compiled software, at least one original call to a routine of interest;

distinguishing the at least one original call to the routine of interest from any other call to the routine of interest by providing at least a portion of the at least one original call with diagnostic information including a unique tag identifier that the at least one distinguished call uses when requesting allocation of memory; and

mapping the at least one distinguished call that includes the unique tag identifier to the at least one original call so that a location of the at least one original call may be subsequently identified from within the routine of interest if the routine writes data beyond any allocated memory based on the original call having been distinguished from any other call to the routine of interest.

20. The method recited in claim 19, wherein the at least one original call comprises a parameter portion and a routine portion.

21. The method recited in claim 20, wherein the step for distinguishing the at least one original call comprises an act of modifying the parameter portion of the at least one original call, the routine portion of the at least one original call, or both, with the diagnostic information that uniquely identifies the at least one call to the routine of interest.

22. The method of claim 21, wherein the act of modifying replaces the original call with a new call to a new routine, and wherein the new routine calls the original call.

23. The method recited in claim 19, wherein the steps for producing, identifying and distinguishing are performed at run-time when loading the compiled software.

24. The method recited in claim 19, wherein the steps for producing, identifying and distinguishing are performed offline without loading the compiled software to preserve a digital signature of the compiled software.

25-34. -34. (canceled)

35. In a computer system comprising an operating system and compiled software that calls one or more routines, a computer program product comprising one or more computer readable storage media used to implement a method of providing a more robust system with enhanced error diagnosis capabilities by instrumenting the compiled software to include diagnostic information so that when a routine writes data beyond a memory allocation an origin of a call to the routines may be more easily and uniquely identified, the computer program product comprising one or more computer-readable media having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:

unassemble the compiled software into a plurality of instructions;

search the unassembled software for one or more instructions that identify at least one call to a routine of interest, wherein the at least one call comprises a parameter portion and a routine portion;

modify at least one of the parameter portion or the routine portion of the at least one call with diagnostic information including a unique tag identifier that uniquely identifies the at least one call to the routine of interest when the at least one call requests allocation of memory; and

record the diagnostic information and the at least one call so that the at least one call may subsequently be identified from within the routine of interest if the routine writes data beyond any allocated memory.

41. The computer program product of claim 35, wherein the compiled software comprises an application.

42. The computer program product of claim 35, wherein the compiled software comprises a device driver.

45. The computer program product of claim 35, further comprising an act of storing the diagnostic information and the at least one call for subsequent retrieval.

46. The computer program product of claim 35, wherein the at least one call is identified by having satisfied a predefined threshold of matching criteria.

47. The computer program product of claim 46, wherein the matching criteria comprises at least one of a pattern for the at least one call, a predefined modeling of the at least one call, or a portion of a load table for the one or more routines.

36-40. -40. (canceled)

43-44. -44. (canceled)

48-59. -59. (canceled)