Instrumenting software for enhanced diagnosability

• US 8,141,052 B2
• Filed: 04/02/2007
• Issued: 03/20/2012
• Est. Priority Date: 05/09/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guarraci, Brian J.
• Primary Examiner(s): MITCHELL, JASON D
• Application Number:
  US11/695,391
• Publication Number:
  US 20070174826A1
• Time in Patent Office: 1,814 Days
• Field of Search: None
• US Class Current: 717/127
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

Systems and methods are provided for instrumenting compiled software to include diagnostic information such that an origin of a call to one or more routines may be more easily identified. For example, a system is provided which unassembles or uncompiles software into a more readily identifiable instructional form, which is then searched to identify various calls to various routines of interest. Portions of the identified calls are then modified with diagnostic information that will identify the call. This diagnostic information and the call are then recorded so that the call may be subsequently traced back to its origin when, for example, an error occurs.

Claims

1. In a computer system comprising an operating system and compiled software that calls one or more routines, a method of providing a more robust system with enhanced error diagnosis capabilities by instrumenting the compiled software to include diagnostic information so that when a routine writes data beyond a memory allocation an origin of a call to the routines may be more easily and uniquely identified, the method comprising acts of:

unassembling the compiled software into a plurality of instructions;

searching the unassembled software for one or more instructions that identify at least one original call to a routine of interest, wherein the at least one original call comprises a parameter portion which identifies a pool tag and a routine portion which requests a tagged allocation of memory using the pool tag;

modifying the at least one original call to arrive at a modified call which requests a tagged allocation of memory using a unique tag identifier, wherein the act of modifying includes substituting the parameter portion of the original call with a new parameter portion which identifies the unique tag identifier instead of the pool tag, such that the unique tag identifier uniquely identifies the at least one original call as the call that requested a tagged allocation of memory with the unique tag identifier;

recording diagnostic information and the at least one original call so that the at least one original call may subsequently be identified in the compiled software by the unique tag identifier, wherein the diagnostic information identifies modifications made to the at least one original call to arrive at the modified call, including the substitution of the parameter portion of the original call with the new parameter portion which identifies the unique tag identifier instead of the pool tag, wherein the diagnostic information includes a mapping between the unique tag identifier and the pool tag, as well as an association of the unique tag identifier with an offset in the compiled code where the modification was made;

executing the compiled software, including the modified call, resulting in a request for a tagged allocation of memory using the unique tag identifier;

identifying a memory error with respect to a tagged memory location corresponding to the unique tag identifier; and

using the recorded diagnostic information to identify the at least one original call based on the unique tag identifier.

2. The method of claim 1, wherein the act of modifying also includes substituting the routine portion with a new routine portion that makes a tagged allocation of memory using the unique tag identifier instead of the pool tag.

3. The method of claim 2, wherein the acts of modifying and recording are performed at the time of loading the compiled software by the operating system.

4. The method of claim 1, wherein the act of unassembling the compiled software into a plurality of instructions is performed at the time of loading the compiled software by the operating system.

5. The method of claim 1, wherein the act of unassembling the compiled software is performed prior to the time of loading the compiled software by the operating system.

6. The method of claim 5, wherein the acts of modifying and recording are performed prior to the time of loading the compiled software by the operating system.

7. The method of claim 6, wherein the compiled software is signed with a digital signature, and wherein the act of modifying comprises recording the diagnostic information in a separate location without modifying the compiled code, the method further comprising:

loading the compiled software;

retrieving the recorded diagnostic information from the separate location; and

applying the recorded diagnostic information to the loaded compiled software subsequent to loading the compiled software.

8. The method of claim 5, further comprising the act of:

retrieving information about the one or more instructions that identify the at least one original call to a routine of interest, wherein the act of modifying is performed at the time of loading the compiled software by the operating system.

9. The method of claim 1, wherein the pool tag is the same as an identifier used for at least one other tagged allocation of memory, and such that the pool tag is shared by at least two different method calls.

10. The method of claim 9, wherein the at least one other tagged allocation of memory originates from the compiled software.

11. The method of claim 9, wherein the at least one other tagged allocation of memory originates separately from the compiled software.

12. The method of claim 1, wherein the diagnostic information includes one or more of a name of the compiled software or a version of the compiled software.

13. One or more computer storage devices having stored thereon computer-executable instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method, comprising:

a computing system unassembling the compiled software into a plurality of instructions, wherein the computing system comprises one or more processors;

the computing system searching the unassembled software for one or more instructions that identify at least one original call to a routine of interest, wherein the at least one original call comprises a parameter portion which identifies a pool tag and a routine portion which requests a tagged allocation of memory using the pool tag;

the computing system modifying the at least one original call to arrive at a modified call which requests a tagged allocation of memory using a unique tag identifier, wherein the act of modifying includes substituting the parameter portion of the original call with a new parameter portion which identifies the unique tag identifier instead of the pool tag, such that the unique tag identifier uniquely identifies the at least one original call as the call that requested a tagged allocation of memory with the unique identifier;

the computing system recording diagnostic information and the at least one original call so that the at least one original call may subsequently be identified in the compiled software by the unique tag identifier, wherein the diagnostic information identifies modifications made to the at least one original call to arrive at the modified call, including the substitution of the parameter portion of the original call with the new parameter portion which identifies the unique tag identifier instead of the pool tag, wherein the diagnostic information includes a mapping between the unique tag identifier and the pool tag, as well as an association of the unique tag identifier with an offset in the compiled code where the modification was made;

executing the compiled software, including the modified call, resulting in a request for a tagged allocation of memory using the unique tag identifier;

identifying a memory error with respect to a tagged memory location corresponding to the unique tag identifier; and

using the recorded diagnostic information to identify the at least one original call based on the unique tag identifier.

14. The one or more storage devices of claim 13, wherein the compiled software comprises an application.

15. The one or more storage devices of claim 13, wherein the compiled software comprises a device driver.

16. The one or more storage devices of claim 13, further comprising an act of storing the diagnostic information and the at least one original call for subsequent retrieval.

17. The one or more storage devices of claim 13, wherein the at least one original call is identified by having satisfied a predefined threshold of matching criteria.

18. The one or more storage devices of claim 17, wherein the matching criteria comprises at least one of a pattern for the at least one original call, a predefined modeling of the at least one original call, or a portion of a load table for the one or more routines.

19. A computer system comprising a processor operatively coupled to a memory and one or more computer storage devices having stored there on computer-executable instructions that, when executed by the processor, cause the computer system to perform a method, comprising:

a processor unassembling the compiled software into a plurality of instructions;

the processor searching the unassembled software for one or more instructions that identify at least one original call to a routine of interest, wherein the at least one original call comprises a parameter portion which identifies a pool tag and a routine portion which requests a tagged allocation of memory using the pool tag;

the processor modifying at least-one of the at least one original call to arrive at a modified call which requests a tagged allocation of memory using a unique tag identifier, wherein the act of modifying includes substituting the parameter portion of the original call with a new parameter portion which identifies the unique tag identifier instead of the pool tag, such that the unique tag identifier uniquely identifies the at least one original call as the call that requested a tagged allocation of memory with the unique identifier;

the processor recording diagnostic information and the at least one original call so that the at least one original call may subsequently be identified in the compiled software by the unique tag identifier, wherein the diagnostic information identifies modifications made to the at least one original call to arrive at the modified call, including the substitution of the parameter portion of the original call with the new parameter portion which identifies the unique tag identifier instead of the pool tag, wherein the diagnostic information includes a mapping between the unique tag identifier and the pool tag, as well as an association of the unique tag identifier with an offset in the compiled code where the modification was made;

executing the compiled software, including the modified call, resulting in a request for a tagged allocation of memory using the unique tag identifier;

identifying a memory error with respect to a tagged memory location corresponding to the unique tag identifier; and

using the recorded diagnostic information to identify the at least one original call based on the unique tag identifier.