Using heuristics for field types of a structure to categorize dynamic memory allocations

• US 8,719,539 B2
• Filed: 06/30/2011
• Issued: 05/06/2014
• Est. Priority Date: 06/30/2011
• Status: Expired due to Fees

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Malcolm, David Hugh
• Primary Examiner(s): Bradley, Matthew
• Assistant Examiner(s): BERNARD, DANIEL J
• Application Number:
  US13/174,651
• Publication Number:
  US 20130007404A1
• Time in Patent Office: 1,041 Days
• Field of Search: None
• US Class Current: 711/170
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

A programming and debugging system determines a block of dynamically allocated memory in an inferior process memory space corresponds to a structure and casts the block of memory as an instance of the structure. The programming and debugging system determines a field type of a field in the instance of the structure and determines whether memory data pertaining to the block of dynamically allocated memory satisfies one or more criteria in heuristics data associated with the field type. The programming and debugging system categorizes the block of dynamically allocated memory based on the determination of whether the memory data satisfies the one or more criteria of the field type.

Claims

1. A method comprising:

determining, by a processing device, that a block of dynamically allocated memory in an inferior process memory space corresponds to a structure;

casting the block of memory as an instance of the structure;

determining a field type of a field in the instance of the structure;

determining heuristics data that corresponds to the field type;

determining whether memory data pertaining to the block of dynamically allocated memory satisfies one or more criteria in the heuristics data that corresponds to the field type; and

categorizing the block of dynamically allocated memory based on the determination of whether the memory data satisfies the one or more criteria of the field type.

2. The method of claim 1, wherein determining that the block of dynamically allocated memory corresponds to a structure comprises:

determining that a size of the block of dynamically allocated memory corresponds to a structure based on heuristics data comprising one or more criteria for categorizing the dynamically allocated area of memory.

3. The method of claim 1, wherein determining that the block of dynamically allocated memory corresponds to a structure comprises:

determining that a size of a first location of an area of dynamically allocated memory fails to correspond to a structure;

identifying at least a second location of an area of dynamically allocated memory, the at least second location being offset a number of bytes from the first location; and

determining whether a size of the at least second location corresponds to a structure.

4. The method of claim 1, wherein determining the field type of a field in the instance of the structure comprises:

fetching bytes of data from the block of dynamically allocated memory of an inferior process;

interpreting the bytes as a pointer value;

determining whether the pointer value points to a region within a memory map of the inferior process; and

assigning a pointer type to the field based on a determination that the pointer value points to a region within a memory map of the inferior process and assigning a field type of unknown to the field based on a determination that the pointer value fails to point to a region within the memory map.

5. The method of claim 4, further comprising:

detecting an all zeros value in the field; and

assigning a NULL value to the field.

6. The method of claim 4, further comprising:

determining a base value;

determining whether the pointer value is a multiple of the base value; and

assigning a field type of unknown to the field based on a determination that the pointer value is not a multiple of the base value.

7. The method of claim 4, further comprising:

determining whether the pointer value points to an appropriate region type; and

assigning a field type of unknown to the field based on a determination that the pointer value fails to point to an appropriate region type.

8. The method of claim 1, wherein determining the field type of a field in the instance of the structure comprises:

reading bytes of data from the block of dynamically allocated memory of an inferior process;

interpreting the bytes as a candidate integer type;

determining whether a value of the interpreted bytes is within a set of integers that corresponds to values associated with the candidate integer type; and

assigning the integer type to the field based on a determination that the value is within the set of integers and assigning a field type of unknown to the field based on a determination that the value fails to represent an integer within the set of integers.

9. A system comprising:

a memory; and

a processing device coupled to the memory to

determine that a block of dynamically allocated memory in an inferior process memory space corresponds to a structure;

cast the block of memory as an instance of the structure;

determine a field type of a field in the instance of the structure;

determine heuristics data that corresponds to the field type;

determine whether memory data pertaining to the block of dynamically allocated memory satisfies one or more criteria in the heuristics data that corresponds to the field type; and

categorize the block of dynamically allocated memory based on the determination of whether the memory data satisfies the one or more criteria of the field type.

10. The system of claim 9, wherein the processing device is to determine that the block of dynamically allocated memory corresponds to a structure by:

determining that a size of the block of dynamically allocated memory corresponds to a structure based on heuristics data comprising one or more criteria for categorizing the dynamically allocated area of memory.

11. The system of claim 9, wherein the processing device is to determine that the block of dynamically allocated memory corresponds to a structure by:

determining that a size of a first location of an area of dynamically allocated memory fails to correspond to a structure;

identifying at least a second location of an area of dynamically allocated memory, the at least second location being offset a number of bytes from the first location; and

determining whether a size of the at least second location corresponds to a structure.

12. The system of claim 9, wherein the processing device is to determine the field type of a field in the instance of the structure by:

fetching bytes of data from the block of dynamically allocated memory of an inferior process;

interpreting the bytes as a pointer value;

determining whether the pointer value points to a region within a memory map of the inferior process; and

assigning a pointer type to the field based on a determination that the pointer value points to a region within a memory map of the inferior process and assigning a field type of unknown to the field based on a determination that the pointer value fails to point to a region within the memory map.

13. The system of claim 12, wherein the processing device is further to:

determine a base value;

determine whether the pointer value is a multiple of the base value; and

assign a field type of unknown to the field based on a determination that the pointer value is not a multiple of the base value.

14. The system of claim 9, wherein the processing device is to determine the field type of a field in the instance of the structure by:

reading bytes of data from the block of dynamically allocated memory of an inferior process;

interpreting the bytes as a candidate integer type;

determining whether a value of the interpreted bytes is within a set of integers that corresponds to values associated with the candidate integer type; and

assigning the integer type to the field based on a determination that the value is within the set of integers and assign a field type of unknown to the field based on a determination that the value fails to represent an integer within the set of integers.

15. A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a set of operations comprising:

determining that a block of dynamically allocated memory in an inferior process memory space corresponds to a structure;

casting the block of memory as an instance of the structure;

determining a field type of a field in the instance of the structure;

determining, by the processing device, heuristics data that corresponds to the field type;

determining whether memory data pertaining to the block of dynamically allocated memory satisfies one or more criteria in the heuristics data that corresponds to the field type; and

categorizing the block of dynamically allocated memory based on the determination of whether the memory data satisfies the one or more criteria of the field type.

16. The non-transitory computer-readable storage medium of claim 15, wherein determining that the block of dynamically allocated memory corresponds to a structure comprises:

determining that a size of the block of dynamically allocated memory corresponds to a structure based on heuristics data comprising one or more criteria for categorizing the dynamically allocated area of memory.

17. The non-transitory computer-readable storage medium of claim 15, wherein determining that the block of dynamically allocated memory corresponds to a structure comprises:

determining that a size of a first location of an area of dynamically allocated memory fails to correspond to a structure;

identifying at least a second location of an area of dynamically allocated memory, the at least second location being offset a number of bytes from the first location; and

determining whether a size of the at least second location corresponds to a structure.

18. The non-transitory computer-readable storage medium of claim 15, wherein determining the field type of a field in the instance of the structure comprises:

fetching bytes of data from the block of dynamically allocated memory of an inferior process;

interpreting the bytes as a pointer value;

determining whether the pointer value points to a region within a memory map of the inferior process; and

assigning a pointer type to the field based on a determination that the pointer value points to a region within a memory map of the inferior process and assigning a field type of unknown to the field based on a determination that the pointer value fails to point to a region within the memory map.

19. The non-transitory computer-readable storage medium of claim 18, further comprising:

determining a base value;

determining whether the pointer value is a multiple of the base value; and

assigning a field type of unknown to the field based on a determination that the pointer value is not a multiple of the base value.

20. The non-transitory computer-readable storage medium of claim 18, wherein determining the field type of a field in the instance of the structure comprises:

reading bytes of data from the block of dynamically allocated memory of an inferior process;

interpreting the bytes as a candidate integer type;

determining whether a value of the interpreted bytes is within a set of integers that corresponds to values associated with the candidate integer type; and

assigning the integer type to the field based on a determination that the value is within the set of integers and assigning a field type of unknown to the field based on a determination that the value fails to represent an integer within the set of integers.