Dr. Memory MEMORY DEBUGGER FOR WINDOWS AND LINUX WGM #47 GUSTAVO ROVELO MARCH 1 ST, 2012

Transcription

1 Dr. Memory MEMORY DEBUGGER FOR WINDOWS AND LINUX WGM #47 GUSTAVO ROVELO MARCH 1 ST, 2012

2 What are we talking about today? Tools for Performing Application Analysis What is Dr. Memory? 2 Image:

3 Tools for Performing Application Analysis Commercial tools Purify IBM Memory debugging Uninitialized memory access, buffer overflow and improper freeing of memory Memory leak detection Single user license: US$447 Insure++ Parasoft commercial tool Memory Validator Softwareverify Single user license: US$299 GlowCode Electric Software Inc. Single user license: US$499 3

4 Tools for Performing Application Analysis Free tools Dr Memory Visual Leak Detector Install and include a header on your application Only memory leaks Visual Studio tools Modifying your application code Using Windbg 4

5 What is Dr. Memory? Is a memory monitoring tool capable of identifying memory-related programming errors such as: Accesses of uninitialized memory Accesses to un-addressable memory including outside of allocated heap units and heap underflow and overflow Accesses to freed memory, double frees, memory leaks. 5

6 Setting up Dr. Memory There are two options to get Dr. Memory: Option 1 Download and unzip the file and Add Dr. Memory bin folder to the path. Option 2 Download the Windows Installer. 6 Image:

7 Running Dr. Memory Preparing your application Compile your application with debug info in order to get line number information on Dr. Memory messages 7 If your application runs with stripped libraries or binaries and have the un-stripped versions in separate locations: Use DRMEMORY_LIB_PATH environment variable to include them

8 On Windows, Running Dr. Memory The debug DLL C library (specified with the "/MDd" flag) is currently not supported. Build with either: Release DLL ("/MD") or Release and Debug static library ("/MT" or "/MTd"), Although "/MTd" is not recommended. If your application is C++, another step is necessary when using /MD to avoid the C++ Debug DLL: 8 Remove _DEBUG from the list of Preprocessor Definitions Configuration Properties C/C++ Preprocessor

9 On Windows (continue) Running Dr. Memory 9 Debug versions of the C library ("/MTd" and /MDd" flags) are not supported at all: The debug heap checks will mostly be disabled as they overlap and can conflict with Dr. Memory's checks. When using static debug versions of msvcrt ("/MTd" flag), if your application does not have symbols : Dr. Memory will not be able to identify and avoid conflicts with msvcrt's own heap debugging facilities. Which may lead to false positives and/or false negatives. Be sure to build with debugging information included.

10 On Windows (continue) Run Time Error Check Running Dr. Memory 10 The Visual Studio compiler's /RTC1 flag can prevent Dr. Memory from reporting uninitialized reads of local variables. And the /RTC1 checks for uninitialized reads themselves may not catch everything that Dr. Memory finds. /RTC1 does perform additional stack checks that Dr. Memory does not So for best results, your application should be run under Dr. Memory without /RTC1, and run natively with /RTC1

11 Running Dr. Memory Run your application as you normally would from a command prompt: drmemory.exe -- c:/path/to/my/app args to my app When running scripts it is best to explicitly invoke the interpreter rather than invoking the script directly: drmemory.exe -- /usr/bin/perl./myscript.pl 11

12 Controlling Child Processes By default, Dr. Memory monitors all child processes. To disable this behavior and not monitor any children, use this option: drmemory.exe -no_follow_children To follow all children except certain applications: Run: drconfig.exe -quiet -reg myapp -norun With the executable name of each application you do not wish to monitor, prior to running Dr. Memory This -norun request is permanent and affects all subsequent Dr. Memory executions by the user that issued the -norun request. To undo it, use this command: drconfig.exe -quiet -unreg myapp 12

13 Examining the Results Results are written to a file called results.txt The default directory is: C:\Users\MyUser\AppData\Roaming\Dr. Memory It can be changed with the -logdir option: drmemory.exe -logdir c:/logs -- myapp Dr. Memory creates a subdirectory in the base log directory for every execution: DrMemory-<appname>.<pid>.NNN 13 NNN = Counter that is incremented to ensure unique names.

14 On Windows Examinig the Results 14 Results files for the top-level processes are automatically opened in notepad when the application exits. If there are child processes, they will have their own result directories and files, but these will not be automatically displayed. The option -batch can be used to disable the launch of notepad at application exit. drmemory -batch -- myapp To attach a debugger at the point an error is first detected: -pause_at_unaddressable -pause_at_uninitialized

15 Examining the Results Aggregating Results from multiple processes 15 Multiple applications, Multiple processes of an application or Multiple runs of the same application Use the -aggregate option and supply the list of log directories, or a single directory containing the log directories as subdirectories to aggregate all of them: drmemory.exe -aggregate DrMemory-myapp DrMemory-myapp drmemory.exe -aggregate /parent/logdir/

16 Examining the Results It updates the results.txt file as the application runs, but it does not perform leak checking or produce a summary of errors until the end of the run. 16 For applications that do not have a normal exit, such as daemons, Dr. Memory provides a method of forcing end-of-run actions: drmemory.exe -nudge processid

17 Error Types Reported by Dr. Memory The error report includes: Error number, Type of error, Address and size of the memory access in question (if applicable to the error type), Timestamp and thread identifier indicating when and where the error was detected, and Callstack of the application at the point of the error. The -brief option can be used to request simpler and in some cases easier to read error reports It hides STL and CRT paths, It removes the path containing the executable itself, and It omit absolute addresses, thread timestamps, and instruction disassembly. 17

18 Error Types Reported by Dr. Memory Un-addressable Access Any read or write of a memory location that was not allocated. Access to an invalid memory address. Examples include: a buffer overflow, 18 reading off the end of an array, reading or writing to memory that has been freed, reading beyond the top of the stack, etc. Error #1: UNADDRESSABLE ACCESS: reading 0x000a720b-0x000a720c 1 byte(s) # 0 main [e:\derek\drmemory\git\src\tests\malloc.c:96] in thread 3808 Note: refers to 1 byte(s) beyond last valid byte in prior malloc Note: prev lower malloc: 0x000a7208-0x000a720b Note: instruction: mov 0x03(%edx) -> %al

19 Error Types Reported by Dr. Memory Un-initialized Read Try to read from memory that has not been written to since it was allocated. In order to avoid false positives does not report the use of uninitialized memory until something "meaningful" is done with that memory 19 a comparison or conditional branch or passing it to a system call. Error #2: UNINITIALIZED READ: reading 0xffbae108-0xffbae byte(s) within 0xffbae100-0xffbae114 Elapsed time = 0:00: in thread system call socketcall setsockopt args <system call> 0x08049a65 <my-socket-test+0x1a65> my-socket-test!main??:0 0x0092dbb6 <libc.so.6+0x16bb6> libc.so.6<nosyms>! libc_start_main??:0 0x080489b1 <my-socket-test+0x9b1> my-socket-test!_start??:0

20 Error Types Reported by Dr. Memory Invalid Heap Argument 20 Whenever a pointer that does not refer to a valid malloc region is passed to free() or other malloc-related routines. Error #4: INVALID HEAP ARGUMENT: free 0x Elapsed time = 0:00: in thread # 0 malloc!main [/home/bruening/drmemory/git/src/tests/malloc.c:164] # 1 libc.so.6! libc_start_main [/build/buildd/eglibc /csu/libc-start.c:226] # 2 malloc!_start

21 Error Types Reported by Dr. Memory Memory Leaks There are three categories: 21 Memory that is still reachable by the application. This is NOT considered a leak. Many applications do not explicitly free memory whose lifetime matches the process lifetime. Memory that is definitely not reachable by the application. This is called a "leak" by Dr. Memory, as there is no way for the application to free this memory. Memory that is reachable only via pointers to the middle of the allocation, rather than the head. This is called a "possible leak" by Dr. Memory. The std::string class places a char[] array in the middle of an allocation and points directly at it. Use -no_midchunk_string_ok runtime option to ignore them.

22 Error Types Reported by Dr. Memory 22 Warnings about unusual memory-related conditions: Error #12: WARNING: heap allocation in thread 3748 # 0 suppress.exe!warning_test1 [e:\derek\drmemory\git\src\tests\suppress.c:179] # 1 suppress.exe!test [e:\derek\drmemory\git\src\tests\suppress.c:282] # 2 suppress.exe!main [e:\derek\drmemory\git\src\tests\suppress.c:297] # 3 KERNEL32.dll!BaseProcessStart

23 Memory Leaks Detection and Isolation with VS Memory leak detection enabling: Include in your program #define _CRTDBG_MAP_ALLOC Maps the base versions of the CRT heap functions to the corresponding debug versions #include <stdlib.h> 23 #include <crtdbg.h> map the malloc and free functions to their debug versions for DEBUG builds Including those libraries in that order is important. Call this function in your program to dump the memory leaks information to the output window: _CrtDumpMemoryLeaks();

24 Memory Leaks Detection and Isolation with VS If your program can exit from multiple locations include the following call at the beginning of your program: _CrtSetDbgFlag ( _CRTDBG_ALLOC_MEM_DF _CRTDBG_LEAK_CHECK_DF ); To dump the results to any other location use: _CrtSetReportMode( reporttype,reportmode ); reporttype _CRT_WARN _CRT_ERROR _CRT_ASSERT reportmode _CRTDBG_MODE_DEBUG _CRTDBG_MODE_FILE _CRTDBG_MODE_WNDW _CrtSetReportFile( _CRT_ASSERT, _CRTDBG_FILE_STDERR ); Any error type can be reported using ore than one report Mode. 24

25 Using Dr. Memory with Visual Studio To add a new building profile to your project: Click on Build menu Then, select the Configuration manager option Click on the Active solution configuration drop down menu Select the New option Write the name of the new configuration, e.g. DrMemory Select the option Copy settings from Debug. 25

26 Using Dr. Memory with Visual Studio Change the profile settings: 26 Go to your projects property pages: Change the Runtime library choosing /MTd, /MT or /MD Configuration properties / C/C++ / Code generation Remove the _DEBUG flag Configuration properties / Preprocessor / Preprocessor definitions To execute the Dr. Memory test directly from the VS Go to your projects property pages Choose the Debugging option Type in Command: drmemory.exe Type in Command Arguments: -logdir c:/logs -- $(TargetPath) Now you can execute Dr. Memory from the VS

27 WGM 47 - Dr. Memory Thank you for your attention Questions? 27