Tools: Memory Analysis

ASan (Address Sanitizer)

  • Accessing memory outside its scope causes a Segfault, but accessing memory inside another valid region of code can cause memory corruption.

  • Because of this, ASan is used to check if accesses are within the array bounds, etc.

Flags

  • ASan LLVM flags .

    • "If you run it with set ASAN_OPTIONS=help=1 , it'll dump out a list on startup too."

  • ASan Google flags .

  • Used in Odin:

    • set ASAN_OPTIONS=detect_stack_use_after_return=true:windows_hook_rtl_allocators=true

Crash Report: Registers

  • PC (Program Counter) :

    • Also known as the Instruction Pointer (IP) in x86.

    • Points to the next instruction to be executed.

    • In ASan reports, the PC indicates where the crash (e.g., use-after-free, buffer overflow) occurred.

  • BP (Base Pointer / Frame Pointer) :

    • Used to track the base of the current stack frame in functions.

    • Helps in unwinding the call stack during debugging.

    • May not always be present (e.g., in optimized builds where frame pointers are omitted).

  • SP (Stack Pointer) :

    • Points to the top of the stack.

    • Used for managing function calls, local variables, and return addresses.

    • ASan uses this to detect stack-based buffer overflows or stack-use-after-return.

Warnings

  • Failed to use and restart external symbolizer!

    • Means that ASan could not use an external tool to convert raw memory addresses into readable file names, line numbers, and function names in your stack trace.

    • Why :

      • Missing Symbolizer Tool

        • ASan relies on an external program (like llvm-symbolizer  or addr2line ) to map addresses to source code locations.

        • If this tool is not installed or not in your PATH , ASan can't resolve symbols properly.

      • Incorrect Path or Permissions

        • Even if the symbolizer exists, ASan might fail to execute it due to:

          • Wrong permissions (e.g., no execute access).

          • Anti-virus blocking the tool.

      • Windows-Specific Issues

        • On Windows, ASan expects llvm-symbolizer.exe  to be available.

        • If you're using MSVC, it might not be bundled by default.

      • ASan Could Not Restart the Symbolizer

        • If the symbolizer crashes or times out, ASan gives up and shows this warning.

    • Fix :

Valgrind + massif-visualizer

  • "Massif Visualizer is a tool that visualizes massif data. You run your application in Valgrind with --tool=massif  and then open the generated massif.out.%pid  in the visualizer. Gzip  or Bzip2  compressed massif files can also be opened transparently."

  • massif-visualizer .

    • Created 16 years ago.

    • Updated 2 weeks ago.

  • massif-visualizer .

  • core:sys/valgrind .

  • Massif docs .

  • Massif docs .

  • Valgrind demo .

  • Valgrind + GDB demo .

  • Tracks heap usage over time and generates memory snapshots.

  • Platforms :

    • Linux

      • Primary platform, best support

    • macOS

      • Limited support, works on older versions without Apple Silicon

    • Windows

      • Not natively supported.

  • Languages :

    • C

      • Full support.

    • C++

      • Full support.

    • Odin

      • Partial support, requires debug symbols and manual suppression files.

    • Rust

      • Works, but may need --tool=memcheck  for leaks.

    • Other compiled languages

      • Any language that compiles to native code can be analyzed but may need extra configuration.

  • How to use : 

valgrind --tool=massif ./your_program
massif-visualizer massif.out.*  # GUI viewer

  • Pros :

    • Shows peak memory usage and allocation trends.

rr  + GDB/LLDB (Time-Travel Debugging)

  • Records execution and lets you rewind  to see when memory was freed.

  • How to use : 

rr record ./your_program   # Records execution
rr replay                  # Debug with GDB/LLDB

  • Key commands : 

watch -l *ptr  # Break on UAF access
backtrace      # See who freed memory

GDB/LLDB Stack Frames

  • Inspect the call stack and local variables.

  • Key commands : 

bt full      # Show full backtrace with locals
info locals  # List all local variables

Dr. Memory