Tuesday, April 17, 2007

Debugging heap corruption on Win32

So I have spent the last 28 hours in two days trying to debug a heap corruption problem on Win32. I have BoundsChecker, which is a great tool for finding certain classes of faults, but it turns up that when it comes to detecting accesses to free'd memory, all BoundsChecker can do is poison the memory on free(), which increases the chance of a crash on read (since the pattern is not a valid pointer). This is helpful in some cases, but in my case I have code actually **writing** to free'd memory, which prompts the debug CRT to panic the at some point in the future when it looks at the heap pool.

On UNIX/Linux, I would be using Electric Fence, a great tool written by Bruce Perens which takes advantage of the VM subsystem to put guard pages after allocated pages, and lock memory after free(). If only there were some equivalent for Win32....

Well, it turns up there is. It's called Pageheap.exe, and it was written by Microsoft.

http://support.microsoft.com/default.aspx?scid=kb;en-us;286470

It's an obscure and not well advertised tool which supposedly provides functionality equivalent to Electric Fence but on Win32. In the process of trying it out now.