Detect Memory Corruption in Windows

WINDBG
1

I created a memory corruption by the following statement:
char *msg = “Default message”;
free(msg);

This causes the memory corruption panic as:
Break instruction exception - code 80000003 (first chance)

How to detect and debug memory corruption issues in Windows probably using Windbg?
What all are the windbg commands needed?

2

.help or !help are two REALLY good ones.

Gary G. Little

----- Original Message -----
From: xxxxx@gmail.com
To: “Kernel Debugging Interest List”
Sent: Thursday, May 5, 2011 2:27:38 PM
Subject: [windbg] Detect Memory Corruption in Windows

I created a memory corruption by the following statement:
char *msg = “Default message”;
free(msg);

This causes the memory corruption panic as:
Break instruction exception - code 80000003 (first chance)

How to detect and debug memory corruption issues in Windows probably using Windbg?
What all are the windbg commands needed?

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

xxxxx@gmail.com wrote:

I created a memory corruption by the following statement:
char *msg = “Default message”;
free(msg);

This causes the memory corruption panic as:
Break instruction exception - code 80000003 (first chance)

80000003 is an intentional breakpoint. Usually (but not always), that
means there was a failed assertion, and usually (but not always) there
will be a message on the debugger or mentioned in the code before the
break that tells you more about the problem.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

In user mode !heap -s -v
will validate all heaps

Regards
Kjell Gunnar

5

This is not memory corruption.

You have tried to free the memory you have not allocated. Free is a MSVCRT library call, and requires memory be allocated, via calloc, malloc or realloc prior to being freed.

char *msg = “Default message”;
// The “Default message” text is pushed on the stack, and hence should not be freed.

Break instruction exception - code 80000003 (first chance)
// This is expected if run under the debugger.

Thanks,
Arvind

6

On Thu, May 5, 2011 at 8:27 PM, wrote:
> How to detect and debug memory corruption issues in Windows probably using Windbg?
> What all are the windbg commands needed?

For starter you can use driver verifier and special pool allocations
if your code runs in kernel mode
(http://msdn.microsoft.com/en-us/library/ff551832(v=vs.85).aspx).

In user land you have application verifier
(http://msdn.microsoft.com/en-us/library/aa480483.aspx) where you can
debug heap corruptions.

Kris

7

Also, it is not a panic, it is a user mode exception. A BSOD would be a
panic, which is a kernel mode exception.

On Fri, May 6, 2011 at 6:47 AM, Krzysztof Uchronski wrote:

> On Thu, May 5, 2011 at 8:27 PM, wrote:
> > How to detect and debug memory corruption issues in Windows probably
> using Windbg?
> > What all are the windbg commands needed?
>
> For starter you can use driver verifier and special pool allocations
> if your code runs in kernel mode
> (http://msdn.microsoft.com/en-us/library/ff551832(v=vs.85).aspx).
>
> In user land you have application verifier
> (http://msdn.microsoft.com/en-us/library/aa480483.aspx) where you can
> debug heap corruptions.
>
> Kris
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>