Patent ID: 7231634
Filing Date: 2007-06-12
Classification: G06F

Abstract:
1. A computer-based method for analyzing computer system memory corruption after a memory corrupting event in a computer system, comprising: retrieving a memory image in a computer system generated after the event in the computer system; identifying automatically a data structure in the memory image linked to the event; applying a data structure rule set to the memory image to determine a scope of corruption in the memory, wherein the data structure rule set is selected based on the identified data structure; selecting an identified data structure rule set associated with the data structure linked to the event; checking the memory image for consistency by checking other data structures related to the identified data structure and comparing data in these other data structures with acceptable values defined in the identified data structure rule set; responsive to determining that at least one of the other data structures is corrupted, storing the corrupted other data structure for reporting and further analysis; responsive to the data structure failing to be automatically identified, prompting a user to select a rule set from two or more rule sets that may fit the data structure; wherein analysis of each corrupted identified data structure includes a list linked to one of the rule sets indicating acceptable data values and types, the analysis comprising walking the linked list in at least one direction using a reverse list to compare data values and types against the linked list to determine the cause of the corruption; and generating a report for review by the use on a user interface identifying patterns of memory corruption and a cause of the corruption.