Purify A tool to detect memory leaks and

Purify – A tool to detect memory leaks and corruption Presented By: Keyur Malaviya

Topics covered Why Purify? What it can do? Features and benefits Purify vs Static Analysis Rational Purify for Windows How does it work? Type of Memory Errors Technique Source for this software Support and issues DEMO

The Necessity PURIFY TOOL Application behaviour: n n n Crashes intermittently Uses too much memory Runs too slowly Isn’t well tested Is about to ship You need something n n n See what your code is really doing Help spend less time finding bugs Develop fast, reliable code

PURIFY? What is it? What it can do for me? How does it work? How do I get it?

Software Quality Management IBM-Rational Products: n n A set of runtime analysis tools Increase code quality Purify n n n Detecting Runtime Errors Automatically pinpoints hard-to-find bugs Profiling. NET Managed Code (Memory Profiling) Quantify n Application profiler n Highlights performance bottlenecks Pure. Coverage n Source code coverage analysis n Helps avoid shipping untested code

Features and benefits Who can use it? n For everybody n Unix, Windows, C, C++, Java, . NET n Developers and testers Source Code required? n Monitors components with no source code Interesting Features: n Rich command line interface and batch mode for automation n Integrations with Rational Robot, Rational Clear. Quest, Rational Clear. Case, and Microsoft Visual Studio. NET Current Version: Purify. Plus

Product feature matrix

What about static analysis tools Static analysis tools are a great complement to Purify n n Find errors that you don’t exercise in test cases Find richer semantic errors, e. g. type safety Find potential errors if calling patterns change Analyze code sections before you have a working executable

What about static analysis tools Static analysis tools have limitations n Only find errors in the code you have source for Not in libraries that you pass bad data too or that are buggy n Can miss errors whose cause & effect are distant in time & space Or bury you in “possible” errors n Can take a long time to run

Rational Purify for Windows Java™, Visual C++ and all VS. NET managed languages (including C# and VB. NET) Checks every component in your program complex multi-threaded, multi-process applications n. DLL's, third party DLL's, Windows. DLL's n Microsoft Foundation Class Library and. DLL's Visual C/C++ components embedded within Visual Basic Applications, Internet Explorer, or any Microsoft Office application Microsoft Excel and Microsoft Word plug-ins COM-enabled applications using OLE and Active. X controls n

Requirements for Windows platform Compilers: Microsoft Visual C++ 6. 0, Microsoft Visual C++. NET Interpreters: Microsoft virtual machine for Java. Msjava. dll version >= 2828. Sun JVM 1. 2. 2 and higher. For Pentium 4 JDK 1. 2. 2, build 007 is required Debuggers: Visual C++, Win. DBG, NTSD Debug formats: COFF, CV 4 Debug files: Debug data can be placed in. exe, . pdb, or. dbg files. Can also use. map files, if available

Type of Memory Errors ABR/ABW – Array bounds read/write FMR/FMW – Freed memory read/write UMR – Uninitialized memory read MSE – Memory Segment Error MLK – Memory Leak NPR/NRW – Null Pointer Read FMM – Freeing Mismatched Memory

Purify limitations Purify has problems detecting: n Array bound errors in static memory. n Array bound errors on the stack. n Improperly accessing legal memory (pointer manipulation).

How does it work? Take your compiled application apart Find interesting places to insert probes Put your application back together again Run it and play Detecting memory leaks n n GC-like algorithm Maintain list of allocated blocks in all heaps And call chain of allocator On demand, scan memory for all in-scope pointers Starting from anchors –stack, statics, registers Any block not pointed to is “leaked”(MLK/PLK) All other blocks are “memory in use”(MIU)

Technique § Track state of each byte in process address space -Red = logically unallocated to app -Yellow = allocated (malloc/new) but not written to yet (uninitialized) -Green = allocated and initialized n Add red guard zone to the ends of allocated blocks -To catch buffer overrun errors n Monitor every read and write instruction

Purify’s memory state tracking

Purify’s array bounds detection Inserts guard zones around each block allocated. (Guard zones are colored red. A read or write to red memory triggers an array bounds violation) Uninitialized Read Violation A read of yellow memory triggers ? ? ?

Source for Purify Download & install the Free 15 day trial http: //www-128. ibm. com/developerworks/downloads/r/rpp/? S_TACT=105 AGX 14&S_CMP=DWNL Apply the latest Fixpack/i. Fixto get the latest platform support http: //www. ibm. com/products/finder/us/finders? pg=ddfinder& C 1=5000583&C 2=5000623&rcss=rtlprfypls If you like it, buy it Rep: http: //www-306. ibm. com/software/rational/howtobuy/contact/ Online: http: //www. ibm. com/cgibin/software/track 0. cgi? i=49435& c=69617&o=7&ef=T&cn=6137703

Any Issues? Yes! Many issues exists Technical Support website Online documentation and articles available to address such issues developer. Works has several how-to articles and a Q&A Forum http: //www 128. ibm. com/developerworks/rational /products/purify Web-based training course DEV 205 http: //www 128. ibm. com/developerworks/rational/ library/4181. html

QUESTION SO FAR?

DEMO ABR/W: Array Bounds Read/Write ABWL: Late Detect Array Bounds Write (Error Detection) Late detect scan after every 200 heap operations or 10 seconds elapsed between heap operations Notes: n n Enable late detect scanning in the settings dialog boxes. Do any one of the following: Rerun the program using precise instrumentation. Advanced tab -> settings lower the values for LDSC LDSI settings -> Errors and Leaks tab -> Use Red zone length to increase the number of bytes Purify inserts

BOX: Message. Box n Normally hidden by error filters. n n Filter Manager -> View -> Global Filters Purify Default Filters group and deselect the BOX filter BSR: Beyond stack read/write void caller() int* values() { { } int* arr. Pointer; int array[100]; arr. Pointer = values(); … // arr. Pointer? ? ? return array; }

EXC: Continued Exception EXH: Handled Exception EXI: Ignored Exception EXU: Unhandled Exception FFM: Freeing Freed Memory FIM: Freeing Invalid Memory FMM: Freeing Mismatched Memory FMR/R: Free Memory Read/Write FMWL: Late Detect Free Memory Write

HAN: Invalid Handle n Instead of proper expected handle the value specified is not an active handle, or of the wrong type n n Filter Manager -> View -> Global Filters Purify Default Filters group and deselect the HAN filter PAR: Bad Parameter