Search code examples
macoslldbcoredump

How to know which module allocated memory area while analysing coredump with LLDB

I'm analysing a core dump on MacOs 13 with LLDB (lldb-1400.0.38.17)

I've got the suspicious values (probably caused the core dump) in memory, these values look like a memory corruption. Now I'd like to know the origin of this memory area. As far as I understand, malloc_info command cannot be used, because it works if the app was run with LLDB. (But maybe I'm mistaken.)

Is it possible to know which module allocated and/or operated with this memory area?

Solution

  • You won't be able to reconstruct "who allocated this block" because all lldb's malloc history tools require the program to have been run in some "memory history collection" mode. That means either building your project with ASAN or running it with the MallocStackLoggingNoCompact environment variable set. This information is not reconstructable "after the fact".

    And I don't know of any of the memory introspection tools that record accesses to memory, that would be a lot of data! So I don't think you could in any circumstances ask after the fact who touched the memory.

    If this is a situation you can reproduce, then try doing so with your binary built with ASAN. That will catch memory errors when they happen rather than waiting for a side-effect to crash the program, making it much easier to diagnose this sort of problem.