Similar to radiometric dating using isotops we can use memory visualization techniques to see distribution of allocated buffers and their retention over time. The key is to allocate colored memory. For example, to append a red buffer that contains RGBA values 0xFF000000 to specific allocations. I call these colored memory marks isomemotops. We can either inject a different isomemotop for a different data or change the isomemotop over time to mark specific allocation times. I created a test program that allocates buffers marked by a different amount of different isomemotops every time:
#include "stdafx.h"
#include <stdlib.h>
#include <memory.h>
#include <windows.h>
typedef unsigned int ISOMEMOTOP;
void *alloc_and_mark_with_isomemotop(size_t size,
ISOMEMOTOP color,
size_t amount)
{
char *p = (char *)malloc(size+amount);
for (char *isop = p+size;
p && isop < p+size+amount;
isop+=sizeof(ISOMEMOTOP))
{
*(ISOMEMOTOP *)isop=color;
}
return p;
}
int _tmain(int argc, _TCHAR* argv[])
{
alloc_and_mark_with_isomemotop(0x1000,
0xFF000000, // red
0x10000);
alloc_and_mark_with_isomemotop(0x1000,
0x00FF0000, // green
0x20000);
alloc_and_mark_with_isomemotop(0x1000,
0x0000FF00, // blue
0x30000);
alloc_and_mark_with_isomemotop(0x1000,
0xFFFFFF00, // white
0x40000);
alloc_and_mark_with_isomemotop(0x1000,
0xFFFF0000, // yellow
0x50000);
DebugBreak();
return 0;
}
Corresponding Dump2Picture image is this (0×00000000 address is at the bottom):
- Dmitry Vostokov @ DumpAnalysis.org -
