Ichnaea: A Framework for Precise Tracking of Memory Objects

Tracing memory objects (who accessed 1 what object and when) is often important for understanding the runtime behavior of modern software. This type of rich per-access metadata can aid in debugging, tracing, forensics and other tasks. Collecting this information is non-trivial since it will be either be incomplete or requires heavy instrumentation and/or hardware support and likely adds significant runtime overheads (e.g., Intel Pin or Valgrind slow programs down by 10 -100x).

We present Ichnaea 2 , a purpose-built, precise and complete framework based on memory protection keys (MPK) that delivers context-rich object events at very low cost to the application. Ichnaea is dormant until one of the objects of interest (ObjOfInterest) is read or written to -at which point it logs any access attempts and changes to the ObjOfInterest along with rich context information ("who is attempting access?", "what changes, if any, are being applied?") before returning control to the application. In general Ichnaea reduces the tracing overheads by 10 -60x when compared to the widely used framework Intel Pin , while still capturing precise, per-access information needed to diagnose memory vulnerabilities, performance hot-spots and subtle concurrency errors.