Method for determining scope and cause of memory corruption

1. A computer-based method for analyzing computer system memory corruption after a memory corrupting event in a computer system, comprising:

retrieving a memory image in a computer system generated after the event in the computer system;

identifying automatically a data structure in the memory image linked to the event;

applying a data structure rule set to the memory image to determine a scope of corruption in the memory, wherein the data structure rule set is selected based on the identified data structure;

selecting an identified data structure rule set associated with the data structure linked to the event;

checking the memory image for consistency by checking other data structures related to the identified data structure and comparing data in these other data structures with acceptable values defined in the identified data structure rule set;

responsive to determining that at least one of the other data structures is corrupted, storing the corrupted other data structure for reporting and further analysis;

responsive to the data structure failing to be automatically identified, prompting a user to select a rule set from two or more rule sets that may fit the data structure;

wherein analysis of each corrupted identified data structure includes a list linked to one of the rule sets indicating acceptable data values and types, the analysis comprising walking the linked list in at least one direction using a reverse list to compare data values and types against the linked list to determine the cause of the corruption; and

generating a report for review by the use on a user interface identifying patterns of memory corruption and a cause of the corruption.

2. The method of claim 1 , wherein the applying is performed on other data structures in the memory image related to the identified data structure by type or location.

3. The method of claim 2 , further including prior to the applying, processing the identified data structure to determine the location and the data structure type for the identified data structure and retrieving the data structure rule set based on the processing.

4. The method of claim 1 , further including prior to the applying, creating the data structure rule set for the identified data structure to define a set of data structure characteristics for other data structures in the memory image related to the identified data structure.

5. The method of claim 4 , further including validating the created data structure rule set prior to the applying including applying the created data structure rule set to an uncorrupted memory image having data structures complying to rules in the created data structure rule set.

6. The method of claim 1 , further including receiving the memory image in a crash dump file generated for the computer system.

7. The method of claim 1 , wherein the scope is defined by a set of corrupted data structures including the identified data structure and other data structures in the memory image which did not comply to the rule set in the applying.

8. The method of claim 7 , further including processing the set of corrupted data structures to determine a cause of the corruption in the memory.

9. The method of claim 8 , wherein the processing includes identifying a pattern to the corruption in the set of corrupted data structures.

10. The method of claim 8 , wherein the report includes a listing of at least a portion of the set of corrupted data structures.

11. A computer implemented method for identifying a cause of memory corruption, comprising:

providing a set of corrupted data structures from a computer system memory;

identifying a pattern to data corruption in the data structures; and

processing the pattern of the data corruption to determine a cause of the data corruption,

wherein the providing includes identifying one of the corrupted data structures as a cause of a memory corrupting event in the computer system memory, selecting a rule set based on the identified corrupted data structure, locating other data structures in the memory related in structure to the identified corrupted data structure, comparing the other data structures to the rule set to generate the set of corrupted data structures wherein comparing includes comparing data values and data types against acceptable linked values and linked types listed in a linked list to determine the cause of the corruption and prompting a user to select a rule from two or more rule sets that may fit the identified data structure,

wherein the analysis of the cause of the corruption includes walking the linked list in at least one direction using a reverse list; and

generating a report for review by the use on a user interface identifying patterns of memory corruption and the cause of the corruption.

12. The method of claim 11 , wherein the set of corrupted data structures is related based on location in the computer system memory.

13. The method of claim 11 , wherein the set of corrupted data structures is related based on content of data in the data structures.

14. The method of claim 11 , further including creating the rule set for the identified corrupted structure and validating the rule set using uncorrupted data structures.

15. The method of claim 11 , wherein the providing includes receiving a core file from a computer system having the memory generated after a panic in the computer system.

16. A client support computer system, comprising:

a memory device storing a received core file for a client computer system having a memory image for the client computer system and storing data structure rules for a plurality of data structures;

a memory analysis tool configured to retrieve the memory image of the received core file, to select one of the data structure rules, and to apply the selected one of the data structure rules to a set of data structures in the memory image to create a list of corrupted data structures in the memory image,

wherein the memory analysis tool is further configured to process the memory image to identify a data structure that caused an event resulting in the corrupted data structures in the client computer system, perform the selecting based on the identified data structure, and select an identified data structure rule set associated with the identified data structure,

wherein the memory analysis tool processes the memory image to establish the set of data structures for applying the selected one of the data structure rules based on construction or location of the identified data structure,

wherein, responsive to the memory analysis tool failing to select the identified data structure rule set, the memory analysis tool prompts a user to select a rule set from two or more rule sets that may fit the identified data structure, and

wherein the data structure includes a linked list, the selected data structure rule set indicates acceptable link values and types, and the analysis of the cause of the corruption includes walking the linked list in at least one direction using a reverse list comparing acceptable data values and types from the selected data structure rule set with those of the identified data structure; and

generating a report for review by the use on a user interface identifying patterns of data corruption and the cause of the corrupted data structures.

17. The system of claim 16 , wherein the memory analysis tool processes the list of corrupted data structures to identify a pattern in data corruption.