Granted Patent B2

US 7,877,641 · App. 11/943,515 · Granted Jan 25, 2011

Abstract

Claims (47)

1. A method of forming a stack signature in response to halting execution of a computer program in a computer, the method comprising:

tracing the program's call stack to determine a series of stack frames resulting from execution of the program;

capturing a selected metric with respect to each stack frame in the series;

encoding each captured metric into a corresponding symbol; and

assembling the series of encoded symbols into an ordered list thereby forming a stack frame signature that reflects generally a historical execution path of the computer program before execution of the computer program was halted.

2. A method according to claim 1 , wherein the selected metric comprises a length of each of the stack frames.

3. A method according to claim 2 , wherein the step of encoding each captured metric into a corresponding symbol comprises encoding the length of each of the stack frames in a positional notation system of the form base b, wherein b is greater than 2.

4. A method according to claim 3 , wherein b is equal to 36 so that each symbol can be represented using a single Arabic numeral or a single Latin letter.

5. A method according to claim 1 , wherein the selected metric comprises an identifier of a generic type of callee module corresponding to each of the stack frames.

6. A method according to claim 1 , wherein the selected metric comprises an identifier of a specific callee code module corresponding to each of the stack frames.

7. A method according to claim 1 , wherein the selected metric comprises an identifier of a callee library associated with of each of the stack frames.

8. A method according to claim 1 , wherein the selected metric comprises an indication of a system call applicable to each of the stack frames.

9. A method according to claim 1 , wherein the selected metric comprises an indication of a peripheral driver module call applicable to each of the stack frames.

10. A method according to claim 1 , further comprising:

delimiting the series of encoded symbols so as to indicate the start and the end of the call stack.

11. A method according to claim 1 , further comprising:

filtering the stack frame signature by deleting symbols corresponding to stack frames associated with predetermined callee code modules.

12. A method according to claim 1 , further comprising:

filtering the stack frame signature by deleting symbols corresponding to stack frames associated with selected types of modules.

13. A method according to claim 1 , further comprising:

filtering the stack frame signature by deleting symbols corresponding to stack frames associated with system calls.

14. A method according to claim 1 , further comprising:

filtering the stack frame signature by deleting symbols corresponding to stack frames associated with calls to peripheral drivers.

15. A method according to claim 1 , further comprising:

truncating the stack frame signature so as to preserve only a selected portion of the signature.

16. A method according to claim 1 , wherein said encoding includes transforming the captured metric into a representation that is more compact than a binary representation, thereby facilitating human inspection and recognition of the stack frame signature.

17. A method according to claim 1 , wherein the step of halting execution of the computer program comprises halting execution of the computer program in response to an unhandled exception caused by the computer program, whereby the computer program can be updated to reduce an occurrence of future unhandled exceptions based on a comparison of a plurality of stack frame signatures formed by the step of assembling the series of encoded symbols into an ordered list.

18. A method according to claim 1 , wherein the stack frame signature formed by the step of assembling the series of encoded symbols into an ordered list does not comprise specific address information.

19. A method according to claim 1 , wherein the selected metric is a first selected metric, the method further comprising:

capturing a second selected metric with respect to each stack frame in the series, the second selected metric being different from the first selected metric;

encoding the second captured metric into a corresponding second symbol; and

appending the encoded second symbols to corresponding ones of the series of encoded symbols such that the stack frame signature reflects two captured metrics with respect to each stack frame in the series.

20. A machine-readable medium on which are stored computer program instructions for forming a stack frame signature, the computer program instructions comprising:

code for registering the computer program instructions for forming a stack frame signature in an operating system so that the operating system will launch the computer program instructions for forming a stack frame signature responsive to abnormal termination of an application program;

code for tracing the application program's call stack to determine a series of stack frames resulting from execution of the application program up to the termination;

code for collecting a size metric of each stack frame in the series;

code for encoding each size metric into a corresponding symbol; and

code for assembling the series of symbols so as to form a stack frame signature.

21. A method of forming a stack signature responsive to execution of a computer program in a computer, the method comprising:

in response to an abnormal termination of the computer program, tracing a stack associated with the computer program to determine a series of stack frames resulting from execution of the computer program;

determining a size of each stack frame, wherein the size of each stack frame reflects a distance between a top and bottom of the respective stack frame;

capturing a selected metric with respect to each stack frame in the series, wherein the selected metric does not comprise a stack frame size;

encoding the size of each stack frame into a corresponding first symbol and each captured metric into a corresponding second symbol; and

assembling the series of encoded first and second symbols into an ordered list thereby forming a stack frame signature that reflects generally a routine invocation sequence of the computer program prior to the abnormal termination of the computer program, so that the computer program can be updated to reduce an occurrence of future abnormal terminations based on a comparison of a plurality of stack frame signatures.

22. A method according to claim 21 , further comprising:

determining whether there is a break in a chain of the series of stack frames resulting from execution of the computer program; and

if it is determined that there is a break in the chain, determining the size of the next stack frame in the stack by single stepping through each stack location until a valid base pointer is found and updating the stack frame signature to signify the break in the chain.

Assignments (6)