Advanced memory tracking for kernel mode drivers

1. A computer-implemented method for tracking memory usage of a driver, comprising:

tracing, in a kernel mode of an operating system, a memory allocation request related to the driver to allocate a portion of memory for the driver, wherein tracing the memory allocation request includes replacing a first function call for the memory allocation request with a second function call provided by a driver verifier to initiate the memory allocation request to the driver verifier, wherein tracing the memory allocation request is performed by the driver verifier;

recording, based on tracing the memory allocation request, one or more allocation parameters indicated by the memory allocation request; and

reporting, during execution of the driver and based on the one or more allocation parameters indicated by the memory allocation request and via an interface on an application, an allocation history of the driver over a period of time.

2. The computer-implemented method of claim 1 , further comprising:

tracing, in the kernel mode of the operating system, a memory free related to the driver to free the portion of memory for the driver; and

recording, based on tracing the memory free, one or more free parameters of the memory free,

wherein reporting the allocation history of the driver over the period of time is further based on the one or more free parameters.

3. The computer-implemented method of claim 2 , wherein the memory free is traced from a pool manager of the operating system.

4. The computer-implemented method of claim 2 , wherein the allocation history includes at least an allocation count of a number of allocations requested by the driver over the period of time, an amount of memory allocated by the driver over the period of time, a number of memory frees related to the driver over the period of time, and an amount of memory freed by the driver over the period of time.

5. The computer-implemented method of claim 1 , further comprising detecting, during execution of the driver, one or more memory allocation requests by the driver without a corresponding memory free, wherein reporting the allocation history includes reporting an indication of the one or more memory allocation requests.

6. The computer-implemented method of claim 1 , wherein reporting the allocation history of the driver over the period of time is part of generating multiple snapshots of the allocation history the driver over multiple periods of time.

7. The computer-implemented method of claim 6 , further comprising:

detecting, during the execution of the driver and based on the multiple snapshots, a pattern of memory allocation requests, including the memory allocation request, traced from the driver without corresponding memory frees over the period of time;

determining that the pattern indicates a potential memory leak; and

reporting an indication of the potential memory leak.

8. The computer-implemented method of claim 7 , wherein reporting the indication of the potential memory leak includes reporting the one or more allocation parameters of at least two of the multiple snapshots that correspond to the pattern that indicates the potential memory leak.

9. The computer-implemented method of claim 1 , wherein replacing the first function call with the second function call includes modifying an import address table (IAT) to replace the first function call with the second function call.

10. A device for tracking memory usage of a driver, comprising:

a memory storing one or more parameters or instructions for executing an operating system and the driver that facilitates communicating with hardware or other devices; and

at least one processor coupled to the memory, wherein the at least one processor is configured to:

trace, in a kernel mode of the operating system, a memory allocation request related to the driver to allocate a portion of memory for the driver, wherein the at least one processor is configured to trace the memory allocation request at least in part by replacing a first function call for the memory allocation request with a second function call provided by a driver verifier to initiate the memory allocation request to the driver verifier, wherein tracing the memory allocation request is performed by the driver verifier;

record, based on tracing the memory allocation request, one or more allocation parameters indicated by the memory allocation request; and

report, during execution of the driver and based on the one or more allocation parameters indicated by the memory allocation request and via an interface on an application, an allocation history of the driver over a period of time.

11. The device of claim 10 , wherein the at least one processor is further configured to:

trace, in the kernel mode of the operating system, a memory free related to the driver to free the portion of memory for the driver; and

record, based on tracing the memory free, one or more free parameters of the memory free,

wherein reporting the allocation history of the driver over the period of time is further based on the one or more free parameters.

12. The device of claim 11 , wherein the memory free is traced from a pool manager of the operating system.

13. The device of claim 11 , wherein the allocation history includes at least an allocation count of a number of allocations requested by the driver over the period of time, an amount of memory allocated by the driver over the period of time, a number of memory frees related to the driver over the period of time, and an amount of memory freed by the driver over the period of time.

14. The device of claim 10 , wherein the at least one processor is further configured to detect, during execution of the driver, one or more memory allocation requests by the driver without a corresponding memory free, wherein the at least one processor is configured to report the allocation history including an indication of the one or more memory allocation requests.

15. The device of claim 10 , wherein the at least one processor is configured to report the allocation history of the driver over the period of time including generating multiple snapshots of the allocation history the driver over multiple periods of time.

16. The device of claim 15 , wherein the at least one processor is further configured to:

detect, during the execution of the driver and based on the multiple snapshots, a pattern of memory allocation requests, including the memory allocation request, traced from the driver without corresponding memory frees over the period of time;

determine that the pattern indicates a potential memory leak; and

report an indication of the potential memory leak.

17. A computer-readable medium, comprising code executable by one or more processors for tracking memory usage of a driver, wherein the computer-readable medium is one of a memory or a storage device, the code comprising code for:

tracing, in a kernel mode of an operating system, a memory allocation request related to the driver to allocate a portion of memory for the driver, wherein tracing the memory allocation request includes replacing a first function call for the memory allocation request with a second function call provided by a driver verifier to initiate the memory allocation request to the driver verifier, wherein tracing the memory allocation request is performed by the driver verifier;

recording, based on tracing the memory allocation request, one or more allocation parameters indicated by the memory allocation request; and

reporting, during execution of the driver and based on the one or more allocation parameters indicated by the memory allocation request and via an interface on an application, an allocation history of the driver over a period of time.

18. The computer-readable medium of claim 17 , further comprising code for:

tracing, in the kernel mode of the operating system, a memory free related to the driver to free the portion of memory for the driver; and

recording, based on tracing the memory free, one or more free parameters of the memory free,

wherein the code for reporting reports the allocation history of the driver over the period of time is further based on the one or more free parameters.