Tracing the last written value of a memory location without slowdown

Question

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and breaks if the next node of the list is null. When the application using the library is run fast enough, the address holding the pointer location being iterated becomes corrupted with a value far outside the bounds of addressable memory, crashing the program. I want to see if the previous linked list node contained the corrupted pointer as its next node or the bug is elsewhere, but there are no references to the parent at the time of the crash, since the node is overwritten inside the loop.

The bug is only triggered when the application is running at full speed, likely because it's a race condition. Because of this, I can't trace or conditionally break on the the execution of the assembly block because it slows the program down so much that the bug doesn't trigger.

Is there some way of injecting a global variable somewhere in memory holding the address of the previously iterated linked list node, or otherwise patching the code structure so the values the program checked are inspectable somehow?

Answer 1

If there is a break on access to the invalid memory, then you have the site of the accessing code. Tracing backwards from there should yield the parameter that holds the start of the list. Tracing forwards from there should show which of the nodes is corrupted.

Failing that, it seems that you would need to modify the code of the iterating function to copy the previous node address to a "safe" location during iteration. There are spare fields in the TEB, for example, that might be suitable.

Answer 2

If you can predict the address being overwritten ahead of time, try setting a hardware breakpoint on it. You can also try a dynamic tracer such as PIN which usually has only minor slowdown.