Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
-
Upload
james-clause -
Category
Technology
-
view
279 -
download
1
description
Transcript of Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
![Page 1: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/1.jpg)
Advanced dynamic analysis for leak detection
Jim ClauseChris Friesen - ManagerAnalysis Tools Group
![Page 2: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/2.jpg)
Current analysis tools
Shark Instruments
![Page 3: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/3.jpg)
≈X-ray
Current analysis tools
Shark Instruments
![Page 4: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/4.jpg)
≈X-ray
MRI
Current analysis tools
Shark Instruments
![Page 5: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/5.jpg)
≈X-ray
MRI
Current analysis tools
Shark Instruments
≈?
![Page 6: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/6.jpg)
≈X-ray
MRI
Current analysis tools
Shark Instruments
C
A
B
31
2
Z
3
Dynamic taint analysis
≈
![Page 7: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/7.jpg)
Dynamic taint analysis
C
A
B Z
![Page 8: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/8.jpg)
Dynamic taint analysis
1 Assign
taint marks
C
A
B Z
![Page 9: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/9.jpg)
Dynamic taint analysis
1 Assign
taint marks
C
A
B
31
2
Z
![Page 10: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/10.jpg)
Dynamic taint analysis
1 Assign
taint marks2 Propagate
taint marks
C
A
B
31
2
Z
![Page 11: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/11.jpg)
Dynamic taint analysis
1 Assign
taint marks2 Propagate
taint marks
C
A
B
31
2
Z
![Page 12: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/12.jpg)
Dynamic taint analysis
1 Assign
taint marks3 Check
taint marks2 Propagate
taint marks
C
A
B
31
2
Z
![Page 13: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/13.jpg)
Dynamic taint analysis
1 Assign
taint marks3 Check
taint marks2 Propagate
taint marks
C
A
B
31
2
Z
C
A
B
31
2
Z
3
![Page 14: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/14.jpg)
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errors
![Page 15: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/15.jpg)
Attack detection / preventionPrevent stack smashing, SQL injection, buffer overruns, etc.Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errors
![Page 16: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/16.jpg)
Information policy enforcementensure classified information does not leave the system
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errors
![Page 17: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/17.jpg)
TestingCoverage metrics, test data generation heuristic, etc.
✔/✘
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errors
![Page 18: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/18.jpg)
Data lifetimetrack how long sensitive data remain in the application
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errors
![Page 19: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/19.jpg)
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errorsMemory errorsDetect illegal memory access, leak detection, etc.
![Page 20: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/20.jpg)
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
Applications of dynamic tainting
Memory errorsMemory errorsDetect illegal memory access, leak detection, etc. leak detection
![Page 21: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/21.jpg)
Detecting leaks is easy, fixing them is hard
![Page 22: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/22.jpg)
Detecting leaks is easy, fixing them is hard
@interface Container:NSObject { id _object;}@end
@implementation Container- (void) dealloc { //[_object release]; [super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
![Page 23: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/23.jpg)
Detecting leaks is easy, fixing them is hard
@interface Container:NSObject { id _object;}@end
@implementation Container- (void) dealloc { //[_object release]; [super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c;}
int main(...) { Container *c = create(); … [c release];}
![Page 24: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/24.jpg)
Detecting leaks is easy, fixing them is hard
@interface Container:NSObject { id _object;}@end
@implementation Container- (void) dealloc { //[_object release]; [super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c;}
int main(...) { Container *c = create(); … [c release];}
leaks:This object is leaked
![Page 25: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/25.jpg)
Leakpoint overviewDiscover where the last pointer to un-freed memory is lost
![Page 26: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/26.jpg)
Leakpoint overview
Assign taint marks
Propagate taint marks
Check taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero andmemory has not been freed.
1 1
1
Discover where the last pointer to un-freed memory is lost
![Page 27: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/27.jpg)
Leakpoint overview
Assign taint marks
Propagate taint marks
Check taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero andmemory has not been freed.
2
1 1
1
1 2
2
2
1
1 2 2
Discover where the last pointer to un-freed memory is lost
![Page 28: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/28.jpg)
Leakpoint overview
Assign taint marks
Propagate taint marks
Check taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero andmemory has not been freed.
2
1 1
1
1 2
2
2
1
1 2 2
In general propagation follows standard pointer arithmetic rules
Discover where the last pointer to un-freed memory is lost
![Page 29: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/29.jpg)
Leakpoint overview
Assign taint marks
Propagate taint marks
Check taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero andmemory has not been freed.
2
3
1 1
1
1 2
2
2
1
1 2 2
In general propagation follows standard pointer arithmetic rules
Discover where the last pointer to un-freed memory is lost
![Page 30: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/30.jpg)
@interface Container:NSObject {
id _object;}@end
@implementation Container- (void) dealloc {
[super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c;}
int main(...) { Container *c = create(); … [c release];}
Detecting leaks is easy, fixing them is easier
![Page 31: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/31.jpg)
@interface Container:NSObject {
id _object;}@end
@implementation Container- (void) dealloc {
[super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c;}
int main(...) { Container *c = create(); … [c release];}
leakpoint:This object is leaked
Detecting leaks is easy, fixing them is easier
![Page 32: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/32.jpg)
@interface Container:NSObject {
id _object;}@end
@implementation Container- (void) dealloc {
[super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c;}
int main(...) { Container *c = create(); … [c release];}
leakpoint:Last reference was lost here
leakpoint:This object is leaked
Detecting leaks is easy, fixing them is easier
![Page 33: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/33.jpg)
@interface Container:NSObject {
id _object;}@end
@implementation Container- (void) dealloc {
[super dealloc];}
- (void) setObject:(id)obj { [_object release]; _object = [obj retain];}@end
Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c;}
int main(...) { Container *c = create(); … [c release];}
[_object release];
leakpoint:Last reference was lost here
leakpoint:This object is leaked
Detecting leaks is easy, fixing them is easier
![Page 34: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/34.jpg)
Leakpoint implementation• Implemented as a Valgrind tool (www.valgrind.org)
■ intercept libc memory management functions■ instrument binary instructions to perform propagation
![Page 35: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/35.jpg)
Lost pointer to 0x1C93AC0 (16 bytes) allocated at: at calloc+105 by _internal_class_createInstanceFromZone+149 by _internal_class_createInstance+31 by +[NSObject allocWithZone:]+155 (NSObject.m:445) by +[NSObject alloc]+41 (NSObject.m:432) by create+97 (main.m:29) by main+17 (main.m:38) leaked at: at free+103 by _internal_object_dispose+81 by NSDeallocateObject+223 (NSObject.m:207) by -[Container dealloc]+53 (container.m:13) by main+43 (main.m:40)
Leakpoint implementation• Implemented as a Valgrind tool (www.valgrind.org)
■ intercept libc memory management functions■ instrument binary instructions to perform propagation
![Page 36: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/36.jpg)
leak
s
Lost pointer to 0x1C93AC0 (16 bytes) allocated at: at calloc+105 by _internal_class_createInstanceFromZone+149 by _internal_class_createInstance+31 by +[NSObject allocWithZone:]+155 (NSObject.m:445) by +[NSObject alloc]+41 (NSObject.m:432) by create+97 (main.m:29) by main+17 (main.m:38) leaked at: at free+103 by _internal_object_dispose+81 by NSDeallocateObject+223 (NSObject.m:207) by -[Container dealloc]+53 (container.m:13) by main+43 (main.m:40)
Leakpoint implementation• Implemented as a Valgrind tool (www.valgrind.org)
■ intercept libc memory management functions■ instrument binary instructions to perform propagation
![Page 37: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/37.jpg)
leak
po
int
leak
s
Lost pointer to 0x1C93AC0 (16 bytes) allocated at: at calloc+105 by _internal_class_createInstanceFromZone+149 by _internal_class_createInstance+31 by +[NSObject allocWithZone:]+155 (NSObject.m:445) by +[NSObject alloc]+41 (NSObject.m:432) by create+97 (main.m:29) by main+17 (main.m:38) leaked at: at free+103 by _internal_object_dispose+81 by NSDeallocateObject+223 (NSObject.m:207) by -[Container dealloc]+53 (container.m:13) by main+43 (main.m:40)
Leakpoint implementation• Implemented as a Valgrind tool (www.valgrind.org)
■ intercept libc memory management functions■ instrument binary instructions to perform propagation
![Page 38: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/38.jpg)
Leakpoint: current status
![Page 39: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/39.jpg)
Leakpoint: current status
Handle basic C / C++ / Objective C
![Page 40: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/40.jpg)
Leakpoint: current status
Handle basic C / C++ / Objective C✔
![Page 41: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/41.jpg)
Leakpoint: current status
Handle basic C / C++ / Objective C✔Handle CoreFoundation
![Page 42: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/42.jpg)
Leakpoint: current status
Handle basic C / C++ / Objective C✔Handle CoreFoundation✔
![Page 43: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/43.jpg)
Leakpoint: current status
Handle basic C / C++ / Objective C
Handle Cocoa
✔Handle CoreFoundation✔
![Page 44: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/44.jpg)
Need to investigate approximately 40false positive (probably) leak reports
• Interface Builder unarchiving
• CoreData
Leakpoint: current status
Handle basic C / C++ / Objective C
Handle Cocoa
✔Handle CoreFoundation✔
![Page 45: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/45.jpg)
Need to investigate approximately 40false positive (probably) leak reports
• Interface Builder unarchiving
• CoreData
Leakpoint: current status
Handle basic C / C++ / Objective C
Handle Cocoa
✔Handle CoreFoundation✔
64bit compatible
![Page 46: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/46.jpg)
Need to investigate approximately 40false positive (probably) leak reports
• Interface Builder unarchiving
• CoreData
Leakpoint: current status
Handle basic C / C++ / Objective C
Handle Cocoa
✔Handle CoreFoundation✔
64bit compatible✔
![Page 47: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/47.jpg)
A real leak?: _NSImageMalloc
void *_NSImageMalloc(NSZone* zone, size_t size) {
// allocate storage aligned to 32 bytes. we do this by// allocating an extra 32 bytes, finding the address in the proper// location and storing the delta in one of the previous 32 bytes.
void *unaligned = NSZoneMalloc(zone, size + BITMAP_DATA_ALIGNMENT);
if(unaligned != NULL) {uintptr_t aligned = ((uintptr_t)unaligned + BITMAP_DATA_ALIGNMENT)
& ~(BITMAP_DATA_ALIGNMENT - 1);
(unsigned char*)aligned[-1] = aligned - (uintptr_t) unaligned;return (void*)aligned;
}else {
return NULL;}
}
![Page 48: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/48.jpg)
Overhead
Powerful but expensive50 -100x overheads are common
![Page 49: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/49.jpg)
Overhead
Powerful but expensive50 -100x overheads are common
Recommended usage:run cheap tools to check for errorsrun expensive tools to diagnose errors
![Page 50: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/50.jpg)
Future work
+ Leakpoint( )
![Page 51: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/51.jpg)
Future work
Impact
+ Leakpoint( )
![Page 52: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/52.jpg)
Future work
• Apple■ new leak detection tool■ experience with dynamic taint analysis
Impact
+ Leakpoint( )
![Page 53: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/53.jpg)
Future work
• Apple■ new leak detection tool■ experience with dynamic taint analysis
• Me■ experience with Valgrind■ experience analyzing large commercial code base
Impact
+ Leakpoint( )
![Page 54: Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)](https://reader034.fdocuments.us/reader034/viewer/2022051515/553891d1550346f53d8b47e3/html5/thumbnails/54.jpg)
Questions?