$ show yanqi27/core_analyzer
Core Analyzer is a production-grade memory debugging tool that integrates with GDB (as a plugin) and WinDbg (as an extension) to provide deep heap introspection, object reference tracking, and memory corruption detection for core dumps and live processes. It supports multiple heap allocators (glibc ptmalloc, tcmalloc, jemalloc, mimalloc, Windows CRT, Darwin malloc) by parsing their internal metadata structures directly from target memory. The tool offers commands to walk heap blocks, search for pointer references across registers/stack/globals/heap, detect C++ objects via vtables, find shared objects across threads (race condition candidates), and annotate disassembly with object context. The architecture is a plugin system where each allocator registers a `CoreAnalyzerHeapInterface` struct, and the core engine provides segment management, binary-search-accelerated block lookup, and bit-vector-optimized memory scanning. The codebase is heavily coupled to debugger internals (GDB C API, WinDbg COM) and maintains separate source copies for multiple GDB versions (9.2, 12.1, 16.3, 17.1), which increases maintenance burden but ensures compatibility. The project includes a comprehensive test suite using Docker containers across Linux distributions and allocator versions.
The LLM identified 2 files worth highlighting for reuse:
Provides a generic memory segment abstraction (`ca_segment`) that represents contiguous virtual address ranges with file mappings, permissions, and a pointer bit vector for fast scanning. Segments are stored in a sorted array and looked up via binary search. The `read_memory_wrapper` abstracts reading from core files or live inferior. This component is the foundation for all memory operations and could be extracted into a standalone library with a pluggable memory reader interface.
Implements a static instruction tracer that disassembles x86-64 functions and propagates register values, symbols, and types across instructions. It handles mov, lea, arithmetic, branches, push/pop, and call/ret, building a register table per PC. The output annotates disassembly with object context (heap blocks, stack variables, global symbols). This pattern is reusable in any debugger or binary analysis tool that needs to track data flow through instructions, though the current implementation is tied to GDB's disassembler and memory reading.