# US 11,307,922 B2 · Application crash analysis techniques when memory dump and debug symbols are not co-located > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,922 B2 - Document ID: US11307922B2 - Status: Granted - Kind: B2 - Application number: 17/160,021 - Filed: 2021-01-27 - Published: 2021-05-20 - Granted: 2022-04-19 - Earliest claimed: 2019-01-29 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Brian Koropoff - Web page: https://patentgrep.com/patent/US11307922B2 ## CPC - G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis} - G06F 8/41: Compilation - G06F 8/61: Installation - G06F 11/0715: {in a system implementing multitasking (multitasking per se G06F9/46)} - G06F 11/0784: {Routing of error reports, e.g. with a specific transmission path or data flow} - G06F 11/366: {using diagnostics (G06F11/0703 takes precedence)} - G06F 40/169: Annotation, e.g. comment data or footnotes - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Distributed architectures that can generate a crash report without concurrent access to debug symbols and a memory dump. Besides grabbing generic information from a memory dump, which most debuggers provide (e.g., call stack traces for all threads), developer-provided scripts can grab application-specific details such as tables of open protocol client connections and so-forth. This extraction can take place at a customer site where a crash occurred and can proceed without the use of debug symbols. The extraction can generate a crash report which can be sent back from the field. Once in the hands of engineering (e.g., at a provider site where debug symbols are extant but the memory dump is not), debug symbols can then be used in an annotation phase to fill in missing details (e.g., the precise source files and line numbers corresponding to call stack traces) without access to the original crash dump. ## Claims ### Claim 1 A system, comprising: a memory that stores computer executable components; and a processor that executes computer executable instructions stored in the memory, wherein the computer executable instructions comprise: prior to receiving, from a customer device at a customer site, crash report data representative of a portion of memory dump data, compiling source code of an application, resulting in an executable file of the application and debug symbols associated with the application; receiving the crash report data, wherein the crash report data is generated in response to the debug symbols being determined not to have been locally available to the customer device; extracting, from the crash report data, a name and a machine code offset of a function being executed at a time that a crash event occurred; and in response to applying the debug symbols to the crash report data, annotating the crash report data with source file location information that specifies a line of the source code of the application being executed at the time of the crash event. ### Claim 2 (depends on 1) The system of claim 1, wherein the memory dump data is generated at the customer site in response to the crash event being determined to have occurred during execution of the application at the customer site. ### Claim 3 (depends on 1) The system of claim 1, wherein the processor is situated at a provider site that excludes the memory dump data other than the portion, and wherein a first size of the portion is at least an order of magnitude smaller than a second size of the memory dump data. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise, prior to the receiving of the crash report data, transmitting the executable file of the application to the customer device and storing the debug symbols to a provider data store that is local to the system. ### Claim 5 (depends on 1) The system of claim 1, wherein the operations further comprise determining typespec data that identifies a data structure referenced by the debug symbols, and wherein the typespec data identifies information referenced by the debug symbols that has been determined, according to a defined criterion, to be useful to diagnose a crash of the application. ### Claim 6 (depends on 5) The system of claim 5, wherein the operations further comprise, in response to applying the typespec data to the debug symbols, generating typeinfo data that is representative of configurable subset of the debug symbols. ### Claim 7 (depends on 6) The system of claim 6, wherein the operations further comprise transmitting an installation package to the customer device, wherein the installation package comprises the executable file of the application and the typeinfo data, and wherein the installation package excludes the debug symbols that are not included in the configurable subset represented by the typeinfo data. ### Claim 8 (depends on 7) The system of claim 7, wherein a first size of the debug symbols is at least an order of magnitude larger than a second size of the typeinfo data. ### Claim 9 (depends on 7) The system of claim 7, wherein the installation package further comprises script data indicative of instructions for extraction of relevant information identified by the typeinfo data from the memory dump data. ### Claim 10 (depends on 9) The system of claim 9, wherein the script data is determined during generation of the source code of the application. ### Claim 11 (depends on 9) The system of claim 9, wherein the script data is determined or updated following the compiling of the source code of the application. ### Claim 12 (depends on 9) The system of claim 9, wherein the script data is determined by a creator of the application. ### Claim 13 A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising: prior to receiving, from a customer device at a customer site, crash report data representative of a portion of memory dump data, compiling source code of an application, resulting in an executable file of the application and debug symbols associated with the application; receiving the crash report data, wherein the crash report data is generated in response to the debug symbols not being locally available to the customer device; extracting, from the crash report data, a name and a machine code offset of a function being executed at a time that a crash event occurred; and in response to applying the debug symbols to the crash report data, annotating the crash report data with source file location information that specifies a line of the source code of the application being executed at the time of the crash event. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the memory dump data is generated at the customer site in response to the crash event having occurred during execution of the application at the customer site. ### Claim 15 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the processor is located at a provider site that excludes the memory dump data other than the portion, and wherein a first size of the memory dump data is at least a defined order of magnitude larger than a second size of the portion of the memory dump data. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the portion is specified by typeinfo data that is representative of a configurable subset of the debug symbols that was generated in response to compiling the source code for the application. ### Claim 17 A method, comprising: prior to receiving crash report data, compiling, by a device comprising a processor, source code, the compiling resulting in generation of an executable file of an application and debug symbols associated with the application; receiving, by the device, the crash report data from a customer site, wherein the crash report is representative of a portion of memory dump data and the crash report data is generated in response to the debug symbols not being locally available to the customer device; extracting, by the device and from the crash report data, a name and a machine code offset of a function being executed at a time that a crash event occurred; and in response to applying the debug symbols to the crash report data, annotating, by the device, the crash report data with source file location information that specifies a line of the source code of the application being executed at the time of the crash event. ### Claim 18 (depends on 17) The method of claim 17, further comprising, prior to receiving the crash report data, transmitting, by the device, the executable file of the application to the customer device and storing the debug symbols to a provider data store that is local to the device. ### Claim 19 (depends on 17) The method of claim 17, further comprising determining, by the device, typespec data that identifies a data structure referenced by the debug symbols, wherein the typespec data identifies information referenced by the debug symbols that has been determined to be useful to diagnose a crash of the application. ### Claim 20 (depends on 19) The method of claim 19, further comprising, in response to applying the typespec data to the debug symbols, generating, by the device, typeinfo data that is representative of configurable subset of the debug symbols.