Ichnaea: A Framework for Precise Tracking of Memory Objects
Talkat 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26) · 2026-07-13..07-15·
summary
A framework that uses memory protection keys and a user-space page-fault handler to log per-access context (accessor, value, timestamp, call stack) and emulates faulting instructions before resuming, implemented via compile-time weak refs and LD_PRELOAD runtime. Permission switches cost ~50–100 ns versus >2 μs for mprotect, so tracing adds 1–3× overhead while Intel Pin costs 12–60×; overhead grows ~2% per traced object; does not trace stack objects and has partial kernel-read coverage.
AI-written summary · about
chapters (16)
- 0:00Ichnaea framework intro
- 1:24Precise memory tracking problem
- 2:07Ideal tracing framework requirements
- 2:50Static analysis limitations
- 3:32Static instrumentation flaws
- 4:33Dynamic analysis challenges
- 5:37Page protection overview
- 6:39mprotect benefits and drawbacks
- 8:23Memory protection keys solution
- 9:28Ichnaea design introduction
- 10:32Ichnaea edge cases
- 11:34Ichnaea performance evaluation
- 12:18Ichnaea concurrency analysis
- 12:58Ichnaea scaling overhead
- 13:19Ichnaea limitations and caveats
- 13:39Ichnaea summary
related talks
24mLow-overhead memory allocation tracking
34mTracing: The Bane of You Security Folks
59mThe Magic of a Trace
39mCPU isolation vs jailbreaking IPIs
15mMemoryTrap: Booby Trapping Memory to Counter Memory Disclosure Attacks with...
38mKernel Hardening: Protecting the Protection Mechanisms
32mRISC-V ftrace: working with preemption
01h 02mObject Introspection: A C++ Memory Profiler