MemTower: A Rust‑Based Native Memory Profiling Solution for Android

Background : The car‑infotainment version of AMap runs on heavily customized Android systems, and its core is written in C/C++ native code. Existing Android tools cover Java‑level performance but lack a complete solution for native memory analysis, especially on Android 4.x devices that still dominate the market.

1. Android Native Memory Analysis Pain Points

No support for Android 4.x.

Built‑in malloc_debug behaves inconsistently across OEM‑customized Android builds.

Hook‑based approaches (e.g., malloc / free via LD_PRELOAD ) can cause recursive malloc loops and crashes.

Previous attempts suffered from severe performance degradation, invasive instrumentation, high leak‑investigation cost, and lack of precise memory usage data.

1.2 Desired Solution

Support the majority of Android versions, including 4.x.

Non‑intrusive analysis with simultaneous detection and precise定位.

Low overhead.

Long‑duration leak stress testing.

Function‑level memory usage statistics.

2. MemTower Solution

The team selected the open‑source memory‑profiler project and rewrote it in Rust, leveraging Rust’s custom allocator feature to hook native memory operations.

2.1.1 Hook Implementation

Typical native profiling hooks malloc and free via LD_PRELOAD . MemTower uses LD_PRELOAD to preload a custom library, but avoids recursive malloc loops by replacing the default allocator with a Rust‑implemented one that forwards requests to the system.

2.1.2 High‑Performance Stack Unwinding

Two unwind strategies are employed:

Using the ELF .eh_frame section (C++ exception handling) for stack traces.

Leveraging ARM’s .ARM.exidx + .ARM.extab unwind tables.

Thread‑local caches store unwind information, dramatically reducing file‑IO during stack reconstruction.

2.1.3 Powerful Data Analysis

MemTower ships a server built with actix‑web that provides:

Time‑series views of memory usage and leaks.

Multi‑dimensional filters (by lifecycle, function, time, thread, regex) and flame‑graph generation.

RESTful APIs for easy integration.

2.2 Porting to Android

Custom Allocator

Because Android’s __libc_malloc is unavailable, MemTower resolves memory functions via dlsym and builds a Rust allocator that forwards all requests to libc, keeping Rust code transparent to the system.

Stack Unwinding Adjustments

The original C++‑based unwind required a C++ runtime, which is not guaranteed on Android 8.0‑ and earlier. The C‑only unwind path was retained.

Address‑Space Reload

MemTower monitors ELF loads/unloads using dl_iterate_phdr (available from Android 5.0) or perf’s PERF_RECORD_MMAP2 (kernel > 3.16). Reloads are triggered only when new ELF modules appear, minimizing overhead.

2.3 Improvements

Leak‑Detection Mode ( ONLY_LEAKED )

Records allocation stack frames in a trie, updates on free, stops sampling once a leak threshold (e.g., 100 MB) is reached, and writes only unreleased nodes to disk. This reduces hour‑long test data from several gigabytes to ~100 MB.

Enhanced Filtering

Added thread‑level and library‑regex filters to cope with the many navigation threads.

Memory Flame‑Graphs

Introduced allocation‑count flame‑graphs in addition to size‑based ones, and separated stacks by thread for clearer visualization.

3. Capabilities and Outlook

Supports Android 4.x, 5.1.1, and 7+ (with root or wrap.sh for non‑root).

Runs on Linux x86_64, AArch64, Arm.

Sampling modes: regular performance profiling and leak‑stress testing.

Features: high‑performance unwind, multi‑dimensional analysis, thread‑aware flame‑graphs.

The solution dramatically cuts leak‑analysis time from days to minutes and can be extended to IO‑performance profiling or other native diagnostics.