According to one embodiment, a method, computer system, and computer program product for memory corruption diagnosis is provided. The present invention may include generating a pattern expression (PE) header file, wherein a plurality of common datatypes associated with a software program are pre-defined. The invention may further include generating a PE for each of the plurality of common datatypes, and generating a PE table by merging the generated PEs for each of the plurality of common datatypes. Upon discovery that memory corruption has occurred, the invention may include transmitting a recorded state of the software program as a core dump file to a server, and using a dump utility to identify overlay content of the core dump file. Lastly, the invention may include identifying a possible source program of the memory corruption by matching the PE tables against the illegally-written overlay content.