Windows C++代码heap分析详解

上次写了一篇文章，Windows代码heap内存分析实战

由于时间的关系，写的不是很详细，于是有朋友建议写的详细些，于是有了本文。

Windows C++代码heap分析详解

Windows代码占用的内存主要是堆和栈，其中栈内存又被称为自动内存，一般为系统自动管理，所以常见的问题主要发生在堆内存上。系统中如果分配了堆内存而不释放，或者错误释放，都会产生问题。

首先来分析一下堆内存的主要结构：

对于普通的堆：

1. CreateHeap -> creates a _HEAP

2. AllocHeap -> creates a _HEAP_ENTRY

对于页堆 (gflags.exe /i +hpa)：

1. CreateHeap -> creates a _DPH_HEAP_ROOT (+ _HEAP + 2x _HEAP_ENTRY)

2. AllocHeap -> creates a _DPH_HEAP_BLOCK

也就是说对于页堆，有额外的数据表征其内容，当让，对于同样堆分析命令，对于两种堆也会输出不同的内容。

对于普通的堆，分别执行的分析命令和结果如下：

0:001> !heap -s

NtGlobalFlag enables following debugging aids for new heaps:

validate parameters

stack back traces

Heap Flags Reserv Commit Virt Free List UCR Virt Lock Fast

(k) (k) (k) (k) length blocks cont. heap

-----------------------------------------------------------------------------

00170000 58000062 1024 64 64 12 3 1 0 0 L

00270000 58001062 64 24 24 11 1 1 0 0 L

00280000 58008060 64 12 12 10 1 1 0 0

00370000 58001062 64 28 28 9 1 1 0 0 L

00390000 58001062 64 56 56 5 2 1 0 0

003a0000 58001062 1088 72 72 16 3 2 0 0 L

003f0000 58001062 64 20 20 5 2 1 0 0 L

01a20000 58001062 64 20 20 1 1 1 0 0 L

02090000 58001062 64 12 12 4 1 1 0 0 L

-----------------------------------------------------------------------------

0:001> !heap -p

Active GlobalFlag bits:

hpc - Enable heap parameter checking

ust - Create user mode stack trace database

StackTraceDataBase @ 00430000 of size 01000000 with 0000037f traces

active heaps:

- 170000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED

- 270000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

- 280000

HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_8

- 370000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

- 390000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

- 3a0000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

- 3f0000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

- 1a20000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

- 2090000

HEAP_GROWABLE HEAP_TAIL_CHECKING_ENABLED HEAP_FREE_CHECKING_ENABLED HEAP_CLASS_1

0:001> !heap -stat

_HEAP 003a0000

Segments 00000002

Reserved bytes 00110000

Committed bytes 00012000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 00170000

Segments 00000001

Reserved bytes 00100000

Committed bytes 00010000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 00390000

Segments 00000001

Reserved bytes 00010000

Committed bytes 0000e000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 00370000

Segments 00000001

Reserved bytes 00010000

Committed bytes 00007000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 00270000

Segments 00000001

Reserved bytes 00010000

Committed bytes 00006000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 01a20000

Segments 00000001

Reserved bytes 00010000

Committed bytes 00005000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 003f0000

Segments 00000001

Reserved bytes 00010000

Committed bytes 00005000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 02090000

Segments 00000001

Reserved bytes 00010000

Committed bytes 00003000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

_HEAP 00280000

Segments 00000001

Reserved bytes 00010000

Committed bytes 00003000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

对于页堆堆，分别执行的分析命令和结果如下：

0:001> !heap -s

Heap Flags Reserv Commit Virt Free List UCR Virt Lock Fast

(k) (k) (k) (k) length blocks cont. heap

-----------------------------------------------------------------------------

00270000 00000002 1024 12 12 4 1 1 0 0 L

00380000 00001002 64 24 24 16 1 1 0 0 L

00390000 00008000 64 12 12 10 1 1 0 0

003e0000 00001002 64 12 12 4 1 1 0 0 L

018e0000 00001002 64 12 12 4 1 1 0 0 L

01ad0000 00001002 64 32 32 24 1 1 0 0 L

02020000 00001002 64 12 12 4 1 1 0 0 L

02130000 00001002 64 12 12 4 1 1 0 0 L

02bd0000 00001002 64 12 12 4 1 1 0 0 L

02ce0000 00001002 64 12 12 4 1 1 0 0 L

-----------------------------------------------------------------------------

0:001> !heap -p

Active GlobalFlag bits:

hpa - Place heap allocations at ends of pages

StackTraceDataBase @ 00430000 of size 01000000 with 00000376 traces

PageHeap enabled with options:

ENABLE_PAGE_HEAP

COLLECT_STACK_TRACES

active heaps:

+ 170000

ENABLE_PAGE_HEAP COLLECT_STACK_TRACES

NormalHeap - 270000

HEAP_GROWABLE

ReadMemory error for address eeddccee

Use `!address eeddccee' to check validity of the address.

0:001> !heap -stat

ReadMemory error for address eeddccee

Use `!address eeddccee' to check validity of the address.

_HEAP 00170000

Segments 00000001

Reserved bytes 00100000

Committed bytes 00003000

VirtAllocBlocks 00000000

VirtAlloc bytes 00000000

从分析结果我们可以看出!heap -p 命令对于不同的堆输出的内容是不同的，对于普通的堆，!heap –s 和!heap –p 产生相同的地址，而对于页堆，他们的输出就有了显著的不同 。另外对于普通的堆，heap handle和heap address 一样，而对于页堆，其也有很大的区别。

另外值得一提的是!heap –p –a 这条神奇命令，别看这条命令带-p 其实这条命令根本不需要开启页堆选项，只要有 +ust就行了

!heap -p -a [UserAddr....UserAddr+AlloSize]

正常情况下这条命令可以打相应的callstack.