Advanced Windows Debugging

Author: Mario Hewardt, Daniel Pravat
All Stack Overflow 21


by anonymous   2017-08-20

From looking at the !heap documentation in the Debugging Tools for Windows help file and the heap docs on MSDN and a great excerpt from Advanced Windows Debugging, here's what I've been able to put together:

  • HEAP_ENTRY: pointer to entry within the heap. As you found, there is an 8 byte header which contains the data for the HEAP_ENTRY structure. The size of the HEAP_ENTRY structure is 8 bytes which defines the "heap granularity" size. This is used for determining the...
  • SIZE: size of the entry in terms of the granularity (i.e. the allocation size / 8)
  • FLAGS: these are defined in winbase.h with explanations found the in MSDN link.
  • USERPTR: the actual pointer to the allocated (or freed) object
by anonymous   2017-08-20

You can, however see another process's memory you do need to be in kernel mode. The API makes it easy to do from User mode. Your choice.

Kernel mode stuff and useful links I've grabbed quickly:

by anonymous   2017-08-20

Try AppVerifier and GFlags together to find Page Heap corruption.

You'll likely need WinDbg as your debugger instead of Visual Studio to debug.

I also recommend this book on advanced Windows debugging for tracking down crashes such as the one you are hitting.