WinXP SP3
如果同时用gflag.exe打开 +ust +hpa的话
ust - Create user mode stack trace database hpa - Enable page heap
我发现好像ust没有用处,无法用!heap -p -a得到stack trace了
0:000> !gflag Current NtGlobalFlag contents: 0x02000000 hpa - Place heap allocations at ends of pages 0:000> !heap -p -a 0x01638fd0 ReadMemory error for address eeddccee Use `!address eeddccee' to check validity of the address.
如果只是用ust的话,可以得到stack trace
0:000> !gflag Current NtGlobalFlag contents: 0x00001040 hpc - Enable heap parameter checking ust - Create user mode stack trace database
0:000> !heap -p -a 0x00344f58 address 00344f58 found in _HEAP @ 340000 HEAP_ENTRY Size Prev Flags UserPtr UserSize - state 00344f30 000d 0000 [07] 00344f38 0004c - (busy) Trace: 0026 7c96eed2 ntdll!RtlDebugAllocateHeap+0x000000e1 7c94b394 ntdll!RtlAllocateHeapSlowly+0x00000044 7c918f21 ntdll!RtlAllocateHeap+0x00000e64 102c163e MSVCR90D!malloc_base+0x000000ee 102d0336 MSVCR90D!malloc_dbg+0x00000306 102d00ef MSVCR90D!malloc_dbg+0x000000bf 102d009c MSVCR90D!malloc_dbg+0x0000006c 102db7bb MSVCR90D!malloc+0x0000001b 102bdc91 MSVCR90D!operator new+0x00000011 411aac HeapExample!fuc1+0x0000002c 411443 HeapExample!wmain+0x00000023 4119d8 HeapExample!__tmainCRTStartup+0x000001a8 41181f HeapExample!wmainCRTStartup+0x0000000f 7c817077 kernel32!BaseProcessStart+0x00000023
|