debugging - What do the different columns in the "!heap -flt -s xxxx" windbg command represent -
debugging - What do the different columns in the "!heap -flt -s xxxx" windbg command represent -
i've been doing work on high memory issues, , i've been doing lot of heap analysis in windbg, , curious different columns mean in "!heap -flt -s xxxx" command.
i read what 'size' numbers mean in windbg !heap output?, , looked in "windows internals" book, still had bunch of questions. columns , questions below.
**heap_entry** - pointer point to? how different userptr? **size** - size mean? how different usersize? **prev** - appears negative offset previous heap entry. still not sure how it's used. **flags** - there documentation on these flags? **userptr** - user pointer? in cases i've seen it's 8 bytes higher heap_entry, don't know points to. **usersize** - appears size of actual allocation. **state** - tells state of heap entry (free, busy, etc....) example: heap_entry size prev flags userptr usersize - state 0015eeb0 0044 0000 [07] 0015eeb8 00204 - (busy)
heap_entry heaps store allocated blocks in contiguous segments of memory, each allocated block starts 8-bytes header followed actual allocated data. heap_entry column address of origin of header of allocated block.
size heap manager handles blocks in multiple of 8 bytes. column number of 8 bytes chunk allocated. in sample, 0044 means block takes 0x220 bytes (0x44*8).
prev multiply per 8 have negative offset in bytes previous heap block.
flags bitmask encodes next information
0x01 - heap_entry_busy 0x02 - heap_entry_extra_present 0x04 - heap_entry_fill_pattern 0x08 - heap_entry_virtual_alloc 0x10 - heap_entry_last_entry
userptr pointer returned application heapalloc (callbed malloc/new) function. since header 8 bytes long, heap_entry +8.
usersize size passed heapalloc function.
state decoding of flags column, telling if entry busy, freed, lastly of segment, …
be aware in windows 7/2008 r2, heaps default using front-end named lfh (low fragmented heap) uses default heap manager allocate chunks in dispatched user allocated data. these heaps, userptr , usersize not point real user data. output of !heap -s
displays heaps lfh enabled.
debugging heap windbg
Comments
Post a Comment