You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1484 lines
40 KiB
1484 lines
40 KiB
|
|
/*++
|
|
|
|
Copyright (c) 2000 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
heapleak.c
|
|
|
|
Abstract:
|
|
|
|
WinDbg Extension Api
|
|
|
|
Author:
|
|
|
|
Adrian Marinescu (adrmarin) 04/17/2000
|
|
|
|
Environment:
|
|
|
|
User Mode.
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
|
|
#include "precomp.h"
|
|
#include "heap.h"
|
|
#pragma hdrstop
|
|
|
|
|
|
ULONG64 AddressToFind;
|
|
|
|
ULONG64 HeapAddressFind;
|
|
ULONG64 SegmentAddressFind;
|
|
ULONG64 HeapEntryFind;
|
|
ULONG64 HeapEntryFindSize;
|
|
BOOLEAN Lookaside;
|
|
|
|
BOOLEAN VerifyBlocks;
|
|
|
|
ULONG64 DumpOptions = 0xffffff;
|
|
|
|
#define HEAP_DUMP_FREE_LISTS 1
|
|
#define HEAP_DUMP_GFLAGS 2
|
|
#define HEAP_DUMP_GTAGS 4
|
|
#define HEAP_DUMP_FREE_LISTS_DETAILS 8
|
|
|
|
BOOLEAN ScanVM;
|
|
|
|
ULONG
|
|
GetFieldSize (
|
|
IN LPCSTR Type,
|
|
IN LPCSTR Field
|
|
)
|
|
{
|
|
FIELD_INFO flds = {(PUCHAR)Field, NULL, 0, DBG_DUMP_FIELD_FULL_NAME, 0, NULL};
|
|
|
|
SYM_DUMP_PARAM Sym = {
|
|
sizeof (SYM_DUMP_PARAM), (PUCHAR)Type, DBG_DUMP_NO_PRINT, 0,
|
|
NULL, NULL, NULL, 1, &flds
|
|
};
|
|
|
|
ULONG RetVal;
|
|
|
|
RetVal = Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );
|
|
|
|
return flds.size;
|
|
}
|
|
|
|
|
|
ULONG
|
|
ReadLongValue(LPTSTR Symbol)
|
|
{
|
|
ULONG64 Address;
|
|
ULONG Value = 0;
|
|
|
|
Address = GetExpression( Symbol );
|
|
|
|
if ( (Address == 0) ||
|
|
!ReadMemory( Address, &Value, sizeof( Value ), NULL )) {
|
|
|
|
dprintf( "HEAPEXT: Unable to read %s\n", Symbol );
|
|
}
|
|
|
|
return Value;
|
|
}
|
|
|
|
|
|
|
|
#define CheckAndPrintFlag(x)\
|
|
if (Flags & (x)) dprintf(#x" ");
|
|
|
|
void
|
|
DumpFlagDescription(ULONG Flags)
|
|
{
|
|
CheckAndPrintFlag(HEAP_NO_SERIALIZE);
|
|
CheckAndPrintFlag(HEAP_GROWABLE);
|
|
CheckAndPrintFlag(HEAP_GENERATE_EXCEPTIONS);
|
|
CheckAndPrintFlag(HEAP_ZERO_MEMORY);
|
|
CheckAndPrintFlag(HEAP_REALLOC_IN_PLACE_ONLY);
|
|
CheckAndPrintFlag(HEAP_TAIL_CHECKING_ENABLED);
|
|
CheckAndPrintFlag(HEAP_FREE_CHECKING_ENABLED);
|
|
CheckAndPrintFlag(HEAP_DISABLE_COALESCE_ON_FREE);
|
|
CheckAndPrintFlag(HEAP_CREATE_ALIGN_16);
|
|
CheckAndPrintFlag(HEAP_CREATE_ENABLE_TRACING);
|
|
}
|
|
|
|
void
|
|
DumpEntryFlagDescription(ULONG Flags)
|
|
{
|
|
if (Flags & HEAP_ENTRY_BUSY) dprintf("busy "); else dprintf("free ");
|
|
if (Flags & HEAP_ENTRY_EXTRA_PRESENT) dprintf("extra ");
|
|
if (Flags & HEAP_ENTRY_FILL_PATTERN) dprintf("fill ");
|
|
if (Flags & HEAP_ENTRY_VIRTUAL_ALLOC) dprintf("virtual ");
|
|
if (Flags & HEAP_ENTRY_LAST_ENTRY) dprintf("last ");
|
|
if (Flags & HEAP_ENTRY_SETTABLE_FLAGS) dprintf("user_flag ");
|
|
}
|
|
|
|
void
|
|
DumpEntryHeader()
|
|
{
|
|
dprintf("Entry User Heap Segment Size PrevSize Flags\n");
|
|
dprintf("----------------------------------------------------------------------\n");
|
|
}
|
|
|
|
void
|
|
DumpEntryInfo(
|
|
IN ULONG64 HeapAddress,
|
|
IN ULONG64 SegmentAddress,
|
|
ULONG64 EntryAddress
|
|
)
|
|
{
|
|
ULONG SizeOfEntry;
|
|
ULONG PreviousSize;
|
|
ULONG Flags;
|
|
ULONG Size;
|
|
UCHAR SegmentIndex;
|
|
UCHAR SmallTagIndex;
|
|
|
|
SizeOfEntry = GetTypeSize("nt!_HEAP_ENTRY"); // same as granularity
|
|
InitTypeRead(EntryAddress, nt!_HEAP_ENTRY);
|
|
|
|
PreviousSize = (ULONG)ReadField(PreviousSize) * SizeOfEntry;
|
|
Size = (ULONG) ReadField(Size) * SizeOfEntry;
|
|
Flags = (ULONG) ReadField(Flags);
|
|
SegmentIndex = (UCHAR) ReadField(SegmentIndex);
|
|
SmallTagIndex = (UCHAR) ReadField(SmallTagCode);
|
|
|
|
if (SegmentIndex != 0xff) {
|
|
|
|
dprintf("%p %p %p %p %8lx %8lx ",
|
|
EntryAddress,
|
|
EntryAddress + SizeOfEntry,
|
|
HeapAddress,
|
|
SegmentAddress,
|
|
Size,
|
|
PreviousSize
|
|
);
|
|
|
|
DumpEntryFlagDescription(Flags);
|
|
|
|
if (Lookaside) {
|
|
dprintf(" - lookaside ");
|
|
}
|
|
|
|
} else {
|
|
|
|
ULONG64 SubSegment = ReadField(SubSegment);
|
|
ULONG64 BlockSize;
|
|
|
|
GetFieldValue(SubSegment, "ntdll!_HEAP_SUBSEGMENT", "BlockSize", BlockSize);
|
|
|
|
Size = (ULONG)BlockSize * SizeOfEntry;
|
|
|
|
dprintf("%p %p %p %p %8lx - ",
|
|
EntryAddress,
|
|
EntryAddress + SizeOfEntry,
|
|
HeapAddress,
|
|
SegmentAddress,
|
|
Size
|
|
);
|
|
|
|
if (SmallTagIndex) {
|
|
|
|
dprintf("LFH_BUSY; ");
|
|
} else {
|
|
dprintf("LFH_FREE; ");
|
|
}
|
|
DumpEntryFlagDescription(Flags);
|
|
}
|
|
|
|
dprintf("\n");
|
|
}
|
|
|
|
void
|
|
DumpHeapStructure (ULONG64 HeapAddress)
|
|
{
|
|
ULONG AlignRound, Offset;
|
|
|
|
if (InitTypeRead(HeapAddress, nt!_HEAP)) {
|
|
|
|
return;
|
|
}
|
|
|
|
GetFieldOffset("nt!_HEAP", "VirtualAllocdBlocks", &Offset);
|
|
AlignRound = (ULONG)ReadField(AlignRound) - GetTypeSize( "nt!_HEAP_ENTRY" );
|
|
|
|
if ((ULONG)ReadField(Flags) & HEAP_TAIL_CHECKING_ENABLED) {
|
|
|
|
AlignRound -= CHECK_HEAP_TAIL_SIZE;
|
|
}
|
|
|
|
AlignRound += 1;
|
|
|
|
dprintf( " Flags: %08x ", (ULONG)ReadField(Flags) );
|
|
DumpFlagDescription((ULONG)ReadField(Flags)); dprintf("\n");
|
|
|
|
dprintf( " ForceFlags: %08x ", (ULONG)ReadField(ForceFlags) );
|
|
DumpFlagDescription((ULONG)ReadField(ForceFlags)); dprintf("\n");
|
|
|
|
dprintf( " Granularity: %u bytes\n", AlignRound );
|
|
dprintf( " Segment Reserve: %08x\n", (ULONG)ReadField(SegmentReserve));
|
|
dprintf( " Segment Commit: %08x\n", (ULONG)ReadField(SegmentCommit) );
|
|
dprintf( " DeCommit Block Thres:%08x\n", (ULONG)ReadField(DeCommitFreeBlockThreshold) );
|
|
dprintf( " DeCommit Total Thres:%08x\n", (ULONG)ReadField(DeCommitTotalFreeThreshold) );
|
|
dprintf( " Total Free Size: %08x\n", (ULONG)ReadField(TotalFreeSize) );
|
|
dprintf( " Max. Allocation Size:%08x\n", (ULONG)ReadField(MaximumAllocationSize) );
|
|
dprintf( " Lock Variable at: %p\n", ReadField(LockVariable) );
|
|
dprintf( " Next TagIndex: %04x\n", (ULONG)ReadField(NextAvailableTagIndex) );
|
|
dprintf( " Maximum TagIndex: %04x\n", (ULONG)ReadField(MaximumTagIndex) );
|
|
dprintf( " Tag Entries: %08x\n", (ULONG)ReadField(TagEntries) );
|
|
dprintf( " PsuedoTag Entries: %08x\n", (ULONG)ReadField(PseudoTagEntries) );
|
|
dprintf( " Virtual Alloc List: %p\n", HeapAddress + Offset);
|
|
|
|
if (DumpOptions & (HEAP_DUMP_FREE_LISTS | HEAP_DUMP_FREE_LISTS_DETAILS)) {
|
|
|
|
ULONG i, ListSize, FreeListOffset;
|
|
|
|
dprintf( " FreeList Usage: %08x %08x %08x %08x\n",
|
|
(ULONG)ReadField(u.FreeListsInUseUlong[0]),
|
|
(ULONG)ReadField(u.FreeListsInUseUlong[1]),
|
|
(ULONG)ReadField(u.FreeListsInUseUlong[2]),
|
|
(ULONG)ReadField(u.FreeListsInUseUlong[3])
|
|
);
|
|
|
|
GetFieldOffset ("nt!_HEAP", "FreeLists", &Offset);
|
|
ListSize = GetTypeSize("nt!_LIST_ENTRY");
|
|
GetFieldOffset ("nt!_HEAP_FREE_ENTRY", "FreeList", &FreeListOffset);
|
|
|
|
for (i=0; i<HEAP_MAXIMUM_FREELISTS; i++) {
|
|
|
|
ULONG64 Flink, Blink, Next;
|
|
ULONG64 FreeListHead;
|
|
ULONG Count = 0;
|
|
ULONG MinSize = 0, MaxSize = 0;
|
|
|
|
FreeListHead = HeapAddress + Offset + ListSize * i;
|
|
|
|
GetFieldValue(FreeListHead, "nt!_LIST_ENTRY", "Flink", Flink);
|
|
GetFieldValue(FreeListHead, "nt!_LIST_ENTRY", "Blink", Blink);
|
|
|
|
if (Flink != FreeListHead) {
|
|
|
|
dprintf( " FreeList[ %02x ] at %08p",
|
|
i,
|
|
FreeListHead
|
|
);
|
|
|
|
if (DumpOptions & HEAP_DUMP_FREE_LISTS_DETAILS) {
|
|
|
|
dprintf("\n");
|
|
}
|
|
|
|
Next = Flink;
|
|
while (Next != FreeListHead) {
|
|
|
|
ULONG Size, PrevSize, Flags;
|
|
ULONG64 FreeEntryAddress;
|
|
|
|
FreeEntryAddress = Next - FreeListOffset;
|
|
|
|
if (InitTypeRead ( FreeEntryAddress, nt!_HEAP_FREE_ENTRY)) {
|
|
|
|
if (Count) {
|
|
dprintf( " Total: %ld blocks (%08lx, %08lx) * Error reading %p\n",
|
|
Count,
|
|
MinSize,
|
|
MaxSize,
|
|
FreeEntryAddress
|
|
);
|
|
} else {
|
|
dprintf( " No blocks in list. Error reading %p\n",
|
|
FreeEntryAddress
|
|
);
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
Size = (ULONG)ReadField(Size) * AlignRound;
|
|
PrevSize = (ULONG)ReadField(PreviousSize) * AlignRound;
|
|
Flags = (ULONG)ReadField(Flags);
|
|
|
|
if (!Count) {
|
|
|
|
MinSize = MaxSize = Size;
|
|
|
|
} else {
|
|
|
|
if (Size < MinSize) MinSize = Size;
|
|
if (Size > MaxSize) MaxSize = Size;
|
|
}
|
|
|
|
if (DumpOptions & HEAP_DUMP_FREE_LISTS_DETAILS) {
|
|
|
|
dprintf( " %08p: %05x . %05x [%02x] - ",
|
|
FreeEntryAddress,
|
|
PrevSize,
|
|
Size,
|
|
Flags
|
|
);
|
|
|
|
DumpEntryFlagDescription(Flags);
|
|
|
|
dprintf("\n");
|
|
}
|
|
|
|
Count += 1;
|
|
|
|
ReadPointer(Next, &Next);
|
|
|
|
if (CheckControlC()) {
|
|
return;
|
|
}
|
|
}
|
|
|
|
if (Count) {
|
|
|
|
if (DumpOptions & HEAP_DUMP_FREE_LISTS_DETAILS) {
|
|
|
|
dprintf(" ");
|
|
}
|
|
|
|
dprintf( " * Total %ld block(s) (%08lx, %08lx)\n",
|
|
Count,
|
|
MinSize,
|
|
MaxSize
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
void
|
|
DumpGlobals()
|
|
{
|
|
ULONG64 pNtGlobalFlag, NtGlobalFlag = 0;
|
|
ULONG64 pNtTempGlobal, NtTempGlobal = 0;
|
|
|
|
NtGlobalFlag = ReadLongValue("NTDLL!NtGlobalFlag");
|
|
|
|
if ((NtGlobalFlag & (FLG_HEAP_ENABLE_TAIL_CHECK |
|
|
FLG_HEAP_ENABLE_FREE_CHECK |
|
|
FLG_HEAP_VALIDATE_PARAMETERS |
|
|
FLG_HEAP_VALIDATE_ALL |
|
|
FLG_HEAP_ENABLE_TAGGING |
|
|
FLG_USER_STACK_TRACE_DB |
|
|
FLG_HEAP_DISABLE_COALESCING )) != 0 ) {
|
|
|
|
dprintf( "NtGlobalFlag enables following debugging aids for new heaps:" );
|
|
|
|
if (NtGlobalFlag & FLG_HEAP_ENABLE_TAIL_CHECK) {
|
|
dprintf( " tail checking\n" );
|
|
}
|
|
|
|
if (NtGlobalFlag & FLG_HEAP_ENABLE_FREE_CHECK) {
|
|
dprintf( " free checking\n" );
|
|
}
|
|
|
|
if (NtGlobalFlag & FLG_HEAP_VALIDATE_PARAMETERS) {
|
|
dprintf( " validate parameters\n" );
|
|
}
|
|
|
|
if (NtGlobalFlag & FLG_HEAP_VALIDATE_ALL) {
|
|
dprintf( " validate on call\n" );
|
|
}
|
|
|
|
if (NtGlobalFlag & FLG_HEAP_ENABLE_TAGGING) {
|
|
dprintf( " heap tagging\n" );
|
|
}
|
|
|
|
if (NtGlobalFlag & FLG_USER_STACK_TRACE_DB) {
|
|
dprintf( " stack back traces\n" );
|
|
}
|
|
|
|
if (NtGlobalFlag & FLG_HEAP_DISABLE_COALESCING) {
|
|
dprintf( " disable coalescing of free blocks\n" );
|
|
}
|
|
}
|
|
|
|
NtTempGlobal = ReadLongValue( "NTDLL!RtlpDisableHeapLookaside" );
|
|
|
|
if (NtTempGlobal) {
|
|
|
|
dprintf( "The process has the following heap extended settings %08lx:\n", (ULONG)NtTempGlobal );
|
|
|
|
if (NtTempGlobal & 1) {
|
|
|
|
dprintf(" - Lookasides disabled\n");
|
|
}
|
|
|
|
if (NtTempGlobal & 2) {
|
|
|
|
dprintf(" - Large blocks cache disabled\n");
|
|
}
|
|
|
|
if (NtTempGlobal & 8) {
|
|
|
|
dprintf(" - Low Fragmentation Heap activated for all heaps\n");
|
|
}
|
|
|
|
dprintf("\n");
|
|
}
|
|
|
|
pNtTempGlobal = GetExpression( "NTDLL!RtlpAffinityState" );
|
|
|
|
if ( pNtTempGlobal ) {
|
|
|
|
ULONG64 TempValue;
|
|
ULONG64 AffinitySwaps;
|
|
ULONG64 AffinityResets;
|
|
ULONG64 AffinityAllocs;
|
|
|
|
GetFieldValue(pNtTempGlobal, "ntdll!_AFFINITY_STATE", "Limit", TempValue);
|
|
|
|
if (TempValue) {
|
|
|
|
dprintf("Affinity manager status:\n");
|
|
dprintf(" - Virtual affinity limit %I64ld\n", TempValue);
|
|
|
|
GetFieldValue(pNtTempGlobal, "ntdll!_AFFINITY_STATE", "CrtLimit", TempValue);
|
|
dprintf(" - Current entries in use %ld\n", (LONG)TempValue);
|
|
|
|
GetFieldValue(pNtTempGlobal, "ntdll!_AFFINITY_STATE", "AffinitySwaps", AffinitySwaps);
|
|
GetFieldValue(pNtTempGlobal, "ntdll!_AFFINITY_STATE", "AffinityResets", AffinityResets);
|
|
GetFieldValue(pNtTempGlobal, "ntdll!_AFFINITY_STATE", "AffinityAllocs", AffinityAllocs);
|
|
|
|
dprintf(" - Statistics: Swaps=%I64ld, Resets=%I64ld, Allocs=%I64ld\n\n",
|
|
AffinitySwaps,
|
|
AffinityResets,
|
|
AffinityAllocs
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
BOOLEAN HeapFindRoutine(
|
|
IN ULONG Context,
|
|
IN ULONG64 HeapAddress,
|
|
IN ULONG64 SegmentAddress,
|
|
IN ULONG64 EntryAddress,
|
|
IN ULONG64 Data
|
|
)
|
|
{
|
|
switch (Context) {
|
|
|
|
case CONTEXT_START_HEAP:
|
|
|
|
//
|
|
// we found a block, we won't need then to search in other heaps
|
|
//
|
|
|
|
if (HeapEntryFind) {
|
|
ScanLevel = 0;
|
|
}
|
|
|
|
break;
|
|
|
|
case CONTEXT_FREE_BLOCK:
|
|
case CONTEXT_BUSY_BLOCK:
|
|
case CONTEXT_LOOKASIDE_BLOCK:
|
|
case CONTEXT_VIRTUAL_BLOCK:
|
|
|
|
if ((AddressToFind >= EntryAddress) &&
|
|
(AddressToFind < (EntryAddress + Data))) {
|
|
|
|
if (HeapEntryFind == 0) {
|
|
|
|
HeapAddressFind = HeapAddress;
|
|
SegmentAddressFind = SegmentAddress;
|
|
}
|
|
|
|
if (Context == CONTEXT_LOOKASIDE_BLOCK) {
|
|
|
|
Lookaside = TRUE;
|
|
|
|
ScanLevel = 0;
|
|
}
|
|
|
|
HeapEntryFind = EntryAddress;
|
|
HeapEntryFindSize = Data;
|
|
}
|
|
|
|
break;
|
|
|
|
case CONTEXT_ERROR:
|
|
|
|
dprintf("HEAP %p (Seg %p) At %p Error: %s\n",
|
|
HeapAddress,
|
|
SegmentAddress,
|
|
EntryAddress,
|
|
(LPSTR) (ULONG_PTR) Data
|
|
);
|
|
|
|
break;
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
BOOLEAN
|
|
SearchVMReference (
|
|
HANDLE hProcess,
|
|
ULONG64 Base,
|
|
ULONG64 EndAddress
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
SIZE_T BufferLen;
|
|
ULONG_PTR lpAddress = 0;
|
|
MEMORY_BASIC_INFORMATION Buffer;
|
|
PVOID MemoryBuffer;
|
|
|
|
if ( hProcess ) {
|
|
|
|
MemoryBuffer = malloc(PageSize);
|
|
|
|
if (!MemoryBuffer) {
|
|
|
|
dprintf("Not enough memory. Abording.\n");
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
dprintf("Search VM for address range %p - %p : ",Base, EndAddress);
|
|
|
|
BufferLen = sizeof(Buffer);
|
|
|
|
while (BufferLen) {
|
|
|
|
BufferLen = VirtualQueryEx( hProcess,
|
|
(LPVOID)lpAddress,
|
|
&Buffer,
|
|
sizeof(Buffer)
|
|
);
|
|
|
|
if (BufferLen) {
|
|
|
|
if ((Buffer.AllocationProtect & (PAGE_READWRITE | PAGE_EXECUTE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_WRITECOPY)) /*&&
|
|
(Buffer.Type == MEM_PRIVATE)*/) {
|
|
|
|
ULONG64 NumPages;
|
|
ULONG i, j;
|
|
|
|
NumPages = Buffer.RegionSize / PageSize;
|
|
|
|
for (i = 0; i < NumPages; i++) {
|
|
|
|
if (ReadMemory( (ULONG64)(lpAddress + i * PageSize),
|
|
MemoryBuffer,
|
|
PageSize,
|
|
NULL
|
|
)) {
|
|
|
|
ULONG_PTR * Pointers = (ULONG_PTR *)MemoryBuffer;
|
|
|
|
for (j = 0; j < PageSize/sizeof(ULONG_PTR); j++) {
|
|
|
|
ULONG_PTR Address = lpAddress + i * PageSize + j * sizeof(ULONG_PTR);
|
|
|
|
if ((*Pointers >= Base) &&
|
|
(*Pointers <= EndAddress)) {
|
|
|
|
dprintf("%08lx (%08lx), ",
|
|
Address,
|
|
*Pointers
|
|
);
|
|
}
|
|
|
|
Pointers += 1;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
lpAddress += Buffer.RegionSize;
|
|
}
|
|
}
|
|
|
|
dprintf("\n");
|
|
free(MemoryBuffer);
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
VOID
|
|
HeapStat(LPCTSTR szArguments);
|
|
|
|
VOID
|
|
HeapFindBlock(LPCTSTR szArguments)
|
|
{
|
|
ULONG64 Process;
|
|
ULONG64 ThePeb;
|
|
HANDLE hProcess;
|
|
|
|
|
|
if (!InitializeHeapExtension()) {
|
|
|
|
return;
|
|
}
|
|
|
|
HeapEntryFind = 0;
|
|
HeapEntryFindSize = 0;
|
|
HeapAddressFind = 0;
|
|
SegmentAddressFind = 0;
|
|
Lookaside = FALSE;
|
|
AddressToFind = 0;
|
|
|
|
GetPebAddress( 0, &ThePeb);
|
|
GetCurrentProcessHandle( &hProcess );
|
|
|
|
ScanVM = FALSE;
|
|
|
|
{
|
|
LPSTR p = (LPSTR)szArguments;
|
|
|
|
while (p && *p) {
|
|
|
|
if (*p == '-') {
|
|
|
|
p++;
|
|
|
|
if (toupper(*p) == 'V') {
|
|
|
|
ScanVM = TRUE;
|
|
}
|
|
|
|
} else if (isxdigit(*p)) {
|
|
|
|
GetExpressionEx(p, &AddressToFind, &p);
|
|
|
|
continue;
|
|
}
|
|
|
|
p++;
|
|
}
|
|
}
|
|
|
|
if (AddressToFind == 0) {
|
|
|
|
dprintf("Syntax:\n!heap -x [-v] address\n");
|
|
return;
|
|
}
|
|
|
|
ScanProcessHeaps( 0,
|
|
ThePeb,
|
|
HeapFindRoutine
|
|
);
|
|
|
|
if (HeapEntryFind) {
|
|
|
|
DumpEntryHeader();
|
|
|
|
DumpEntryInfo(HeapAddressFind, SegmentAddressFind, HeapEntryFind);
|
|
|
|
dprintf("\n");
|
|
|
|
if (ScanVM) {
|
|
|
|
SearchVMReference(hProcess, HeapEntryFind, HeapEntryFind + HeapEntryFindSize - 1);
|
|
}
|
|
} else {
|
|
|
|
if (ScanVM) {
|
|
SearchVMReference(hProcess, AddressToFind, AddressToFind);
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// Heap stat implementation
|
|
//
|
|
|
|
typedef struct _SIZE_INFO {
|
|
ULONG Busy;
|
|
ULONG Free;
|
|
ULONG FrontHeapAllocs;
|
|
ULONG FrontHeapFrees;
|
|
}SIZE_INFO, *PSIZE_INFO;
|
|
|
|
typedef struct _HEAP_STATS {
|
|
|
|
ULONG HeapIndex;
|
|
ULONG64 HeapAddress;
|
|
ULONG64 ReservedMemory;
|
|
ULONG64 CommitedMemory;
|
|
ULONG64 VirtualBytes;
|
|
ULONG64 FreeSpace;
|
|
ULONG Flags;
|
|
ULONG FreeListLength;
|
|
ULONG VirtualBlocks;
|
|
ULONG UncommitedRanges;
|
|
ULONG64 LockContention;
|
|
ULONG FrontEndHeapType;
|
|
ULONG64 FrontEndHeap;
|
|
|
|
BOOLEAN ScanningSubSegment;
|
|
|
|
}HEAP_STATS, *PHEAP_STATS;
|
|
|
|
HEAP_STATS CrtHeapStat;
|
|
PSIZE_INFO SizeInfo = NULL;
|
|
ULONG BucketSize;
|
|
ULONG LargestBucketIndex = 0;
|
|
ULONG64 StatHeapAddress;
|
|
ULONG DumpBlocksSize = 0;
|
|
|
|
ULONG
|
|
FASTCALL
|
|
HeapStatSizeToSizeIndex(ULONG64 Size)
|
|
{
|
|
ULONG Index = (ULONG)(Size / BucketSize);
|
|
|
|
if (Index >= LargestBucketIndex) {
|
|
|
|
Index = LargestBucketIndex - 1;
|
|
}
|
|
|
|
return Index;
|
|
}
|
|
|
|
|
|
VOID
|
|
HeapStatDumpBlocks()
|
|
{
|
|
ULONG Index;
|
|
ULONG64 Busy = 0, Free = 0, FEBusy = 0, FEFree = 0;
|
|
|
|
|
|
dprintf("\n Default heap Front heap \n");
|
|
dprintf(" Range (bytes) Busy Free Busy Free \n");
|
|
dprintf("----------------------------------------------- \n");
|
|
if (SizeInfo == NULL) {
|
|
|
|
return;
|
|
}
|
|
|
|
for ( Index = 0; Index < LargestBucketIndex; Index++ ) {
|
|
|
|
if (SizeInfo[Index].Busy
|
|
||
|
|
SizeInfo[Index].Free
|
|
||
|
|
SizeInfo[Index].FrontHeapAllocs
|
|
||
|
|
SizeInfo[Index].FrontHeapFrees) {
|
|
|
|
dprintf("%6ld - %6ld %6ld %6ld %6ld %6ld\n",
|
|
Index * BucketSize,
|
|
(Index + 1) * BucketSize,
|
|
SizeInfo[Index].Busy,
|
|
SizeInfo[Index].Free,
|
|
SizeInfo[Index].FrontHeapAllocs,
|
|
SizeInfo[Index].FrontHeapFrees
|
|
);
|
|
|
|
FEBusy += SizeInfo[Index].FrontHeapAllocs;
|
|
FEFree += SizeInfo[Index].FrontHeapFrees;
|
|
Busy += SizeInfo[Index].Busy;
|
|
Free += SizeInfo[Index].Free;
|
|
}
|
|
}
|
|
|
|
dprintf("----------------------------------------------- \n");
|
|
dprintf(" Total %6I64d %6I64d %6I64d %6I64d \n",
|
|
Busy,
|
|
Free,
|
|
FEBusy,
|
|
FEFree
|
|
);
|
|
}
|
|
|
|
VOID
|
|
DumpBlock (
|
|
IN ULONG64 BlockAddress,
|
|
IN UCHAR Flag
|
|
)
|
|
{
|
|
UCHAR Buffer[33];
|
|
PULONG pLongArray = (PULONG)Buffer;
|
|
ULONG i;
|
|
|
|
memchr(Buffer, '?', sizeof( Buffer ));
|
|
|
|
if (!ReadMemory( BlockAddress, &Buffer[0], sizeof( Buffer ), NULL )) {
|
|
|
|
dprintf("%p ?\n", BlockAddress);
|
|
|
|
return;
|
|
}
|
|
|
|
dprintf("%p %c %08lx %08lx %08lx %08lx ",
|
|
BlockAddress,
|
|
Flag,
|
|
pLongArray[0],
|
|
pLongArray[1],
|
|
pLongArray[2],
|
|
pLongArray[3]
|
|
);
|
|
|
|
for (i = 0; i < 32; i++) {
|
|
|
|
if (!isprint(Buffer[i])) {
|
|
|
|
Buffer[i] = '.';
|
|
}
|
|
}
|
|
|
|
Buffer[32] = 0;
|
|
|
|
dprintf("%s\n", Buffer);
|
|
}
|
|
|
|
VOID
|
|
CollectHeapInfo(
|
|
ULONG64 HeapAddress
|
|
)
|
|
{
|
|
ULONG64 TempValue;
|
|
ULONG64 FrontEndHeapType;
|
|
|
|
memset(&CrtHeapStat, 0, sizeof(CrtHeapStat));
|
|
|
|
CrtHeapStat.HeapAddress = HeapAddress;
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "TotalFreeSize", CrtHeapStat.FreeSpace);
|
|
CrtHeapStat.FreeSpace *= HeapEntrySize;
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "NonDedicatedListLength", CrtHeapStat.FreeListLength);
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "Flags", TempValue);
|
|
CrtHeapStat.Flags = (ULONG)TempValue;
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "Signature", TempValue);
|
|
|
|
if (TempValue != 0xeeffeeff) {
|
|
dprintf("Error: Heap %p has an invalid signature %08lx\n", HeapAddress, 0xeeffeeff);
|
|
}
|
|
|
|
if (GetFieldValue(HeapAddress, "ntdll!_HEAP", "LockVariable", TempValue) == 0) {
|
|
|
|
if (TempValue != 0) {
|
|
|
|
GetFieldValue(TempValue, "ntdll!_RTL_CRITICAL_SECTION", "DebugInfo", TempValue);
|
|
GetFieldValue(TempValue, "ntdll!_RTL_CRITICAL_SECTION_DEBUG", "ContentionCount", CrtHeapStat.LockContention);
|
|
|
|
} else {
|
|
|
|
CrtHeapStat.LockContention = 0xbad;
|
|
}
|
|
}
|
|
|
|
CrtHeapStat.FrontEndHeapType = 0;
|
|
|
|
if (GetFieldValue(HeapAddress, "ntdll!_HEAP", "Lookaside", TempValue)) {
|
|
|
|
|
|
if (GetFieldValue(HeapAddress, "ntdll!_HEAP", "FrontEndHeapType", FrontEndHeapType)) {
|
|
|
|
dprintf("Front-end heap type info is not available\n");
|
|
|
|
} else {
|
|
|
|
CrtHeapStat.FrontEndHeapType = (ULONG)FrontEndHeapType;
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "FrontEndHeap", CrtHeapStat.FrontEndHeap);
|
|
}
|
|
|
|
} else {
|
|
|
|
if (TempValue) {
|
|
|
|
CrtHeapStat.FrontEndHeapType = 1;
|
|
}
|
|
|
|
CrtHeapStat.FrontEndHeap = TempValue;
|
|
}
|
|
}
|
|
|
|
typedef struct _BUCKET_INFO {
|
|
|
|
ULONG TotalBlocks;
|
|
ULONG SubSegmentCounts;
|
|
ULONG BlockUnits;
|
|
ULONG UseAffinity;
|
|
LONG Conversions;
|
|
|
|
} BUCKET_INFO, *PBUCKET_INFO;
|
|
|
|
VOID
|
|
DumpLowfHeap(
|
|
ULONG64 HeapAddress
|
|
)
|
|
{
|
|
ULONG64 TempValue, CrtAddress;
|
|
ULONG64 Head;
|
|
ULONG TempOffset, i;
|
|
ULONG64 Next;
|
|
ULONG Counter, TempSize;
|
|
ULONG Values[20];
|
|
PBUCKET_INFO BucketInfo;
|
|
ULONG CacheSize = GetFieldSize("ntdll!_USER_MEMORY_CACHE", "AvailableBlocks") / sizeof(ULONG);
|
|
|
|
if (CacheSize > 20) {
|
|
|
|
CacheSize = 20;
|
|
}
|
|
|
|
InitTypeRead(HeapAddress, nt!_LFH_HEAP);
|
|
|
|
if (GetFieldValue(HeapAddress, "ntdll!_LFH_HEAP", "Lock.DebugInfo", TempValue) == 0) {
|
|
|
|
if (TempValue != 0) {
|
|
|
|
ULONG64 Contention;
|
|
|
|
GetFieldValue(TempValue, "ntdll!_RTL_CRITICAL_SECTION_DEBUG", "ContentionCount", Contention);
|
|
|
|
dprintf(" Lock contention %7ld\n", (ULONG) Contention);
|
|
}
|
|
}
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_LFH_HEAP", "SubSegmentZones.Flink", Head);
|
|
|
|
Counter = 0;
|
|
|
|
ReadPointer(Head, &Next);
|
|
|
|
while (Next != Head) {
|
|
|
|
Counter += 1;
|
|
|
|
if (!ReadPointer(Next, &Next)) {
|
|
|
|
dprintf("ERROR Cannot read SubSegmentZones list at %p\n", Next);
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
dprintf(" Metadata usage %7ld\n", Counter * 1024);
|
|
|
|
dprintf(" Statistics:\n");
|
|
dprintf(" Segments created %7ld\n", ReadField(SegmentCreate));
|
|
dprintf(" Segments deleted %7ld\n", ReadField(SegmentDelete));
|
|
dprintf(" Segments reused %7ld\n", ReadField(SegmentInsertInFree));
|
|
dprintf(" Conversions %7ld\n", ReadField(Conversions));
|
|
dprintf(" ConvertedSpace %7ld\n\n", ReadField(ConvertedSpace));
|
|
|
|
GetFieldOffset("ntdll!_LFH_HEAP", "UserBlockCache", &TempOffset);
|
|
|
|
CrtAddress = TempValue = HeapAddress + TempOffset;
|
|
|
|
InitTypeRead(TempValue, nt!_USER_MEMORY_CACHE);
|
|
dprintf(" Block cache:\n");
|
|
dprintf(" Free blocks %7ld\n", ReadField(FreeBlocks));
|
|
dprintf(" Sequence %7ld\n", ReadField(Sequence));
|
|
dprintf(" Cache blocks");
|
|
|
|
for (i = 0; i < CacheSize; i++) {
|
|
|
|
ULONG64 Depth;
|
|
|
|
GetFieldValue(TempValue, "ntdll!_SLIST_HEADER", "Depth", Depth);
|
|
|
|
dprintf(" %6ld", (ULONG)Depth);
|
|
TempValue += GetTypeSize("_SLIST_HEADER");
|
|
}
|
|
|
|
GetFieldOffset("ntdll!_USER_MEMORY_CACHE", "AvailableBlocks", &TempOffset);
|
|
dprintf("\n Available ");
|
|
|
|
|
|
TempValue = CrtAddress + TempOffset;
|
|
|
|
if (ReadMemory( TempValue, Values, CacheSize * sizeof(ULONG), NULL )) {
|
|
|
|
for (i = 0; i < CacheSize; i++) {
|
|
|
|
dprintf(" %6ld", Values[i]);
|
|
}
|
|
}
|
|
|
|
dprintf("\n");
|
|
|
|
GetFieldOffset("ntdll!_LFH_HEAP", "Buckets", &TempOffset);
|
|
|
|
CrtAddress = HeapAddress + TempOffset;
|
|
TempSize = GetTypeSize("nt!_HEAP_BUCKET");
|
|
|
|
BucketInfo = (PBUCKET_INFO)malloc(128 * sizeof(BUCKET_INFO));
|
|
|
|
if (BucketInfo) {
|
|
|
|
dprintf(" Buckets info:\n");
|
|
dprintf(" Size Blocks Seg Aff Conv\n");
|
|
dprintf("-----------------------------\n");
|
|
|
|
for (i = 0; i < 128; i++) {
|
|
|
|
InitTypeRead(CrtAddress + (i * TempSize), nt!_HEAP_BUCKET);
|
|
|
|
BucketInfo[i].TotalBlocks = (ULONG)ReadField(Counters.TotalBlocks);
|
|
BucketInfo[i].BlockUnits = (ULONG)ReadField(BlockUnits);
|
|
BucketInfo[i].Conversions = (ULONG)ReadField(Conversions);
|
|
BucketInfo[i].SubSegmentCounts = (ULONG)ReadField(Counters.SubSegmentCounts);
|
|
BucketInfo[i].UseAffinity = (ULONG)ReadField(UseAffinity);
|
|
|
|
if (BucketInfo[i].TotalBlocks) {
|
|
|
|
dprintf("%6ld %7ld %5ld %ld %4ld\n",
|
|
BucketInfo[i].BlockUnits*HeapEntrySize,
|
|
BucketInfo[i].TotalBlocks,
|
|
BucketInfo[i].SubSegmentCounts,
|
|
BucketInfo[i].UseAffinity,
|
|
BucketInfo[i].Conversions
|
|
);
|
|
}
|
|
}
|
|
dprintf("-----------------------------\n");
|
|
|
|
free(BucketInfo);
|
|
}
|
|
}
|
|
|
|
VOID
|
|
DumpHeapInfo(
|
|
ULONG64 HeapAddress
|
|
)
|
|
{
|
|
ULONG64 TempValue;
|
|
|
|
dprintf("\n%2ld: Heap %p\n",
|
|
CrtHeapStat.HeapIndex,
|
|
CrtHeapStat.HeapAddress);
|
|
|
|
dprintf(" Flags %08lx - ", CrtHeapStat.Flags);
|
|
DumpFlagDescription(CrtHeapStat.Flags);
|
|
dprintf("\n");
|
|
|
|
dprintf(" Reserved %I64d (k)\n", CrtHeapStat.ReservedMemory/1024);
|
|
dprintf(" Commited %I64d (k)\n", CrtHeapStat.CommitedMemory/1024);
|
|
dprintf(" Virtual bytes %I64d (k)\n", CrtHeapStat.VirtualBytes/1024);
|
|
dprintf(" Free space %I64d (k)\n", CrtHeapStat.FreeSpace/1024);
|
|
|
|
|
|
if (CrtHeapStat.CommitedMemory) {
|
|
dprintf(" External fragmentation %ld%% (%ld free blocks)\n",
|
|
(ULONG)(CrtHeapStat.FreeSpace *100 / CrtHeapStat.CommitedMemory),
|
|
CrtHeapStat.FreeListLength
|
|
);
|
|
|
|
}
|
|
|
|
if (CrtHeapStat.VirtualBytes) {
|
|
dprintf(" Virtual address fragmentation %ld%% (%ld uncommited ranges)\n",
|
|
(ULONG)((CrtHeapStat.VirtualBytes - CrtHeapStat.CommitedMemory) *100 / CrtHeapStat.VirtualBytes),
|
|
CrtHeapStat.UncommitedRanges
|
|
);
|
|
}
|
|
|
|
|
|
dprintf(" Virtual blocks %ld\n", CrtHeapStat.VirtualBlocks);
|
|
dprintf(" Lock contention %ld\n", CrtHeapStat.LockContention);
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "LastSegmentIndex", TempValue);
|
|
dprintf(" Segments %ld\n", (ULONG)TempValue + 1);
|
|
|
|
GetFieldValue(HeapAddress, "ntdll!_HEAP", "LargeBlocksIndex", TempValue);
|
|
|
|
if (TempValue) {
|
|
|
|
ULONG PerfOffset;
|
|
|
|
InitTypeRead(TempValue, nt!_HEAP_INDEX);
|
|
|
|
dprintf(" %ld hash table for the free list\n", (ULONG) ReadField(ArraySize));
|
|
dprintf(" Commits %ld\n", (ULONG) ReadField(Committs));
|
|
dprintf(" Decommitts %ld\n", (ULONG) ReadField(Decommitts));
|
|
}
|
|
|
|
switch (CrtHeapStat.FrontEndHeapType) {
|
|
case 1:
|
|
|
|
dprintf("\n Lookaside heap %p\n", CrtHeapStat.FrontEndHeap);
|
|
break;
|
|
case 2:
|
|
|
|
dprintf("\n Low fragmentation heap %p\n", CrtHeapStat.FrontEndHeap);
|
|
|
|
DumpLowfHeap(CrtHeapStat.FrontEndHeap);
|
|
break;
|
|
}
|
|
}
|
|
|
|
BOOLEAN
|
|
HeapStatRoutine(
|
|
IN ULONG Context,
|
|
IN ULONG64 HeapAddress,
|
|
IN ULONG64 SegmentAddress,
|
|
IN ULONG64 EntryAddress,
|
|
IN ULONG64 Data
|
|
)
|
|
{
|
|
ULONG SizeIndex;
|
|
|
|
switch (Context) {
|
|
|
|
case CONTEXT_START_HEAP:
|
|
{
|
|
if (DumpBlocksSize == 0) {
|
|
dprintf("Walking the heap %p ", HeapAddress);
|
|
}
|
|
|
|
CollectHeapInfo(HeapAddress);
|
|
|
|
//
|
|
// Allow scanning the heap
|
|
//
|
|
|
|
return TRUE;
|
|
}
|
|
break;
|
|
|
|
case CONTEXT_END_HEAP:
|
|
|
|
if (DumpBlocksSize == 0) {
|
|
dprintf("\r");
|
|
}
|
|
if (SizeInfo == NULL) {
|
|
|
|
dprintf("%p %08lx %7I64d %6I64d %6I64d %6I64d %5ld %5ld %4ld %6lx ",
|
|
CrtHeapStat.HeapAddress,
|
|
CrtHeapStat.Flags,
|
|
(CrtHeapStat.ReservedMemory / 1024),
|
|
(CrtHeapStat.CommitedMemory / 1024),
|
|
(CrtHeapStat.VirtualBytes / 1024),
|
|
(CrtHeapStat.FreeSpace / 1024),
|
|
CrtHeapStat.FreeListLength,
|
|
CrtHeapStat.UncommitedRanges,
|
|
CrtHeapStat.VirtualBlocks,
|
|
CrtHeapStat.LockContention
|
|
);
|
|
|
|
switch (CrtHeapStat.FrontEndHeapType) {
|
|
case 1:
|
|
dprintf("L ");
|
|
break;
|
|
case 2:
|
|
dprintf("LFH");
|
|
break;
|
|
default:
|
|
dprintf(" ");
|
|
}
|
|
|
|
dprintf("\n");
|
|
|
|
//
|
|
// Report external fragmentation is the heap uses more than 1M
|
|
// The threshold to report is 10%
|
|
//
|
|
|
|
if ((CrtHeapStat.CommitedMemory > 1024*1024)
|
|
&&
|
|
CrtHeapStat.FreeSpace *100 / CrtHeapStat.CommitedMemory > 10) {
|
|
|
|
dprintf(" External fragmentation %ld %% (%ld free blocks)\n",
|
|
(ULONG)(CrtHeapStat.FreeSpace *100 / CrtHeapStat.CommitedMemory),
|
|
CrtHeapStat.FreeListLength
|
|
);
|
|
}
|
|
|
|
//
|
|
// Report virtual address fragmentation is the heap has more than 100 UCR
|
|
// The threshold to report is 10%
|
|
//
|
|
|
|
if (CrtHeapStat.UncommitedRanges > 100
|
|
&&
|
|
(CrtHeapStat.VirtualBytes - CrtHeapStat.CommitedMemory) *100 / CrtHeapStat.VirtualBytes > 10) {
|
|
|
|
dprintf(" Virtual address fragmentation %ld %% (%ld uncommited ranges)\n",
|
|
(ULONG)((CrtHeapStat.VirtualBytes - CrtHeapStat.CommitedMemory) *100 / CrtHeapStat.VirtualBytes),
|
|
CrtHeapStat.UncommitedRanges
|
|
);
|
|
}
|
|
|
|
//
|
|
// Make noise about lock contention. The value is 1M, and it's arbitrary.
|
|
// Over a long run this value can be legitimate
|
|
//
|
|
|
|
if (CrtHeapStat.LockContention > 1024*1024) {
|
|
|
|
dprintf(" Lock contention %ld \n",
|
|
CrtHeapStat.LockContention);
|
|
}
|
|
} else {
|
|
|
|
DumpHeapInfo(StatHeapAddress);
|
|
HeapStatDumpBlocks();
|
|
}
|
|
break;
|
|
|
|
case CONTEXT_START_SEGMENT:
|
|
|
|
{
|
|
ULONG64 NumberOfPages, NumberOfUnCommittedPages, LargestUnCommittedRange, NumberOfUnCommittedRanges;
|
|
|
|
GetFieldValue(SegmentAddress, "ntdll!_HEAP_SEGMENT", "NumberOfPages", NumberOfPages);
|
|
GetFieldValue(SegmentAddress, "ntdll!_HEAP_SEGMENT", "NumberOfUnCommittedPages", NumberOfUnCommittedPages);
|
|
GetFieldValue(SegmentAddress, "ntdll!_HEAP_SEGMENT", "LargestUnCommittedRange", LargestUnCommittedRange);
|
|
GetFieldValue(SegmentAddress, "ntdll!_HEAP_SEGMENT", "NumberOfUnCommittedRanges", NumberOfUnCommittedRanges);
|
|
|
|
CrtHeapStat.ReservedMemory += NumberOfPages * PageSize;
|
|
CrtHeapStat.CommitedMemory += (NumberOfPages - NumberOfUnCommittedPages) * PageSize;
|
|
CrtHeapStat.UncommitedRanges += (ULONG)NumberOfUnCommittedRanges;
|
|
CrtHeapStat.VirtualBytes += NumberOfPages * PageSize - LargestUnCommittedRange;
|
|
|
|
}
|
|
|
|
if ((SizeInfo != NULL)
|
|
&&
|
|
(DumpBlocksSize == 0)
|
|
) {
|
|
|
|
dprintf(".");
|
|
}
|
|
|
|
if (VerifyBlocks) {
|
|
|
|
dprintf(".");
|
|
return TRUE;
|
|
}
|
|
|
|
//
|
|
// Do not walk the blocks. We need to return FALSE
|
|
//
|
|
|
|
return (SizeInfo != NULL);
|
|
|
|
case CONTEXT_START_SUBSEGMENT:
|
|
|
|
CrtHeapStat.ScanningSubSegment = TRUE;
|
|
break;
|
|
|
|
case CONTEXT_END_SUBSEGMENT:
|
|
CrtHeapStat.ScanningSubSegment = FALSE;
|
|
break;
|
|
|
|
case CONTEXT_FREE_BLOCK:
|
|
if (SizeInfo) {
|
|
|
|
if (CrtHeapStat.ScanningSubSegment) {
|
|
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].FrontHeapFrees += 1;
|
|
|
|
} else {
|
|
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].Free += 1;
|
|
}
|
|
}
|
|
|
|
if (Data == DumpBlocksSize) {
|
|
|
|
DumpBlock(EntryAddress + HeapEntrySize, 'F');
|
|
}
|
|
break;
|
|
case CONTEXT_BUSY_BLOCK:
|
|
|
|
if (SizeInfo) {
|
|
|
|
if (CrtHeapStat.ScanningSubSegment) {
|
|
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].FrontHeapAllocs += 1;
|
|
|
|
} else {
|
|
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].Busy += 1;
|
|
}
|
|
}
|
|
if (Data == DumpBlocksSize) {
|
|
DumpBlock(EntryAddress + HeapEntrySize, 'B');
|
|
}
|
|
break;
|
|
|
|
case CONTEXT_LOOKASIDE_BLOCK:
|
|
|
|
if (SizeInfo) {
|
|
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].FrontHeapFrees += 1;
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].Busy -= 1;
|
|
}
|
|
if (Data == DumpBlocksSize) {
|
|
|
|
DumpBlock(EntryAddress + HeapEntrySize, 'f');
|
|
}
|
|
break;
|
|
case CONTEXT_VIRTUAL_BLOCK:
|
|
|
|
if (SizeInfo) {
|
|
|
|
SizeInfo[HeapStatSizeToSizeIndex(Data)].Busy += 1;
|
|
}
|
|
CrtHeapStat.VirtualBlocks += 1;
|
|
break;
|
|
|
|
case CONTEXT_ERROR:
|
|
|
|
dprintf("HEAP %p (Seg %p) At %p Error: %s\n",
|
|
HeapAddress,
|
|
SegmentAddress,
|
|
EntryAddress,
|
|
(LPSTR) (ULONG_PTR) Data
|
|
);
|
|
|
|
break;
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
VOID
|
|
HeapStat(LPCTSTR szArguments)
|
|
{
|
|
ULONG64 Process;
|
|
ULONG64 ThePeb;
|
|
HANDLE hProcess;
|
|
|
|
int LastCommand = ' ';
|
|
|
|
|
|
if (!InitializeHeapExtension()) {
|
|
|
|
return;
|
|
}
|
|
|
|
HeapEntryFind = 0;
|
|
HeapEntryFindSize = 0;
|
|
HeapAddressFind = 0;
|
|
SegmentAddressFind = 0;
|
|
Lookaside = FALSE;
|
|
StatHeapAddress = 0;
|
|
BucketSize = 1024;
|
|
DumpBlocksSize = 0;
|
|
VerifyBlocks = FALSE;
|
|
|
|
GetPebAddress( 0, &ThePeb);
|
|
GetCurrentProcessHandle( &hProcess );
|
|
|
|
ScanVM = FALSE;
|
|
|
|
{
|
|
LPSTR p = (LPSTR)szArguments;
|
|
|
|
while (p && *p) {
|
|
|
|
if (*p == '-') {
|
|
|
|
p++;
|
|
|
|
LastCommand = toupper(*p);
|
|
|
|
if (LastCommand == 'V') {
|
|
|
|
VerifyBlocks = TRUE;
|
|
}
|
|
|
|
} else if (isxdigit(*p)) {
|
|
|
|
ULONG64 HexInput = 0;
|
|
|
|
GetExpressionEx(p, &HexInput, &p);
|
|
|
|
switch (LastCommand) {
|
|
case 'B':
|
|
|
|
BucketSize = (ULONG)HexInput;
|
|
|
|
break;
|
|
case 'D':
|
|
|
|
DumpBlocksSize = (ULONG)HexInput;
|
|
|
|
break;
|
|
default:
|
|
|
|
if (StatHeapAddress != 0) {
|
|
|
|
dprintf("Parameter error: unexpected second heap address %I64d\n", HexInput);
|
|
|
|
} else {
|
|
StatHeapAddress = HexInput;
|
|
}
|
|
}
|
|
LastCommand = '\0';
|
|
continue;
|
|
}
|
|
|
|
p++;
|
|
}
|
|
}
|
|
|
|
if (StatHeapAddress == 0) {
|
|
|
|
DumpGlobals();
|
|
|
|
if (PointerSize == 8) {
|
|
dprintf(" ");
|
|
}
|
|
dprintf(" Heap Flags Reserv Commit Virt Free List UCR Virt Lock Fast \n");
|
|
|
|
if (PointerSize == 8) {
|
|
dprintf(" ");
|
|
}
|
|
|
|
dprintf(" (k) (k) (k) (k) length blocks cont. heap \n");
|
|
|
|
if (PointerSize == 8) {
|
|
dprintf("--------");
|
|
}
|
|
dprintf("-----------------------------------------------------------------------------\n");
|
|
|
|
ScanProcessHeaps( 0,
|
|
ThePeb,
|
|
HeapStatRoutine
|
|
);
|
|
|
|
|
|
if (PointerSize == 8) {
|
|
dprintf("--------");
|
|
}
|
|
dprintf("-----------------------------------------------------------------------------\n");
|
|
|
|
} else {
|
|
|
|
//
|
|
// Do not handle blocks over 512k, which is close to virtual alloc limit
|
|
//
|
|
|
|
LargestBucketIndex = (512*1024)/BucketSize;
|
|
|
|
SizeInfo = malloc(LargestBucketIndex * sizeof(SIZE_INFO));
|
|
|
|
if (SizeInfo == NULL) {
|
|
|
|
dprintf("cannot allocate thye statistics buffer\n");
|
|
return;
|
|
}
|
|
|
|
memset(SizeInfo, 0, LargestBucketIndex * sizeof(SIZE_INFO));
|
|
|
|
ScanProcessHeaps( StatHeapAddress,
|
|
ThePeb,
|
|
HeapStatRoutine
|
|
);
|
|
|
|
free(SizeInfo);
|
|
SizeInfo = NULL;
|
|
}
|
|
}
|
|
|
|
|