堆内存破坏检测实战.docxVIP

堆内存破坏检测实战--附完整调试过程首先解释一下，什么是堆内存？堆是一种常见的内存管理器，应用程序通过堆来动态地分配和释放内存，通常使用堆的情况是无法预先知道所需要的内存大小，或者申请内存太大，无法通过栈内存来自动分配，下面让我们再来看一段英文解释。A heap is a form of memory manager that an application can use when it needs to allocate?and free memory dynamically. Common situations that call for the use of a heap?are when the size of the memory needed is not known ahead of time and the size of?the memory is too large to neatly fit on the stack (automatic memory).常见的情况是由于效率或特殊需求一个进程中同时使用几个堆，如下图：??下面通过一个完整的demo来带大家调试一个对破坏问题，demo代码如下：#define SZ_MAX_LEN? 10void?__cdecl?wmain?(int?argc,?WCHAR*?args[]){????if(argc==2)????{????????wprintf(LPress?any?key?to?start\n);????????_getch();????????DupString(args[1]);????}????else????{????????wprintf(LPlease?enter?a?string);????}}BOOL?DupString(WCHAR*?psz){????BOOL?bRet=FALSE;????????if(psz!=NULL)????{????????pszCopy=(WCHAR*)?HeapAlloc(GetProcessHeap(),?0,?SZ_MAX_LEN*sizeof(WCHAR));????????if(pszCopy)????????{????????????wcscpy(pszCopy,?psz);????????????wprintf(LCopy?of?string:?%s,?pszCopy);????????????HeapFree(GetProcessHeap(),?0,?pszCopy);????????????bRet=TRUE;????????}????}????return?bRet;?在应用程序验证器下启用普通页堆，配置gflags,?运行build出来的代码，输入参数为：SolidmangoSolidmangoSolidmango得到如下输出：CommandLine:?C:\WinXP.x86.chk\06overrun.exe?SolidmangoSolidmangoSolidmangoExecutable?search?path?is:?ModLoad:01005000???06overrun.exeModLoad:?7c900000?7c9b2000???ntdll.dllAVRF:?06overrun.exe:?pid?0x120C:?flags?0x8044B026:?application?verifier?enabledModLoad:?5ad10000?5ad59000???C:\WINDOWS\System32\verifier.dllModLoad:10029000???C:\WINDOWS\System32\vrfcore.dllModLoad:?003a0000?003dc000???C:\WINDOWS\System32\vfbasics.dllModLoad:?7c800000?7c8f6000???C:\WINDOWS\system32\kernel32.dllAVRF:?verifier.dll?provider?initialized?for?06overrun.exe?with?flags?0x8044B026?ModLoad:?77c10000?77c68000???C:\WINDOWS\system32\msvcrt.dll(120c.1700):?Break?instruction?exception?-?code(first?chance)eax=00391ec4?ebx=7ffd8000?ecxedxesi=00391f98?edi=00391ec4eip=7