Git Product home page Git Product logo

winheapplugin's Introduction

WinHeapPlugin

usage

.load /path/to/WindbgDll.dll

you can use the command .chain to check if it is loaded.

!freelist

3: kd> !heap
        Heap Address      NT/Segment Heap

         1ff3fae0000              NT Heap
         1ff3fa60000              NT Heap
         1ff3fcf0000              NT Heap
         1ff40240000              NT Heap
3: kd> !freelist 1ff3fae0000
[+] freelist head: 0x1ff3fae0150
   [>] Flink: 0x1ff3fb1d1e0 -> 0x1ff3fb05f50 -> 0x1ff3fafd970 -> 0x1ff3fb1a690 -> 0x1ff3fae1500 -> 0x1ff3fb286d0 
           -> 0x1ff3fb1ca20 -> 0x1ff3faf3de0 -> 0x1ff3fb01ff0 -> 0x1ff3fb34a60 -> 0x1ff3fb222e0 -> 0x1ff3fae8210 
           -> 0x1ff3faf4110 -> 0x1ff3fb1cea0 -> 0x1ff3fb0e120 -> 0x1ff3fae6f40 -> 0x1ff3fae6df0 -> 0x1ff3fae71a0 
           -> 0x1ff3fb31610 -> 0x1ff3fb1bd00 -> 0x1ff3fb193e0 -> 0x1ff3fae7ac0 -> 0x1ff3fae8b50 -> 0x1ff3fae8920 
           -> 0x1ff3fb283f0 -> 0x1ff3fb05b20 -> 0x1ff3fb322f0 -> 0x1ff3fb06170 -> 0x1ff3fb19f10 -> 0x1ff3fb057d0 
           -> 0x1ff3fb1e8a0 -> 0x1ff3fb32700 -> 0x1ff3fae7260 -> 0x1ff3fae40e0 -> 0x1ff3fae84a0 -> 0x1ff3fb36e90 
           -> 0x1ff3fb33d50 -> 0x1ff3fb16270 -> 0x1ff3fb25b90 -> 0x1ff3fb24840 -> 0x1ff3faf6a10 -> 0x1ff3fb0f080 
           -> 0x1ff3faffce0 -> 0x1ff3fb2f8b0 -> 0x1ff3fb17eb0 -> 0x1ff3fb06490 -> 0x1ff3fb26710 -> 0x1ff3fb11ab0 
           -> 0x1ff3fb393a0 

   [>] Blink: 0x1ff3fb393a0 -> 0x1ff3fb11ab0 -> 0x1ff3fb26710 -> 0x1ff3fb06490 -> 0x1ff3fb17eb0 -> 0x1ff3fb2f8b0 
           -> 0x1ff3faffce0 -> 0x1ff3fb0f080 -> 0x1ff3faf6a10 -> 0x1ff3fb24840 -> 0x1ff3fb25b90 -> 0x1ff3fb16270 
           -> 0x1ff3fb33d50 -> 0x1ff3fb36e90 -> 0x1ff3fae84a0 -> 0x1ff3fae40e0 -> 0x1ff3fae7260 -> 0x1ff3fb32700 
           -> 0x1ff3fb1e8a0 -> 0x1ff3fb057d0 -> 0x1ff3fb19f10 -> 0x1ff3fb06170 -> 0x1ff3fb322f0 -> 0x1ff3fb05b20 
           -> 0x1ff3fb283f0 -> 0x1ff3fae8920 -> 0x1ff3fae8b50 -> 0x1ff3fae7ac0 -> 0x1ff3fb193e0 -> 0x1ff3fb1bd00 
           -> 0x1ff3fb31610 -> 0x1ff3fae71a0 -> 0x1ff3fae6df0 -> 0x1ff3fae6f40 -> 0x1ff3fb0e120 -> 0x1ff3fb1cea0 
           -> 0x1ff3faf4110 -> 0x1ff3fae8210 -> 0x1ff3fb222e0 -> 0x1ff3fb34a60 -> 0x1ff3fb01ff0 -> 0x1ff3faf3de0 
           -> 0x1ff3fb1ca20 -> 0x1ff3fb286d0 -> 0x1ff3fae1500 -> 0x1ff3fb1a690 -> 0x1ff3fafd970 -> 0x1ff3fb05f50 
           -> 0x1ff3fb1d1e0 

!hchunk

3: kd> !hchunk 0x1ff3fb1d1e0
[!] To get the right result, you have to use !freelist first
[+] cookie:  0x7a4962b56ebe
[+] chunk:  0x1ff3fb1d1e0
   [>] PreviousBlockPrivateData: 0x0 00 00 00 00 00 00 00 00  ........
   [>] Size: 0x20(32)
   [>] Flags: 0x0(free)
   [>] PreviousSize: 0xb0(176)
3: kd> !hchunk 0x1ff3fb05f50
[!] To get the right result, you have to use !freelist first
[+] cookie:  0x7a4962b56ebe
[+] chunk:  0x1ff3fb05f50
   [>] PreviousBlockPrivateData: 0x0 00 00 00 00 00 00 00 00  ........
   [>] Size: 0x20(32)
   [>] Flags: 0x0(free)
   [>] PreviousSize: 0xb0(176)

winheapplugin's People

Stargazers

 avatar  avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.