这是一个32位控制台程序,使用AppVerifier启用了Heaps(即Full Page Heap),主要看pszBuffer1和pszBuffer2,pszBuffer1申请0xe个字节,即14字节,而pszBuffer2比pszBuffer1多申请1个字节,但是通过调试发现,其实系统是会多分配蛮多字节的,具体为什么。。我也搞不懂。。。
#include "stdafx.h"
#include <string>
int _tmain(int argc, _TCHAR* argv[])
{
char* pszBuffer1 = new char[0xe];
memset(pszBuffer1, 1, 0xe);
char* pszBuffer2 = new char[0xF];
memset(pszBuffer2, 2, 0xF);
char* pszBuffer3 = new char[0x3];
memset(pszBuffer3, 3, 0x3);
char* pszBuffer4 = new char[0x6];
memset(pszBuffer4, 4, 0x6);
char* pszBuffer5 = new char[0x7];
memset(pszBuffer5, 5, 0x7);
__debugbreak();
return 0;
}
开始调试
Opened log file 'c:\test\log.txt'
0:000> .symfix c:\mss
0:000> .reload
Reloading current modules
.........
0:000> g
(1cc4.1220): Break instruction exception - code 80000003 (first chance)
*** WARNING: Unable to verify checksum for ConsoleApplication2.exe
eax=0630cff0 ebx=7efde000 ecx=00000000 edx=00000000 esi=00000000 edi=003cf880
eip=012f449b esp=003cf73c ebp=003cf880 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
ConsoleApplication2!wmain+0xeb:
012f449b cc int 3
#好,断点触发,那么看下ebp寄存器的值
0:000> r ebp
ebp=003cf880
#再把所有局部变量的地址啊、类型啊、值啊全部按照顺序列出来,