crt 内存布局图(转)

Address	Offset	After HeapAlloc()	After malloc()	During free()	After HeapFree()	Comments
0×00320FD8	-40	0×01090009	0×01090009	0×01090009	0×0109005A	Win32 heap info
0×00320FDC	-36	0×01090009	0×00180700	0×01090009	0×00180400	Win32 heap info
0×00320FE0	-32	0xBAADF00D	0×00320798	0xDDDDDDDD	0×00320448	Ptr to next CRT heap block (allocated earlier in time)
0×00320FE4	-28	0xBAADF00D	0×00000000	0xDDDDDDDD	0×00320448	Ptr to prev CRT heap block (allocated later in time)
0×00320FE8	-24	0xBAADF00D	0×00000000	0xDDDDDDDD	0xFEEEFEEE	Filename of malloc() call
0×00320FEC	-20	0xBAADF00D	0×00000000	0xDDDDDDDD	0xFEEEFEEE	Line number of malloc() call
0×00320FF0	-16	0xBAADF00D	0×00000008	0xDDDDDDDD	0xFEEEFEEE	Number of bytes to malloc()
0×00320FF4	-12	0xBAADF00D	0×00000001	0xDDDDDDDD	0xFEEEFEEE	Type (0=Freed, 1=Normal, 2=CRT use, etc)
0×00320FF8	-8	0xBAADF00D	0×00000031	0xDDDDDDDD	0xFEEEFEEE	Request #, increases from 0
0×00320FFC	-4	0xBAADF00D	0xFDFDFDFD	0xDDDDDDDD	0xFEEEFEEE	No mans land
0×00321000	+0	0xBAADF00D	0xCDCDCDCD	0xDDDDDDDD	0xFEEEFEEE	The 8 bytes you wanted
0×00321004	+4	0xBAADF00D	0xCDCDCDCD	0xDDDDDDDD	0xFEEEFEEE	The 8 bytes you wanted
0×00321008	+8	0xBAADF00D	0xFDFDFDFD	0xDDDDDDDD	0xFEEEFEEE	No mans land
0×0032100C	+12	0xBAADF00D	0xBAADF00D	0xDDDDDDDD	0xFEEEFEEE	Win32 heap allocations are rounded up to 16 bytes
0×00321010	+16	0xABABABAB	0xABABABAB	0xABABABAB	0xFEEEFEEE	Win32 heap bookkeeping
0×00321014	+20	0xABABABAB	0xABABABAB	0xABABABAB	0xFEEEFEEE	Win32 heap bookkeeping
0×00321018	+24	0×00000010	0×00000010	0×00000010	0xFEEEFEEE	Win32 heap bookkeeping
0×0032101C	+28	0×00000000	0×00000000	0×00000000	0xFEEEFEEE	Win32 heap bookkeeping
0×00321020	+32	0×00090051	0×00090051	0×00090051	0xFEEEFEEE	Win32 heap bookkeeping
0×00321024	+36	0xFEEE0400	0xFEEE0400	0xFEEE0400	0xFEEEFEEE	Win32 heap bookkeeping
0×00321028	+40	0×00320400	0×00320400	0×00320400	0xFEEEFEEE	Win32 heap bookkeeping
0×0032102C	+44	0×00320400	0×00320400	0×00320400	0xFEEEFEEE	Win32 heap bookkeeping

http://www.nobugs.org/developer/win32/debug_crt_heap.html#table