Address | Offset | After HeapAlloc() | After malloc() | During free() | After HeapFree() | Comments |
0×00320FD8 | -40 | 0×01090009 | 0×01090009 | 0×01090009 | 0×0109005A | Win32 heap info |
0×00320FDC | -36 | 0×01090009 | 0×00180700 | 0×01090009 | 0×00180400 | Win32 heap info |
0×00320FE0 | -32 | 0xBAADF00D | 0×00320798 | 0xDDDDDDDD | 0×00320448 | Ptr to next CRT heap block (allocated earlier in time) |
0×00320FE4 | -28 | 0xBAADF00D | 0×00000000 | 0xDDDDDDDD | 0×00320448 | Ptr to prev CRT heap block (allocated later in time) |
0×00320FE8 | -24 | 0xBAADF00D | 0×00000000 | 0xDDDDDDDD | 0xFEEEFEEE | Filename of malloc() call |
0×00320FEC | -20 | 0xBAADF00D | 0×00000000 | 0xDDDDDDDD | 0xFEEEFEEE | Line number of malloc() call |
0×00320FF0 | -16 | 0xBAADF00D | 0×00000008 | 0xDDDDDDDD | 0xFEEEFEEE | Number of bytes to malloc() |
0×00320FF4 | -12 | 0xBAADF00D | 0×00000001 | 0xDDDDDDDD | 0xFEEEFEEE | Type (0=Freed, 1=Normal, 2=CRT use, etc) |
0×00320FF8 | -8 | 0xBAADF00D | 0×00000031 | 0xDDDDDDDD | 0xFEEEFEEE | Request #, increases from 0 |
0×00320FFC | -4 | 0xBAADF00D | 0xFDFDFDFD | 0xDDDDDDDD | 0xFEEEFEEE | No mans land |
0×00321000 | +0 | 0xBAADF00D | 0xCDCDCDCD | 0xDDDDDDDD | 0xFEEEFEEE | The 8 bytes you wanted |
0×00321004 | +4 | 0xBAADF00D | 0xCDCDCDCD | 0xDDDDDDDD | 0xFEEEFEEE | The 8 bytes you wanted |
0×00321008 | +8 | 0xBAADF00D | 0xFDFDFDFD | 0xDDDDDDDD | 0xFEEEFEEE | No mans land |
0×0032100C | +12 | 0xBAADF00D | 0xBAADF00D | 0xDDDDDDDD | 0xFEEEFEEE | Win32 heap allocations are rounded up to 16 bytes |
0×00321010 | +16 | 0xABABABAB | 0xABABABAB | 0xABABABAB | 0xFEEEFEEE | Win32 heap bookkeeping |
0×00321014 | +20 | 0xABABABAB | 0xABABABAB | 0xABABABAB | 0xFEEEFEEE | Win32 heap bookkeeping |
0×00321018 | +24 | 0×00000010 | 0×00000010 | 0×00000010 | 0xFEEEFEEE | Win32 heap bookkeeping |
0×0032101C | +28 | 0×00000000 | 0×00000000 | 0×00000000 | 0xFEEEFEEE | Win32 heap bookkeeping |
0×00321020 | +32 | 0×00090051 | 0×00090051 | 0×00090051 | 0xFEEEFEEE | Win32 heap bookkeeping |
0×00321024 | +36 | 0xFEEE0400 | 0xFEEE0400 | 0xFEEE0400 | 0xFEEEFEEE | Win32 heap bookkeeping |
0×00321028 | +40 | 0×00320400 | 0×00320400 | 0×00320400 | 0xFEEEFEEE | Win32 heap bookkeeping |
0×0032102C | +44 | 0×00320400 | 0×00320400 | 0×00320400 | 0xFEEEFEEE | Win32 heap bookkeeping |