[ros-dev] Heap corruption detector is ready

Aleksey Bragin aleksey at reactos.org
Fri Feb 25 16:39:26 UTC 2011


Hi all,
I finished implementing main features of a special mechanism for  
monitoring uesrmode heap allocations in ReactOS. This mechanism is  
called Debug Page Heap, after the very similar mechanism present in  
recent versions of Microsoft Windows NT.

Explaining the heap manager, the "usual" heap allocator (the one I  
also developed earlier) also contains a heap corruption detector, but  
it works post-factum, only after the respective block is freed its  
patterns are checked (if such heap flags are specified) and if they  
are damaged the block is reported. This makes debugging problematic,  
because a lot of code is executed between the moment the corruption  
occured and moment when the corrupted block is freed. Also it may be  
so that block's patterns are untouched, but internal heap structures  
are damaged. The usual heap allocator won't be able to catch this,  
but will crash with undetermined exception.

Debug page heap (DPH) comes to solve this problem. Simply speaking it  
guards every block with a no-access page either after or before the  
block, so that when a badly written app wants to write beyond the  
allowed area, an exception occurs showing exactly the faulty  
instruction.
Not so simply speaking, it's a rather complicated debugging tool with  
abilities to catch access-after-free cases also when they happen, and  
do some other nice tricks too. If you want to read more about it,  
look for "debug page heap" in MSDN and also visit URLs specified as  
references in rtl/heappage.c.

How to use it? The best way is to use Microsoft's utility gflags.exe  
which is part of the Debugging package of WDK. To make long things  
short, just copy gflags.exe to C:\ReactOS\system32, boot your ReactOS  
installation, fire up cmd prompt and type:
gflags /p /enable name.exe /full
Now, when you run your app called name.exe, it will use the DPH heap  
allocator.

Detailed information about gflags.exe could be found here: http:// 
msdn.microsoft.com/en-us/library/ff549557%28VS.85%29.aspx
Also, I suggest looking in MSDN for page heap explanation (I provided  
some references in heappage.c too).


Have fun!
Aleksey.



More information about the Ros-dev mailing list