Finding which function allocated a heap based on a

Question

So I know that a memory address (eg: 12208e6c) is within a specific heap.Using windbg, is there a way to determine what the starting address for this heap is and which function was responsible for allocating it?

Answer 1

!address <address> gives you information about the heap an address is contained in:

0:005> !address 03051234
Usage:                  Heap
Base Address:           03050000
End Address:            0307c000
Region Size:            0002c000
State:                  00001000    MEM_COMMIT
Protect:                00000004    PAGE_READWRITE
Type:                   00020000    MEM_PRIVATE
Allocation Base:        03050000
Allocation Protect:     00000004    PAGE_READWRITE
More info:              heap owning the address: !heap 0x3050000
More info:              heap segment
More info:              heap entry containing the address: !heap -x 0x3051234

The "Base Address" is what you called the "starting address".

To find out who allocated that heap, you have to enable a feature called "Create user mode stack trace database" and set a buffer size in GFlags.

After doing so, you can find out the allocation call stack like this:

0:005> !gflag
Current NtGlobalFlag contents: 0x00001000
    ust - Create user mode stack trace database

0:005> !heap -p -a 00591234
    address 00591234 found in
    _HEAP @ 590000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        00590f28 0103 0000  [00]   00590f40    00800 - (busy)
          msvcrt!_iob
        7782e159 ntdll!RtlAllocateHeap+0x00000274
        7629ade8 msvcrt!_calloc_impl+0x00000136
        7629ae43 msvcrt!_calloc_crt+0x00000016
        762a1e48 msvcrt!__initstdio+0x0000000d
        762a1fc8 msvcrt!_cinit+0x0000001e
        762a1a94 msvcrt!_core_crt_dll_init+0x000001b2
        7629a48c msvcrt!_CRTDLL_INIT+0x0000001b
        777e92e0 ntdll!__RtlUserThreadStart+0x00000021
        777f061b ntdll!RtlpAllocateHeap+0x0000083a
        777f6d84 ntdll!LdrpInitializeProcess+0x0000137e
        777f583e ntdll!RtlSetEnvironmentVariable+0x00000020
        777e9809 ntdll!LdrpUpdateLoadCount2+0x00000047