Introduction to the fast table of heap management system in Windows environment

• Lab Environment:
• Operating system: Windows Service Pack 4
• Integrated development environment: Microsoft Visual C + + 6.0 SP6
• Build version: Release version
• Experiment Code:

• 1#include <stdio.h>2#include <windows.h>3 4 voidMain ()5 {6 hlocal H1, H2, H3, H4;7 HANDLE hp;8 9     //Enable fast tablesTenHP = HeapCreate (0,0,0); Oneprintf"HP:%p\n", HP); A  -     //prevent the program from monitoring the debugger and using the debug heap management policy -__asmint 3 the  -H1 = HeapAlloc (HP, Heap_zero_memory,8); -printf"H1:%p\n", H1); -H2 = HeapAlloc (HP, Heap_zero_memory,8); +printf"H2:%p\n", H2); -H3 = HeapAlloc (HP, Heap_zero_memory, -); +printf"h3:%p\n", H3); AH4 = HeapAlloc (HP, Heap_zero_memory, -); atprintf"h4:%p\n", H4); -  -HeapFree (HP,0, H1); -HeapFree (HP,0, H2); -HeapFree (HP,0, H3); -HeapFree (HP,0, H4); in  -H2 = HeapAlloc (HP, Heap_zero_memory, -); toprintf"H2:%p\n", H2); +  -HeapFree (HP,0, H2); the}

• After the fast table is enabled, the heap structure also changes, the main is that the largest block of the initialization heap is no longer at the 0x688 offset, this position is occupied by the fast table, look at the 0x178 offset of the empty table index area can also be found. (The first address of the heap on my machine is 0x00360000)
• At this point to the 0x00360688 memory area, you will find that the data in the Fast table area is empty. This is why you need to apply heap blocks first, then release heap blocks, request heap blocks from an empty table, and then free up 8,16,24 bytes of heap space, because it is an integer multiple of 8, so it is prioritized into the fast table.
• Step to four release, the red box is the address of the 8,16,24 byte heap block.
• Then to 0x00361ea0 to see the structure of the fast table heap block, you can see, and empty table heap block There are two obvious differences, one is the block head of the flag bit is always 0x01, that is, busy, this is also the fast table heap block does not merge the reason; the other is the first block contains a pointer to the next heap block, There is no pointer to the previous heap block. (See the idle doubly linked list structure of the heap tables in the Windows environment for details)
• After the previous allocation release operation, the fast table is already non-empty, and if you request 8,16,24 bytes of heap space again, the system will be allocated directly from the block table. After the H2 release, the 16-byte heap is re-linked into the fast table.

• Data reference:
• King Qingyue. "0day Security: Software Vulnerability Analysis Technology (2nd edition)". Electronic industry Press. 2011
• Matt Connover. "Windows Heap Internals". 2004
• If there is any mistake, please correct me, thank you.

Introduction to the fast table of heap management system in Windows environment