Using WinDbg to deeply understand the storage model of variables

The following is a simple test program that basically includes all of the variable types, including static, constant, global, local, and new.

#include <iostream>using namespacestd;Const Char* Global_const_string ="Hello World";intGlobal_int = -;Static intGlobal_static_int = -;intMain () {Static intLocal_static_int = -; intLocal_int = $; int* PValue =New int( -); cout<< global_const_string <<Global_int<< Global_static_int <<Local_static_int<< Local_int << *PValue; DeletePValue; System ("Pause"); return 0;}

In turn, we analyze the storage area to which each variable belongs:

We use WinDbg to debug our test program ConsoleTest.exe in the form of source code.
First we analyze the starting address of the ConsoleTest.exe module and the distribution of the internal data section, through the!address command:

*   400000   401000     mem_image   mem_commit  page_readonly       &NBS P              image "ConsoleTest.exe" |- 401000   41d000    1c000 ME M_image   Mem_commit  page_execute_read                  image "Con SoleTest.exe "|  41d000   422000     mem_image   Mem_commit  page_readonly   &NBSP ;                  image "ConsoleTest.exe" |- 422000   426000     4000 mem_image   Mem_commit  page_writecopy                 &NBSP ;   Image "ConsoleTest.exe" |- 426000   427000     mem_image   Mem_commit  page_read Only                      image "ConsoleTest.exe"

The

can see that the ConsoleTest.exe module's start address in memory is 0x400000, which can then be analyzed by!dh 0x400000 to analyze its internal data section distribution, and finally we can conclude that:
Address 400000- 401000:pe file header, property is read-only
Address  401000-41d000:. Text, property is read-only executable, represents code section
address  41d000- 422000:. Rdata, property is read-only, Represents a read-only data
address  422000- 426000:. Data, which is a write-on copy that represents the read-write Data
Address  426000-427000:. rsrc, the property is read-only, representing the resource section

with the!address-f:stack command we can see:

0:000>!address-f:stack   baseaddr endaddr+1 rgnsize     Type       State   &N Bsp             Protect             Usage------------------------- ------------------------------------------------------------------   40000   13d000     fd000 mem_private mem_reserve                           () nbsp        stack [8b0.1d0; ~0]  13d000   13e000     + mem_private mem_commit   page_readwrite| Page_guard          stack [8b0.1d0; ~0]  13e000   140000     Mem_private Mem_commit  page_readwrite                     Stack [8b0.1d0; ~0]You can see the stack start address of our main thread is: 13e000-140000

Next we first analyze the storage area of all global variables, and with the x consoletest!global* command, let the debugger list all the debug symbols that start with global in the Consoletest module:
0:000> x consoletest!global*
00422000 consoletest!global_const_string = 0x0041d1dc "Hello World"
00422004 Consoletest!global_int = 0n20
00422008 Consoletest!global_static_int = 0n30
004238a0 Consoletest!global_locale = 0x00000000 Through analysis we can see our 3 global variables global_const_string, Global_int, Global_static_ int is all distributed between 422000-426000. Data can be read and written in a section.
The content that global_const_string points to 0x0041d1dc "Hello World" is distributed between 41d000-422000. Rdata read-only data section, this conclusion is also in line with our usual understanding of the global variable storage area.

Here we try to analyze the storage area of the local variables, then the main function inside the cout place breakpoints, and then let the program run to this, and then enter the dv/t/i/v command to see all the local variables, you can see
0:000> dv/t/i/v
PRV local 0042200c int local_static_int = 0n100
PRV local 0013ff70 int local_int = 0n200
PRV local 0013ff74 int * PValue = 0X02248FF8 We can see that the local_static_int is also distributed between 422000-426000. Data can be read and written in sections, while Local_int and PValue are stored on the stack area between 13e000-140000.

The address pointed to by the pointer pvalue 0x02248ff8 we can parse by!address 0x02248ff8 command, the result is:
0:000>!address 0x02248ff8

Usage:heap
Allocation base:021d0000
Base address:02248000
End address:02249000
Region size:00001000
type:00020000 mem_private
state:00001000 Mem_commit
protect:00000004 Page_readwrite
More info:!heap-p 0x21d1000
More info:!heap-p-A 0X2248FF8 can see that the address 0x02248ff8 is above the heap.

From the above analysis, we have verified the usual C + + book on the various types of variable storage area assumptions, in short, the global variables and static variables will be compiled into the executable data section (read-only and readable and writable), non-static local variables are allocated on the stack, and the new (malloc The memory that comes out is allocated on the heap.

Transfer from http://www.cppblog.com/weiym/archive/2012/09/20/191429.html

Using WinDbg to deeply understand the storage model of variables