|  |  | @ -28,7 +28,6 @@ distribution. | 
			
		
	
		
		
			
				
					
					|  |  |  | #define WINVER 0x0501       // OpenThread(), PSAPI, Toolhelp32
 |  |  |  | #define WINVER 0x0501       // OpenThread(), PSAPI, Toolhelp32
 | 
			
		
	
		
		
			
				
					
					|  |  |  | #define WIN32_LEAN_AND_MEAN |  |  |  | #define WIN32_LEAN_AND_MEAN | 
			
		
	
		
		
			
				
					
					|  |  |  | #include <windows.h> |  |  |  | #include <windows.h> | 
			
		
	
		
		
			
				
					
					|  |  |  | #include <winnt.h> |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  | #include <psapi.h> |  |  |  | #include <psapi.h> | 
			
		
	
		
		
			
				
					
					|  |  |  | #include <tlhelp32.h> |  |  |  | #include <tlhelp32.h> | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
	
		
		
			
				
					|  |  | @ -234,28 +233,12 @@ struct HeapBlock | 
			
		
	
		
		
			
				
					
					|  |  |  |       ULONG reserved; |  |  |  |       ULONG reserved; | 
			
		
	
		
		
			
				
					
					|  |  |  | }; |  |  |  | }; | 
			
		
	
		
		
			
				
					
					|  |  |  | */ |  |  |  | */ | 
			
		
	
		
		
			
				
					
					|  |  |  | void HeapNodes(DWORD pid, map<char *, unsigned int> & heaps) |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  | { |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     // Create debug buffer
 |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     PDEBUG_BUFFER db = RtlCreateQueryDebugBuffer(0, FALSE);  |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     // Get process heap data
 |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     RtlQueryProcessDebugInformation( pid, PDI_HEAPS/* | PDI_HEAP_BLOCKS*/, db); |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     ULONG heapNodeCount = db->HeapInformation ? *PULONG(db->HeapInformation):0; |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     PDEBUG_HEAP_INFORMATION heapInfo = PDEBUG_HEAP_INFORMATION(PULONG(db-> HeapInformation) + 1); |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     // Go through each of the heap nodes and dispaly the information
 |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     for (unsigned int i = 0; i < heapNodeCount; i++)  |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     { |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |         heaps[(char *)heapInfo[i].Base] = i; |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     } |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     // Clean up the buffer
 |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |     RtlDestroyQueryDebugBuffer( db ); |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  | } |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  | // FIXME: NEEDS TESTING!
 |  |  |  | // FIXME: NEEDS TESTING!
 | 
			
		
	
		
		
			
				
					
					|  |  |  |  |  |  |  | // FIXME: <warmist> i noticed that if you enumerate it twice, second time it returns wrong .text region size
 | 
			
		
	
		
		
			
				
					
					|  |  |  | void Process::getMemRanges( vector<t_memrange> & ranges ) |  |  |  | void Process::getMemRanges( vector<t_memrange> & ranges ) | 
			
		
	
		
		
			
				
					
					|  |  |  | { |  |  |  | { | 
			
		
	
		
		
			
				
					
					|  |  |  |     MEMORY_BASIC_INFORMATION MBI; |  |  |  |     MEMORY_BASIC_INFORMATION MBI; | 
			
		
	
		
		
			
				
					
					|  |  |  |     map<char *, unsigned int> heaps; |  |  |  |     //map<char *, unsigned int> heaps;
 | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  |     uint64_t movingStart = 0; |  |  |  |     uint64_t movingStart = 0; | 
			
		
	
		
		
			
				
					
					|  |  |  |     map <char *, string> nameMap; |  |  |  |     map <char *, string> nameMap; | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
	
		
		
			
				
					|  |  | @ -264,7 +247,7 @@ void Process::getMemRanges( vector<t_memrange> & ranges ) | 
			
		
	
		
		
			
				
					
					|  |  |  |     GetSystemInfo(&si); |  |  |  |     GetSystemInfo(&si); | 
			
		
	
		
		
			
				
					
					|  |  |  |     uint64_t PageSize = si.dwPageSize; |  |  |  |     uint64_t PageSize = si.dwPageSize; | 
			
		
	
		
		
			
				
					
					|  |  |  |     // enumerate heaps
 |  |  |  |     // enumerate heaps
 | 
			
		
	
		
		
			
				
					
					|  |  |  |     HeapNodes(d->my_pid, heaps); |  |  |  |     // HeapNodes(d->my_pid, heaps);
 | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  |     // go through all the VM regions, convert them to our internal format
 |  |  |  |     // go through all the VM regions, convert them to our internal format
 | 
			
		
	
		
		
			
				
					
					|  |  |  |     while (VirtualQueryEx(d->my_handle, (const void*) (movingStart), &MBI, sizeof(MBI)) == sizeof(MBI)) |  |  |  |     while (VirtualQueryEx(d->my_handle, (const void*) (movingStart), &MBI, sizeof(MBI)) == sizeof(MBI)) | 
			
		
	
		
		
			
				
					
					|  |  |  |     { |  |  |  |     { | 
			
		
	
	
		
		
			
				
					|  |  | @ -294,14 +277,7 @@ void Process::getMemRanges( vector<t_memrange> & ranges ) | 
			
		
	
		
		
			
				
					
					|  |  |  |                 if( !(MBI.Type & MEM_PRIVATE) ) |  |  |  |                 if( !(MBI.Type & MEM_PRIVATE) ) | 
			
		
	
		
		
			
				
					
					|  |  |  |                     continue; |  |  |  |                     continue; | 
			
		
	
		
		
			
				
					
					|  |  |  |                 else |  |  |  |                 else | 
			
		
	
		
		
			
				
					
					|  |  |  |                 { |  |  |  |                     temp.name[0]=0; | 
			
				
				
			
		
	
		
		
			
				
					
					|  |  |  |                     // could be a heap?
 |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |                     if(heaps.count((char *)temp.start)) |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |                     { |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |                         sprintf(temp.name,"HEAP %d",heaps[(char*)temp.start]); |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |                     } |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |                     else temp.name[0]=0; |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  |                 } |  |  |  |  | 
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  |             } |  |  |  |             } | 
			
		
	
		
		
			
				
					
					|  |  |  |         } |  |  |  |         } | 
			
		
	
		
		
			
				
					
					|  |  |  |         else |  |  |  |         else | 
			
		
	
	
		
		
			
				
					|  |  | 
 |