Find mapping between Windows heap and modules

Question

Hi all!

I am searching for a way to find a mapping between a heap and the module which owns the heap. I retrieve the heaps in the following way:

HANDLE heaps[1025];
DWORD nheaps = GetProcessHeaps((sizeof(heaps) / sizeof(HANDLE)) - 1, heaps);
for (DWORD i = 0; i < nheaps; ++i) {
  // find module which created for heap 
  // ...
}

The reason why i want to do that is that in my application i find round about 40 heaps, some are standard heaps, other are low-fragmentation heaps. Now i am trying to figure out which module uses which kind of heap.

Thanks a lot!

Answer 1

According to the MSDN docs, the GetProcessHeaps call given you the handles for all heaps in your current process, not all heaps in the system so there is no mapping to other processes.

Answer 2

Add a CreateHeap call to the very beginning of your program and put a breakpoint on it. Run. Step into the call (going to the disassembly level). Set a new breakpoint. Now continue and the breakpoint should be hit each time a new heap is created. The call stack will show you where it came from.

If the heaps are being created by global objects, those will happen before main(). You can poke around in your C run-time start-up code to set your breakpoint even earlier.