new and delete container Dlls

Question

I want to hook new and delete operators. But I am unable to locate the original DLLs where these operators reside. I used msvcr90.dll, msvsr90d.dll, msvcrt.dll, kernal32.dll, ole32.dll and some more dlls as well. But my spying application is unable to locate new and delete operators.

Kindly if someone could tell me in which DLL new and delete operators are defined.

Answer 1

As you say yourself, new and delete are operators, not functions. As such, and as C++-only features, they will probably be defined either in the standard C++ library (libstdc++) or within the compiler you're using.

Answer 2

They are in msvcr90.dll. Don't forget that these are C++ operators, the name mangling algorithm does quite a job on them. Copied from the dumpbin /exports output:

 15    F 00063E99 ??2@YAPAXI@Z         // void * __cdecl operator new(unsigned int)
 ...
 17   11 00063F03 ??3@YAXPAX@Z         // void __cdecl operator delete(void *)

I used the undname.exe utility to convert the mangled name back. There are several overloads present as well.