Is it possible to see when a piece of memory is accessed when debugging in VC++ 6.0?

Question

I'm trying to debug an issue using VC++ 6.0. I think the problem is something accessing a buffer after it was freed, and so I'm wondering if the VC++ debugger has a nifty feature to monitor a block of memory and break as soon as something tries to access it.

Any ideas appreciated, as are very simple instructions :-)

Thanks, Sam.

Answer 1

I don't know about Visual Studio but i know that there is such feature in IDA disassembler. http://www.hex-rays.com/idapro/idadown.htm it is great application.

Answer 2

There's a simple technique you can use, prepend each buffer with a very specific binary pattern and when cleaning up the buffer set it to another value. Then when you go to use it, check to see if the beginning has the pattern you'd like to see.

If you're trying to debug a third party API and know that they use the new operator you could overwrite it. Although this suggestion isn't as simple or straight forward. I've had to debug third party API's for memory issues and it's a world of pain. Good luck and here's hoping someone else has more experience with this than I.

Answer 3

Limit the access to the buffer by having a getbuffer()/setbuffer() type functions. Then a break point at the beginning of these functions will let you see the call stack once the break point is hit. From this you can know how the control reached there.

Answer 4

If you have control over where the buffer is allocated and freed, you can allocate the buffer using the VirtualAlloc function (http://msdn.microsoft.com/en-us/library/aa366887%28v=VS.85%29.aspx).

To free this memory afterwards, you would normally use VirtualFree (http://msdn.microsoft.com/en-us/library/aa366892%28v=VS.85%29.aspx), but in your case its better to not free the buffer, but to protect it using VirtualProtect (http://msdn.microsoft.com/en-us/library/aa366898%28v=VS.85%29.aspx). Use the protection constant PAGE_NOACCESS (see http://msdn.microsoft.com/en-us/library/aa366786%28v=VS.85%29.aspx). Everyone accessing the page after this call will get an access violation.

Of course, this trick assumes that you don't use gigabytes of buffers, since the number of pages you can allocate this way is limited (by the size of the pagetable).

Answer 5

Visual Studio can set breakpoints on memory. You do need to know the address of the memory in question, so if you're overwriting the stack, it's not as helpful.