【转】Getting Process Heaps

This example illustrates the use of the GetProcessHeaps function to retrieve handles to the default process heap and any private heaps that are active for the current process.

The example calls GetProcessHeaps twice, first to calculate the size of the buffer needed and again to retrieve handles into the buffer. The buffer is allocated from the default process heap, using the handle returned by GetProcessHeap . The example prints the starting address of each heap to the console. It then uses the HeapFree function to free memory allocated for the buffer.

The number of heaps in a process may vary. A process always has at least one heap—the default process heap—and it may have one or more private heaps created by the application or by DLLs that are loaded into the address space of the process.

Note that an application should call heap functions only on its default process heap or on private heaps that the application has created; calling heap functions on a private heap owned by another component may cause undefined behavior.

代码：

#include <windows.h>
 #include <tchar.h>
 #include <stdio.h>
 //#include <intsafe.h>

 int __cdecl _tmain()
 {
     DWORD NumberOfHeaps;
     DWORD HeapsIndex;
     DWORD HeapsLength;
     HANDLE hDefaultProcessHeap;
     HRESULT Result;
     PHANDLE aHeaps;
     SIZE_T BytesToAllocate;

     //
     // Retrieve the number of active heaps for the current process
     // so we can calculate the buffer size needed for the heap handles.
     //
     NumberOfHeaps = GetProcessHeaps(0, NULL);
     if (NumberOfHeaps == 0) {
         _tprintf(TEXT("Failed to retrieve the number of heaps with LastError %d.\n"),
                  GetLastError());
         return 1;
     }

     //
     // Calculate the buffer size.
     //
     //Result = SIZETMult(NumberOfHeaps, sizeof(*aHeaps), &BytesToAllocate);
     //if (Result != S_OK) {
     //    _tprintf(TEXT("SIZETMult failed with HR %d.\n"), Result);
     //    return 1;
    // }
　　BytesToAllocate = NumberOfHeaps * sizeof(*aHeaps);

     //
     // Get a handle to the default process heap.
     //
     hDefaultProcessHeap = GetProcessHeap();
     if (hDefaultProcessHeap == NULL) {
         _tprintf(TEXT("Failed to retrieve the default process heap with LastError %d.\n"),
                  GetLastError());
         return 1;
     }

     //
     // Allocate the buffer from the default process heap.
     //
     aHeaps = (PHANDLE)HeapAlloc(hDefaultProcessHeap, 0, BytesToAllocate);
     if (aHeaps == NULL) {
         _tprintf(TEXT("HeapAlloc failed to allocate %d bytes.\n"),
                  BytesToAllocate);
         return 1;
     }

     // 
     // Save the original number of heaps because we are going to compare it
     // to the return value of the next GetProcessHeaps call.
     //
     HeapsLength = NumberOfHeaps;

     //
     // Retrieve handles to the process heaps and print them to stdout. 
     // Note that heap functions should be called only on the default heap of the process
     // or on private heaps that your component creates by calling HeapCreate.
     //
     NumberOfHeaps = GetProcessHeaps(HeapsLength, aHeaps);
     if (NumberOfHeaps == 0) {
         _tprintf(TEXT("Failed to retrieve heaps with LastError %d.\n"),
                  GetLastError());
         return 1;
     }
     else if (NumberOfHeaps > HeapsLength) {

         //
         // Compare the latest number of heaps with the original number of heaps.
         // If the latest number is larger than the original number, another
         // component has created a new heap and the buffer is too small.
         //
         _tprintf(TEXT("Another component created a heap between calls. ") \
                  TEXT("Please try again.\n"));
         return 1;
     }

     _tprintf(TEXT("Process has %d heaps.\n"), HeapsLength);
     for (HeapsIndex = 0; HeapsIndex < HeapsLength; ++HeapsIndex) {
         _tprintf(TEXT("Heap %d at address: %#p.\n"),
                  HeapsIndex,
                  aHeaps[HeapsIndex]);
     }
  
     //
     // Release memory allocated from default process heap.
     //
     if (HeapFree(hDefaultProcessHeap, 0, aHeaps) == FALSE) {
         _tprintf(TEXT("Failed to free allocation from default process heap.\n"));
     }

     return 0;
 }

结果：

　　

转自：http://msdn.microsoft.com/en-us/library/ee175820(v=vs.85).aspx

说明：

• heap handle就是堆地址
• GetProcessHeap（）获取默认堆地址0x00150000
• 在进程的用户区存着一个叫PEB(进程环境块)的结构，这个结构中存放着一些有关进程的重要信息，其中在PEB首地址偏移0x18处存放的ProcessHeap就是进程默认堆的地址，而偏移0x90处存放了指向进程所有堆的地址列表的指针。
• AP（malloc/new）--->CRT(HeapCreat)--->Heap Manager(VirtualAlloc)--->Windows