Author: wopz0
Subject: Heaps listed in vmmap and windbg
Posted: 07 December 2013 at 11:37am
Hello everyone:
Subject: Heaps listed in vmmap and windbg
Posted: 07 December 2013 at 11:37am
Hello everyone:
I meet a problem nowdays,I got two different heap list of a running process from vmmap and windbg.After runing a simple process in win7 x64, I attached the process to windbg to analyze and typed !heap -h。A heap listed below:
process_heaps_addr = 77d7a6c0, heap_num:1,addr=560000
process_heaps_addr = 77d7a6c4, heap_num:2,addr=10000
process_heaps_addr = 77d7a6c8, heap_num:3,addr=20000
Clearly, There were three heaps in the process,
When I runned vmmap to monitor the address space of the same process and found there were only two heaps with totally different address(0x480000,0x710000)
Is the heap in vmmap and windbg the same concept?Why there are two diffrent heap list in the same process?Can someone gives any sugguestion?
