I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process:
0:000> dt nt!_PEB 0106c000
ntdll!_PEB
+0x000 InheritedAddressSpace : 0 ''
+0x001 ReadImageFileExecOptions : 0 ''
+0x002 BeingDebugged : 0x1 ''
+0x003 BitField : 0x4 ''
+0x003 ImageUsesLargePages : 0y0
+0x003 IsProtectedProcess : 0y0
+0x003 IsImageDynamicallyRelocated : 0y1
+0x003 SkipPatchingUser32Forwarders : 0y0
+0x003 IsPackagedProcess : 0y0
+0x003 IsAppContainer : 0y0
+0x003 IsProtectedProcessLight : 0y0
+0x003 IsLongPathAwareProcess : 0y0
+0x004 Mutant : 0xffffffff Void
+0x008 ImageBaseAddress : 0x00840000 Void
+0x00c Ldr : 0x77a4ebe0 _PEB_LDR_DATA
+0x010 ProcessParameters : 0x03b885e0 _RTL_USER_PROCESS_PARAMETERS
+0x014 SubSystemData : (null)
+0x018 ProcessHeap : 0x03b70000 Void
Now i want to examine the heap header, and apply the dt !_HEAP
to the ProcessHeap : 0x03b70000, but i can see that i get totaly invalid data in result. !heap -s
gives me totally different results for the heap,
LFH Key : 0xd5ec6951
Termination on corruption : ENABLED
Heap Flags Reserv Commit Virt Free List UCR Virt Lock Fast
(k) (k) (k) (k) length blocks cont. heap
-----------------------------------------------------------------------------
05e90000 00000002 1020 4 1020 2 1 1 0 0
00ff0000 00001002 60 4 60 2 1 1 0 0
I understand, that the address where the heap header starts must be calculated from this handle, ProcessHeap : 0x03b70000 Void but i don't understand how it is calculated. its not a va, because 00840000 + 03b70000 != 05e90000 , so how to get from the heap handle, to the actual address of _HEAP structure header?