windows Heap manager

前缀

我们首先看一下关于heap函数的前缀使用：
1. its native interfaces ( prefixed with rtl ) are available only for use in internal windows components or kernel-mode device drivers.
2. The documented windows api interfaces to the heap ( prefixed with heap ) are forwarders to the native functions in ntdll.dll
3. legacy api (prefixed with local or global ) are provide to support older windows applications
4. the C runtime uses the heap manager when using functions such as malloc,free and the C++ new operator.
接着我们看一下heap的作用：
1. A heap can manage allocations either large memory regions reserved from the memory manager via virtualalloc or from memory mapped file objects mapped in ther process address space.
2. it suitable for scenarios where the content of the blocks needs to be shared between two processes or between a kernel-mode and a user-mode component.

RtlCreateHeap

我们已经知道heap前缀的函数位于ntdll.dll中，我们首先看看堆的创建，其核心实现又是通过rtl堆前缀来具体实现的。
so，我们主要看rtl前缀的函数实现。

HANDLE NTAPIRtlCreateHeap(ULONG Flags,              PVOID Addr,              SIZE_T TotalSize,              SIZE_T CommitSize,              PVOID Lock,              PRTL_HEAP_PARAMETERS Parameters){    PVOID CommittedAddress = NULL, UncommittedAddress = NULL;    PHEAP Heap = NULL;    RTL_HEAP_PARAMETERS SafeParams = {0};    ULONG_PTR MaximumUserModeAddress;    SYSTEM_BASIC_INFORMATION SystemInformation;    MEMORY_BASIC_INFORMATION MemoryInfo;    ULONG NtGlobalFlags = RtlGetNtGlobalFlags();    ULONG HeapSegmentFlags = 0;    NTSTATUS Status;    ULONG MaxBlockSize;    /* Check for a special heap */    if (RtlpPageHeapEnabled && !Addr && !Lock)    {        Heap = RtlpPageHeapCreate(Flags, Addr, TotalSize, CommitSize, Lock, Parameters);        if (Heap) return Heap;        /* Reset a special Parameters == -1 hack */        if ((ULONG_PTR)Parameters == (ULONG_PTR)-1)            Parameters = NULL;        else            DPRINT1("Enabling page heap failed\n");    }    /* Check validation flags */    if (!(Flags & HEAP_SKIP_VALIDATION_CHECKS) && (Flags & ~HEAP_CREATE_VALID_MASK))    {        DPRINT1("Invalid flags 0x%08x, fixing...\n", Flags);        Flags &= HEAP_CREATE_VALID_MASK;    }    /* TODO: Capture parameters, once we decide to use SEH */    if (!Parameters) Parameters = &SafeParams;    /* Check global flags */    if (NtGlobalFlags & FLG_HEAP_DISABLE_COALESCING)        Flags |= HEAP_DISABLE_COALESCE_ON_FREE;    if (NtGlobalFlags & FLG_HEAP_ENABLE_FREE_CHECK)        Flags |= HEAP_FREE_CHECKING_ENABLED;    if (NtGlobalFlags & FLG_HEAP_ENABLE_TAIL_CHECK)        Flags |= HEAP_TAIL_CHECKING_ENABLED;    if (RtlpGetMode() == UserMode)    {        /* Also check these flags if in usermode */        if (NtGlobalFlags & FLG_HEAP_VALIDATE_ALL)            Flags |= HEAP_VALIDATE_ALL_ENABLED;        if (NtGlobalFlags & FLG_HEAP_VALIDATE_PARAMETERS)            Flags |= HEAP_VALIDATE_PARAMETERS_ENABLED;        if (NtGlobalFlags & FLG_USER_STACK_TRACE_DB)            Flags |= HEAP_CAPTURE_STACK_BACKTRACES;    }    /* Set tunable parameters */    RtlpSetHeapParameters(Parameters);    /* Get the max um address */    Status = ZwQuerySystemInformation(SystemBasicInformation,                                      &SystemInformation,                                      sizeof(SystemInformation),                                      NULL);    if (!NT_SUCCESS(Status))    {        DPRINT1("Getting max usermode address failed with status 0x%08x\n", Status);        return NULL;    }    MaximumUserModeAddress = SystemInformation.MaximumUserModeAddress;    /* Calculate max alloc size */    if (!Parameters->MaximumAllocationSize)        Parameters->MaximumAllocationSize = MaximumUserModeAddress - (ULONG_PTR)0x10000 - PAGE_SIZE;    MaxBlockSize = 0x80000 - PAGE_SIZE;    if (!Parameters->VirtualMemoryThreshold ||        Parameters->VirtualMemoryThreshold > MaxBlockSize)    {        Parameters->VirtualMemoryThreshold = MaxBlockSize;    }    /* Check reserve/commit sizes and set default values */    if (!CommitSize)    {        CommitSize = PAGE_SIZE;        if (TotalSize)            TotalSize = ROUND_UP(TotalSize, PAGE_SIZE);        else            TotalSize = 64 * PAGE_SIZE;    }    else    {        /* Round up the commit size to be at least the page size */        CommitSize = ROUND_UP(CommitSize, PAGE_SIZE);        if (TotalSize)            TotalSize = ROUND_UP(TotalSize, PAGE_SIZE);        else            TotalSize = ROUND_UP(CommitSize, 16 * PAGE_SIZE);    }    /* Call special heap */    if (RtlpHeapIsSpecial(Flags))        return RtlDebugCreateHeap(Flags, Addr, TotalSize, CommitSize, Lock, Parameters);    /* Without serialization, a lock makes no sense */    if ((Flags & HEAP_NO_SERIALIZE) && (Lock != NULL))        return NULL;    /* See if we are already provided with an address for the heap */    if (Addr)    {        if (Parameters->CommitRoutine)        {            /* There is a commit routine, so no problem here, check params */            if ((Flags & HEAP_GROWABLE) ||                !Parameters->InitialCommit ||                !Parameters->InitialReserve ||                (Parameters->InitialCommit > Parameters->InitialReserve))            {                /* Fail */                return NULL;            }            /* Calculate committed and uncommitted addresses */            CommittedAddress = Addr;            UncommittedAddress = (PCHAR)Addr + Parameters->InitialCommit;            TotalSize = Parameters->InitialReserve;            /* Zero the initial page ourselves */            RtlZeroMemory(CommittedAddress, PAGE_SIZE);        }        else        {            /* Commit routine is absent, so query how much memory caller reserved */            Status = ZwQueryVirtualMemory(NtCurrentProcess(),                                          Addr,                                          MemoryBasicInformation,                                          &MemoryInfo,                                          sizeof(MemoryInfo),                                          NULL);            if (!NT_SUCCESS(Status))            {                DPRINT1("Querying amount of user supplied memory failed with status 0x%08X\n", Status);                return NULL;            }            /* Validate it */            if (MemoryInfo.BaseAddress != Addr ||                MemoryInfo.State == MEM_FREE)            {                return NULL;            }            /* Validation checks passed, set committed/uncommitted addresses */            CommittedAddress = Addr;            /* Check if it's committed or not */            if (MemoryInfo.State == MEM_COMMIT)            {                /* Zero it out because it's already committed */                RtlZeroMemory(CommittedAddress, PAGE_SIZE);                /* Calculate uncommitted address value */                CommitSize = MemoryInfo.RegionSize;                TotalSize = CommitSize;                UncommittedAddress = (PCHAR)Addr + CommitSize;                /* Check if uncommitted address is reserved */                Status = ZwQueryVirtualMemory(NtCurrentProcess(),                                              UncommittedAddress,                                              MemoryBasicInformation,                                              &MemoryInfo,                                              sizeof(MemoryInfo),                                              NULL);                if (NT_SUCCESS(Status) &&                    MemoryInfo.State == MEM_RESERVE)                {                    /* It is, so add it up to the reserve size */                    TotalSize += MemoryInfo.RegionSize;                }            }            else            {                /* It's not committed, inform following code that a commit is necessary */                CommitSize = PAGE_SIZE;                UncommittedAddress = Addr;            }        }        /* Mark this as a user-committed mem */        HeapSegmentFlags = HEAP_USER_ALLOCATED;        Heap = (PHEAP)Addr;    }    else    {        /* Check commit routine */        if (Parameters->CommitRoutine) return NULL;        /* Reserve memory */        Status = ZwAllocateVirtualMemory(NtCurrentProcess(),                                         (PVOID *)&Heap,                                         0,                                         &TotalSize,                                         MEM_RESERVE,                                         PAGE_READWRITE);        if (!NT_SUCCESS(Status))        {            DPRINT1("Failed to reserve memory with status 0x%08x\n", Status);            return NULL;        }        /* Set base addresses */        CommittedAddress = Heap;        UncommittedAddress = Heap;    }    /* Check if we need to commit something */    if (CommittedAddress == UncommittedAddress)    {        /* Commit the required size */        Status = ZwAllocateVirtualMemory(NtCurrentProcess(),                                         &CommittedAddress,                                         0,                                         &CommitSize,                                         MEM_COMMIT,                                         PAGE_READWRITE);        DPRINT("Committed %Iu bytes at base %p\n", CommitSize, CommittedAddress);        if (!NT_SUCCESS(Status))        {            DPRINT1("Failure, Status 0x%08X\n", Status);            /* Release memory if it was reserved */            if (!Addr) ZwFreeVirtualMemory(NtCurrentProcess(),                                           (PVOID *)&Heap,                                           &TotalSize,                                           MEM_RELEASE);            return NULL;        }        /* Calculate new uncommitted address */        UncommittedAddress = (PCHAR)UncommittedAddress + CommitSize;    }    /* Initialize the heap */    Status = RtlpInitializeHeap(Heap, Flags, Lock, Parameters);    if (!NT_SUCCESS(Status))    {        DPRINT1("Failed to initialize heap (%x)\n", Status);        return NULL;    }    /* Initialize heap's first segment */    Status = RtlpInitializeHeapSegment(Heap, (PHEAP_SEGMENT) (Heap), 0, HeapSegmentFlags, TotalSize, CommitSize);    if (!NT_SUCCESS(Status))    {        DPRINT1("Failed to initialize heap segment (%x)\n", Status);        return NULL;    }    DPRINT("Created heap %p, CommitSize %x, ReserveSize %x\n", Heap, CommitSize, TotalSize);    /* Add heap to process list in case of usermode heap */    if (RtlpGetMode() == UserMode)    {        RtlpAddHeapToProcessList(Heap);        // FIXME: What about lookasides?    }    return Heap;}

函数开始我们检查是否是要申请页面堆，如果是我们换到RtlpPageHeapCreate来申请。
否则我们开始检查创建标志的有效性，并主要判断NtGlobalFlags的标志，来更新我们自己的创建标志。而NtGlobalFlags是一个全局变量。然后我们查询系统信息，来看看我们能申请的最大空间为多少并计算出我们max alloc size.
然后我们接着检查参数，这次我们检查 CommitSize 和 TotalSize，如果用户未指定值，我们设置默认值，如果用户指定值，我们设置好其粒度。
然后我们判断Flags创建标志，看看是否我们要创建debug堆。符合如下标志时我们要创建。

HEAP_FLAG_PAGE_ALLOCS |                 HEAP_VALIDATE_ALL_ENABLED |                 HEAP_VALIDATE_PARAMETERS_ENABLED |                 HEAP_CAPTURE_STACK_BACKTRACES |                 HEAP_CREATE_ENABLE_TRACING

如果我们指定的flags中制定无序列话，而且还没指定锁，这个是不允许的，对于堆来说不安全。
然后我们使用zwAllocateVirtualMemory，在内核的内存管理器中申请内存，申请方式是MEM_RESERVE即内存保留模式。申请大小为TotalSize
我们接着检查是否需要提交一部分内存，如果需要的话，我们提交CommitSize大小的内存，当然我们设置的MEM_COMMIT形式来提交内存，使用的依旧是ZwAllocateVirtualMemory。
当我们做完前期准备后需要初始化我们的heap，其实是初始化我们这个数据结构，是的这块区域有其自己独特的含义。
我们来看一下heap的结构

typedef struct _HEAP {    HEAP_ENTRY Entry;    ULONG SegmentSignature;    ULONG SegmentFlags;    LIST_ENTRY SegmentListEntry;    struct _HEAP *Heap;    PVOID BaseAddress;    ULONG NumberOfPages;    PHEAP_ENTRY FirstEntry;    PHEAP_ENTRY LastValidEntry;    ULONG NumberOfUnCommittedPages;    ULONG NumberOfUnCommittedRanges;    USHORT SegmentAllocatorBackTraceIndex;    USHORT Reserved;    LIST_ENTRY UCRSegmentList;    ULONG Flags;    ULONG ForceFlags;    ULONG CompatibilityFlags;    ULONG EncodeFlagMask;    HEAP_ENTRY Encoding;    ULONG_PTR PointerKey;    ULONG Interceptor;    ULONG VirtualMemoryThreshold;    ULONG Signature;    SIZE_T SegmentReserve;    SIZE_T SegmentCommit;    SIZE_T DeCommitFreeBlockThreshold;    SIZE_T DeCommitTotalFreeThreshold;    SIZE_T TotalFreeSize;    SIZE_T MaximumAllocationSize;    USHORT ProcessHeapsListIndex;    USHORT HeaderValidateLength;    PVOID HeaderValidateCopy;    USHORT NextAvailableTagIndex;    USHORT MaximumTagIndex;    PHEAP_TAG_ENTRY TagEntries;    LIST_ENTRY UCRList;    LIST_ENTRY UCRSegments; // FIXME: non-Vista    ULONG_PTR AlignRound;    ULONG_PTR AlignMask;    LIST_ENTRY VirtualAllocdBlocks;                    //    向内存管理器申请的内存链接在这个链表中    LIST_ENTRY SegmentList;    struct _HEAP_SEGMENT *Segments[HEAP_SEGMENTS]; //FIXME: non-Vista    USHORT AllocatorBackTraceIndex;    ULONG NonDedicatedListLength;    PVOID BlocksIndex; // HEAP_LIST_LOOKUP    PVOID UCRIndex;    PHEAP_PSEUDO_TAG_ENTRY PseudoTagEntries;    LIST_ENTRY FreeLists[HEAP_FREELISTS]; //FIXME: non-Vista                    //128块小空间    //LIST_ENTRY FreeLists;    union    {        ULONG FreeListsInUseUlong[HEAP_FREELISTS / (sizeof(ULONG) * 8)]; //FIXME: non-Vista        UCHAR FreeListsInUseBytes[HEAP_FREELISTS / (sizeof(UCHAR) * 8)]; //FIXME: non-Vista    } u;    PHEAP_LOCK LockVariable;    PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;    PVOID FrontEndHeap;    USHORT FrontHeapLockCount;    UCHAR FrontEndHeapType;    HEAP_COUNTERS Counters;    HEAP_TUNING_PARAMETERS TuningParameters;} HEAP, *PHEAP;

下面我们来看一下RtlInitializeHeap，函数的开始，计算头部大小。然后填写结构的内部信息。特别的，当我们指定用户锁时，我们内部函数也要初始化这个锁。接着我们要初始化这个结构内部的链表
当我们都初始化完事了，我们在RtlCreateHeap中开始初始化第一个segment，我们调用RtlpInitializeHeapSegment，其实函数内部就是初始化segment这个结构变量。数据的内部结构在其他函数中也会被进行操作。其数据结构如下：

typedef struct _HEAP_SEGMENT{    HEAP_ENTRY Entry;    ULONG SegmentSignature;    ULONG SegmentFlags;    LIST_ENTRY SegmentListEntry;    PHEAP Heap;    PVOID BaseAddress;    ULONG NumberOfPages;    PHEAP_ENTRY FirstEntry;    PHEAP_ENTRY LastValidEntry;    ULONG NumberOfUnCommittedPages;    ULONG NumberOfUnCommittedRanges;    USHORT SegmentAllocatorBackTraceIndex;    USHORT Reserved;    LIST_ENTRY UCRSegmentList;} HEAP_SEGMENT, *PHEAP_SEGMENT;

在创建heap结束的时候，判断是否在用户模式，如果是，则添加这个堆到用户的进程链表中。在RtlAddHeapToProcessList函数中，我们获取当前进程的PEB，进入临界区锁模式，我们在ProcessHeaps中记录当前堆地址，并递增堆计数，设置ProcessHeapsListIndex。
段的内部又分很多堆块，这些堆块从freelist中申请，其数据结构如下定义

typedef struct _HEAP_ENTRY{    struct _HEAP_COMMON_ENTRY;}  HEAP_ENTRY, *PHEAP_ENTRY;/* Heap structures */struct _HEAP_COMMON_ENTRY{#ifdef _M_AMD64    PVOID PreviousBlockPrivateData;#endif    union    {        struct        {            USHORT Size;            UCHAR Flags;            UCHAR SmallTagIndex;        };        struct        {#ifndef _M_AMD64            PVOID SubSegmentCode;#else            ULONG SubSegmentCodeDummy;#endif            USHORT PreviousSize;            union            {                UCHAR SegmentOffset;                UCHAR LFHFlags;            };            UCHAR UnusedBytes;        };        struct        {            USHORT FunctionIndex;            USHORT ContextValue;        };        struct        {            ULONG InterceptorValue;            USHORT UnusedBytesLength;            UCHAR EntryOffset;            UCHAR ExtendedBlockSignature;        };        struct        {            ULONG Code1;            USHORT Code2;            UCHAR Code3;            UCHAR Code4;        };        ULONGLONG AgregateCode;    };};

RtlAllocateHeap

当我们创建好堆后，我们就可以在这个堆上申请空间了。

PVOID NTAPIRtlAllocateHeap(IN PVOID HeapPtr,                IN ULONG Flags,                IN SIZE_T Size){    PHEAP Heap = (PHEAP)HeapPtr;    PULONG FreeListsInUse;    ULONG FreeListsInUseUlong;    SIZE_T AllocationSize;    SIZE_T Index, InUseIndex, i;    PLIST_ENTRY FreeListHead;    PHEAP_ENTRY InUseEntry;    PHEAP_FREE_ENTRY FreeBlock;    UCHAR FreeFlags, EntryFlags = HEAP_ENTRY_BUSY;    EXCEPTION_RECORD ExceptionRecord;    BOOLEAN HeapLocked = FALSE;    PHEAP_VIRTUAL_ALLOC_ENTRY VirtualBlock = NULL;    PHEAP_ENTRY_EXTRA Extra;    NTSTATUS Status;    /* Force flags */    Flags |= Heap->ForceFlags;    /* Call special heap */    if (RtlpHeapIsSpecial(Flags))        return RtlDebugAllocateHeap(Heap, Flags, Size);    /* Check for the maximum size */    if (Size >= 0x80000000)    {        RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_NO_MEMORY);        DPRINT1("HEAP: Allocation failed!\n");        return NULL;    }    if (Flags & (HEAP_CREATE_ENABLE_TRACING |                 HEAP_CREATE_ALIGN_16))    {        DPRINT1("HEAP: RtlAllocateHeap is called with unsupported flags %x, ignoring\n", Flags);    }    //DPRINT("RtlAllocateHeap(%p %x %x)\n", Heap, Flags, Size);    /* Calculate allocation size and index */    if (Size)        AllocationSize = Size;    else        AllocationSize = 1;    AllocationSize = (AllocationSize + Heap->AlignRound) & Heap->AlignMask;    /* Add extra flags in case of settable user value feature is requested,       or there is a tag (small or normal) or there is a request to       capture stack backtraces */    if ((Flags & HEAP_EXTRA_FLAGS_MASK) ||        Heap->PseudoTagEntries)    {        /* Add flag which means that the entry will have extra stuff attached */        EntryFlags |= HEAP_ENTRY_EXTRA_PRESENT;        /* Account for extra stuff size */        AllocationSize += sizeof(HEAP_ENTRY_EXTRA);    }    /* Add settable user flags, if any */    EntryFlags |= (Flags & HEAP_SETTABLE_USER_FLAGS) >> 4;    Index = AllocationSize >>  HEAP_ENTRY_SHIFT;    /* Acquire the lock if necessary */    if (!(Flags & HEAP_NO_SERIALIZE))    {        RtlEnterHeapLock(Heap->LockVariable, TRUE);        HeapLocked = TRUE;    }    /* Depending on the size, the allocation is going to be done from dedicated,       non-dedicated lists or a virtual block of memory */    if (Index < HEAP_FREELISTS)    {        FreeListHead = &Heap->FreeLists[Index];        if (!IsListEmpty(FreeListHead))        {            /* There is a free entry in this list */            FreeBlock = CONTAINING_RECORD(FreeListHead->Blink,                                          HEAP_FREE_ENTRY,                                          FreeList);            /* Save flags and remove the free entry */            FreeFlags = FreeBlock->Flags;            RtlpRemoveFreeBlock(Heap, FreeBlock, TRUE, FALSE);            /* Update the total free size of the heap */            Heap->TotalFreeSize -= Index;            /* Initialize this block */            InUseEntry = (PHEAP_ENTRY)FreeBlock;            InUseEntry->Flags = EntryFlags | (FreeFlags & HEAP_ENTRY_LAST_ENTRY);            InUseEntry->UnusedBytes = (UCHAR)(AllocationSize - Size);            InUseEntry->SmallTagIndex = 0;        }        else        {            /* Find smallest free block which this request could fit in */            InUseIndex = Index >> 5;            FreeListsInUse = &Heap->u.FreeListsInUseUlong[InUseIndex];            /* This bit magic disables all sizes which are less than the requested allocation size */            FreeListsInUseUlong = *FreeListsInUse++ & ~((1 << ((ULONG)Index & 0x1f)) - 1);            /* If size is definitily more than our lists - go directly to the non-dedicated one */            if (InUseIndex > 3)                return RtlpAllocateNonDedicated(Heap, Flags, Size, AllocationSize, Index, HeapLocked);            /* Go through the list */            for (i = InUseIndex; i < 4; i++)            {                if (FreeListsInUseUlong)                {                    FreeListHead = &Heap->FreeLists[i * 32];                    break;                }                if (i < 3) FreeListsInUseUlong = *FreeListsInUse++;            }            /* Nothing found, search in the non-dedicated list */            if (i == 4)                return RtlpAllocateNonDedicated(Heap, Flags, Size, AllocationSize, Index, HeapLocked);            /* That list is found, now calculate exact block  */            FreeListHead += RtlpFindLeastSetBit(FreeListsInUseUlong);            /* Take this entry and remove it from the list of free blocks */            FreeBlock = CONTAINING_RECORD(FreeListHead->Blink,                                          HEAP_FREE_ENTRY,                                          FreeList);            RtlpRemoveFreeBlock(Heap, FreeBlock, TRUE, FALSE);            /* Split it */            InUseEntry = RtlpSplitEntry(Heap, Flags, FreeBlock, AllocationSize, Index, Size);        }        /* Release the lock */        if (HeapLocked) RtlLeaveHeapLock(Heap->LockVariable);        /* Zero memory if that was requested */        if (Flags & HEAP_ZERO_MEMORY)            RtlZeroMemory(InUseEntry + 1, Size);        else if (Heap->Flags & HEAP_FREE_CHECKING_ENABLED)        {            /* Fill this block with a special pattern */            RtlFillMemoryUlong(InUseEntry + 1, Size & ~0x3, ARENA_INUSE_FILLER);        }        /* Fill tail of the block with a special pattern too if requested */        if (Heap->Flags & HEAP_TAIL_CHECKING_ENABLED)        {            RtlFillMemory((PCHAR)(InUseEntry + 1) + Size, sizeof(HEAP_ENTRY), HEAP_TAIL_FILL);            InUseEntry->Flags |= HEAP_ENTRY_FILL_PATTERN;        }        /* Prepare extra if it's present */        if (InUseEntry->Flags & HEAP_ENTRY_EXTRA_PRESENT)        {            Extra = RtlpGetExtraStuffPointer(InUseEntry);            RtlZeroMemory(Extra, sizeof(HEAP_ENTRY_EXTRA));            // TODO: Tagging        }        /* User data starts right after the entry's header */        return InUseEntry + 1;    }    else if (Index <= Heap->VirtualMemoryThreshold)    {        /* The block is too large for dedicated lists, but fine for a non-dedicated one */        return RtlpAllocateNonDedicated(Heap, Flags, Size, AllocationSize, Index, HeapLocked);    }    else if (Heap->Flags & HEAP_GROWABLE)    {        /* We've got a very big allocation request, satisfy it by directly allocating virtual memory */        AllocationSize += sizeof(HEAP_VIRTUAL_ALLOC_ENTRY) - sizeof(HEAP_ENTRY);        Status = ZwAllocateVirtualMemory(NtCurrentProcess(),                                         (PVOID *)&VirtualBlock,                                         0,                                         &AllocationSize,                                         MEM_COMMIT,                                         PAGE_READWRITE);        if (!NT_SUCCESS(Status))        {            // Set STATUS!            /* Release the lock */            if (HeapLocked) RtlLeaveHeapLock(Heap->LockVariable);            DPRINT1("HEAP: Allocation failed!\n");            return NULL;        }        /* Initialize the newly allocated block */        VirtualBlock->BusyBlock.Size = (USHORT)(AllocationSize - Size);        VirtualBlock->BusyBlock.Flags = EntryFlags | HEAP_ENTRY_VIRTUAL_ALLOC | HEAP_ENTRY_EXTRA_PRESENT;        VirtualBlock->CommitSize = AllocationSize;        VirtualBlock->ReserveSize = AllocationSize;        /* Insert it into the list of virtual allocations */        InsertTailList(&Heap->VirtualAllocdBlocks, &VirtualBlock->Entry);        /* Release the lock */        if (HeapLocked) RtlLeaveHeapLock(Heap->LockVariable);        /* Return pointer to user data */        return VirtualBlock + 1;    }    /* Generate an exception */    if (Flags & HEAP_GENERATE_EXCEPTIONS)    {        ExceptionRecord.ExceptionCode = STATUS_NO_MEMORY;        ExceptionRecord.ExceptionRecord = NULL;        ExceptionRecord.NumberParameters = 1;        ExceptionRecord.ExceptionFlags = 0;        ExceptionRecord.ExceptionInformation[0] = AllocationSize;        RtlRaiseException(&ExceptionRecord);    }    RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_BUFFER_TOO_SMALL);    /* Release the lock */    if (HeapLocked) RtlLeaveHeapLock(Heap->LockVariable);    DPRINT1("HEAP: Allocation failed!\n");    return NULL;}

在函数中，我们判断标志位，判断是否是申请一个debug空间，如果是转向RtlDebugAllocateHeap来创建空间，如果不是继续判断申请的空间大小是否过大。
判断当前是否是序列化访问，如果不是还要进入堆互斥区，进行互斥访问。
我们根据申请的大小计算出索引 Index = AllocationSize >> HEAP_ENTRY_SHIFT;
reactos中注释如下，清晰的解释了，可以申请三类内存
/* Depending on the size, the allocation is going to be done from dedicated,
non-dedicated lists or a virtual block of memory */

1.如果索引号小于128 即 index < HEAP_FREELISTS 使用的是dedicated的链表
我们首先得到空闲链表的链表头FreeListHead = &Heap->FreeLists[Index];
a) 如果我们的空闲链表不空，我们则从链表中取出一块空间，并从这块链表中移除这个空间。

            /* There is a free entry in this list */            FreeBlock = CONTAINING_RECORD(FreeListHead->Blink,                                          HEAP_FREE_ENTRY,                                          FreeList);

接着我们初始化这个空间，设置好表述这块空间的数据结构PHEAP_ENTRY，降低总体空闲大小计数。

            /* Initialize this block */            InUseEntry = (PHEAP_ENTRY)FreeBlock;            InUseEntry->Flags = EntryFlags | (FreeFlags & HEAP_ENTRY_LAST_ENTRY);            InUseEntry->UnusedBytes = (UCHAR)(AllocationSize - Size);            InUseEntry->SmallTagIndex = 0;

b) 如果空闲链表为空，说明没有适合的，我们找更大的块，将其分割出比较小的适合应用程序使用的内存。我们修改索引InUseIndex = Index >> 5;即扩展到第二个位置上。然后在其上找到内存块FreeListHead = &Heap->FreeLists[i * 32];

2.如果申请的空间小于VirtualMemoryThreshold（为虚拟内存分配阈值，表示可以在段中分配的堆块的最大有效（即应用程序可以实际使用的）值，该值为508kB。），却Index >( AllocationSize >> HEAP_ENTRY_SHIFT )即index>128，则我们调用RtlpAllocateNonDedicated来额外申请内存。

3.如果申请的内存大于VirtualMemoryThreshold并且堆设置为Heap->Flags & HEAP_GROWABLE，说明这是一个可增长的堆。于是我们使用ZwAllocateVirtualMemory从虚拟内存管理器中申请内存，申请大小为 AllocationSize += sizeof(HEAP_VIRTUAL_ALLOC_ENTRY) - sizeof(HEAP_ENTRY);另外我们还要给这个空间做额外的标记，这个数据结构为HEAP_VIRTUAL_ALLOC_ENTRY，然后我们初始化这块空间，并将这块空间加入到另外一个链表中

 /* Insert it into the list of virtual allocations */        InsertTailList(&Heap->VirtualAllocdBlocks, &VirtualBlock->Entry);

RtlFreeHeap

我们看完了空间的申请，接着看看空间的释放。

BOOLEAN NTAPI RtlFreeHeap(   HANDLE HeapPtr, /* [in] Handle of heap */   ULONG Flags,   /* [in] Heap freeing flags */   PVOID Ptr     /* [in] Address of memory to free */){    PHEAP Heap;    PHEAP_ENTRY HeapEntry;    USHORT TagIndex = 0;    SIZE_T BlockSize;    PHEAP_VIRTUAL_ALLOC_ENTRY VirtualEntry;    BOOLEAN Locked = FALSE;    NTSTATUS Status;    /* Freeing NULL pointer is a legal operation */    if (!Ptr) return TRUE;    /* Get pointer to the heap and force flags */    Heap = (PHEAP)HeapPtr;    Flags |= Heap->ForceFlags;    /* Call special heap */    if (RtlpHeapIsSpecial(Flags))        return RtlDebugFreeHeap(Heap, Flags, Ptr);    /* Lock if necessary */    if (!(Flags & HEAP_NO_SERIALIZE))    {        RtlEnterHeapLock(Heap->LockVariable, TRUE);        Locked = TRUE;    }    /* Get pointer to the heap entry */    HeapEntry = (PHEAP_ENTRY)Ptr - 1;    /* Check this entry, fail if it's invalid */    if (!(HeapEntry->Flags & HEAP_ENTRY_BUSY) ||        (((ULONG_PTR)Ptr & 0x7) != 0) ||        (HeapEntry->SegmentOffset >= HEAP_SEGMENTS))    {        /* This is an invalid block */        DPRINT1("HEAP: Trying to free an invalid address %p!\n", Ptr);        RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_INVALID_PARAMETER);        /* Release the heap lock */        if (Locked) RtlLeaveHeapLock(Heap->LockVariable);        return FALSE;    }    if (HeapEntry->Flags & HEAP_ENTRY_VIRTUAL_ALLOC)    {        /* Big allocation */        VirtualEntry = CONTAINING_RECORD(HeapEntry, HEAP_VIRTUAL_ALLOC_ENTRY, BusyBlock);        /* Remove it from the list */        RemoveEntryList(&VirtualEntry->Entry);        // TODO: Tagging        BlockSize = 0;        Status = ZwFreeVirtualMemory(NtCurrentProcess(),                                     (PVOID *)&VirtualEntry,                                     &BlockSize,                                     MEM_RELEASE);        if (!NT_SUCCESS(Status))        {            DPRINT1("HEAP: Failed releasing memory with Status 0x%08X. Heap %p, ptr %p, base address %p\n",                Status, Heap, Ptr, VirtualEntry);            RtlSetLastWin32ErrorAndNtStatusFromNtStatus(Status);        }    }    else    {        /* Normal allocation */        BlockSize = HeapEntry->Size;        // TODO: Tagging        /* Coalesce in kernel mode, and in usermode if it's not disabled */        if (RtlpGetMode() == KernelMode ||            (RtlpGetMode() == UserMode && !(Heap->Flags & HEAP_DISABLE_COALESCE_ON_FREE)))        {            HeapEntry = (PHEAP_ENTRY)RtlpCoalesceFreeBlocks(Heap,                                                           (PHEAP_FREE_ENTRY)HeapEntry,                                                           &BlockSize,                                                           FALSE);        }        /* If there is no need to decommit the block - put it into a free list */        if (BlockSize < Heap->DeCommitFreeBlockThreshold ||            (Heap->TotalFreeSize + BlockSize < Heap->DeCommitTotalFreeThreshold))        {            /* Check if it needs to go to a 0 list */            if (BlockSize > HEAP_MAX_BLOCK_SIZE)            {                /* General-purpose 0 list */                RtlpInsertFreeBlock(Heap, (PHEAP_FREE_ENTRY)HeapEntry, BlockSize);            }            else            {                /* Usual free list */                RtlpInsertFreeBlockHelper(Heap, (PHEAP_FREE_ENTRY)HeapEntry, BlockSize, FALSE);                /* Assert sizes are consistent */                if (!(HeapEntry->Flags & HEAP_ENTRY_LAST_ENTRY))                {                    ASSERT((HeapEntry + BlockSize)->PreviousSize == BlockSize);                }                /* Increase the free size */                Heap->TotalFreeSize += BlockSize;            }            if (RtlpGetMode() == UserMode &&                TagIndex != 0)            {                // FIXME: Tagging                UNIMPLEMENTED;            }        }        else        {            /* Decommit this block */            RtlpDeCommitFreeBlock(Heap, (PHEAP_FREE_ENTRY)HeapEntry, BlockSize);        }    }    /* Release the heap lock */    if (Locked) RtlLeaveHeapLock(Heap->LockVariable);    return TRUE;}

函数依旧是那么的紧凑，开始要检测参数是否合法，转换参数指针结构到我们需要的PHEAP结构，然后判断是否是一个特殊的堆，如果是，则使用RtlDebugFreeHeap特殊堆的调用方式来调用。接着判断是否需要序列化访问，如果需要我们申请进入临界区。
我们获取堆项

    /* Get pointer to the heap entry */    HeapEntry = (PHEAP_ENTRY)Ptr - 1;

检查堆项是否有问题，如果所释放的内存是大块内存，我们使用内存管理器函数ZwFreeVirtualMemory来释放。
如果所释放的不是大块的内存，要判断我们是否在内核模式，或者用户模式未禁用合并。
接着我们调用RtlpCoalesceFreeBlocks来合并这块内存
然后函数开始判断如下两个条件
第一个条件：本次释放的堆块大小超过了_PEB中的DeCommitFreeBlockThreshold字段的值。
第二个条件：空闲空间的总大小超过了_PEB中的DeCommitTotalFreeThreshold字段的值。
如果两个条件中有一个未满足，我们将这个块加入到本身它所在的链表中。并递增空闲空间的总大小
如果两个条件同时满足，我们调用RtlpDeCommitFreeBlock执行具体的操作，这个过程被称为解除提交。
最后我们是否heap的锁。

RtlpInsertFreeBlockHelper

有时候我们不是直接归还内存给虚存管理器的，而是将内部链入到链表中，等待时机再去归还，这个函数是实际的插入链表函数。

VOID NTAPIRtlpInsertFreeBlockHelper(PHEAP Heap,                          PHEAP_FREE_ENTRY FreeEntry,                          SIZE_T BlockSize,                          BOOLEAN NoFill){    PLIST_ENTRY FreeListHead, Current;    PHEAP_FREE_ENTRY CurrentEntry;    ASSERT(FreeEntry->Size == BlockSize);    /* Fill if it's not denied */    if (!NoFill)    {        FreeEntry->Flags &= ~(HEAP_ENTRY_FILL_PATTERN |                              HEAP_ENTRY_EXTRA_PRESENT |                              HEAP_ENTRY_BUSY);        if (Heap->Flags & HEAP_FREE_CHECKING_ENABLED)        {            RtlFillMemoryUlong((PCHAR)(FreeEntry + 1),                               (BlockSize << HEAP_ENTRY_SHIFT) - sizeof(*FreeEntry),                               ARENA_FREE_FILLER);            FreeEntry->Flags |= HEAP_ENTRY_FILL_PATTERN;        }    }    else    {        /* Clear out all flags except the last entry one */        FreeEntry->Flags &= HEAP_ENTRY_LAST_ENTRY;    }    /* Insert it either into dedicated or non-dedicated list */    if (BlockSize < HEAP_FREELISTS)    {        /* Dedicated list */        FreeListHead = &Heap->FreeLists[BlockSize];        if (IsListEmpty(FreeListHead))        {            RtlpSetFreeListsBit(Heap, FreeEntry);        }    }    else    {        /* Non-dedicated one */        FreeListHead = &Heap->FreeLists[0];        Current = FreeListHead->Flink;        /* Find a position where to insert it to (the list must be sorted) */        while (FreeListHead != Current)        {            CurrentEntry = CONTAINING_RECORD(Current, HEAP_FREE_ENTRY, FreeList);            if (BlockSize <= CurrentEntry->Size)                break;            Current = Current->Flink;        }        FreeListHead = Current;    }    /* Actually insert it into the list */    InsertTailList(FreeListHead, &FreeEntry->FreeList);}

函数相对来说比较简洁，如果块大小小于HEAP_FREELISTS即128大小时，我们直接在FreeListHead = &Heap->FreeLists[BlockSize]获得到对应的链表头部，并设置对应的使用位，如下设置使用位

FORCEINLINEVOIDRtlpSetFreeListsBit(PHEAP Heap,                    PHEAP_FREE_ENTRY FreeEntry){    ULONG Index, Bit;    ASSERT(FreeEntry->Size < HEAP_FREELISTS);    /* Calculate offset in the free list bitmap */    Index = FreeEntry->Size >> 3; /* = FreeEntry->Size / (sizeof(UCHAR) * 8)*/    Bit = 1 << (FreeEntry->Size & 7);    /* Assure it's not already set */    ASSERT((Heap->u.FreeListsInUseBytes[Index] & Bit) == 0);    /* Set it */    Heap->u.FreeListsInUseBytes[Index] |= Bit;}

如果大小超过了堆处理器提供的小块大小又在某个临界之内，我们则设置将这个块放置在FreeList[0]的位置。FreeList[0]指向一个链表，我们根据块的大小放置在对应位置。当我们获取到对应位置的表头后，我们做对应的插入链表操作。
/* Actually insert it into the list */
InsertTailList(FreeListHead, &FreeEntry->FreeList);

RtlpDeCommitFreeBlock

解除提交操作，如前所说，当要是否的堆块大小超过一定值的时候，堆管理器和内存管理器进行一定的交互。

VOID NTAPIRtlpDeCommitFreeBlock(PHEAP Heap,                      PHEAP_FREE_ENTRY FreeEntry,                      SIZE_T Size){    PHEAP_SEGMENT Segment;    PHEAP_ENTRY PrecedingInUseEntry = NULL, NextInUseEntry = NULL;    PHEAP_FREE_ENTRY NextFreeEntry;    PHEAP_UCR_DESCRIPTOR UcrDescriptor;    SIZE_T PrecedingSize, NextSize, DecommitSize;    ULONG_PTR DecommitBase;    NTSTATUS Status;    DPRINT("Decommitting %p %p %x\n", Heap, FreeEntry, Size);    /* We can't decommit if there is a commit routine! */    if (Heap->CommitRoutine)    {        /* Just add it back the usual way */        RtlpInsertFreeBlock(Heap, FreeEntry, Size);        return;    }    /* Get the segment */    Segment = Heap->Segments[FreeEntry->SegmentOffset];    /* Get the preceding entry */    DecommitBase = ROUND_UP(FreeEntry, PAGE_SIZE);    PrecedingSize = (PHEAP_ENTRY)DecommitBase - (PHEAP_ENTRY)FreeEntry;    if (PrecedingSize == 1)    {        /* Just 1 heap entry, increase the base/size */        DecommitBase += PAGE_SIZE;        PrecedingSize += PAGE_SIZE >> HEAP_ENTRY_SHIFT;    }    else if (FreeEntry->PreviousSize &&             (DecommitBase == (ULONG_PTR)FreeEntry))    {        PrecedingInUseEntry = (PHEAP_ENTRY)FreeEntry - FreeEntry->PreviousSize;    }    /* Get the next entry */    NextFreeEntry = (PHEAP_FREE_ENTRY)((PHEAP_ENTRY)FreeEntry + Size);    DecommitSize = ROUND_DOWN(NextFreeEntry, PAGE_SIZE);    NextSize = (PHEAP_ENTRY)NextFreeEntry - (PHEAP_ENTRY)DecommitSize;    if (NextSize == 1)    {        /* Just 1 heap entry, increase the size */        DecommitSize -= PAGE_SIZE;        NextSize += PAGE_SIZE >> HEAP_ENTRY_SHIFT;    }    else if (NextSize == 0 &&             !(FreeEntry->Flags & HEAP_ENTRY_LAST_ENTRY))    {        NextInUseEntry = (PHEAP_ENTRY)NextFreeEntry;    }    NextFreeEntry = (PHEAP_FREE_ENTRY)((PHEAP_ENTRY)NextFreeEntry - NextSize);    /* Calculate real decommit size */    if (DecommitSize > DecommitBase)    {        DecommitSize -= DecommitBase;    }    else    {        /* Nothing to decommit */        RtlpInsertFreeBlock(Heap, FreeEntry, Size);        return;    }    /* A decommit is necessary. Create a UCR descriptor */    UcrDescriptor = RtlpCreateUnCommittedRange(Segment);    if (!UcrDescriptor)    {        DPRINT1("HEAP: Failed to create UCR descriptor\n");        RtlpInsertFreeBlock(Heap, FreeEntry, PrecedingSize);        return;    }    /* Decommit the memory */    Status = ZwFreeVirtualMemory(NtCurrentProcess(),                                 (PVOID *)&DecommitBase,                                 &DecommitSize,                                 MEM_DECOMMIT);    /* Delete that UCR. This is needed to assure there is an unused UCR entry in the list */    RtlpDestroyUnCommittedRange(Segment, UcrDescriptor);    if (!NT_SUCCESS(Status))    {        RtlpInsertFreeBlock(Heap, FreeEntry, Size);        return;    }    /* Insert uncommitted pages */    RtlpInsertUnCommittedPages(Segment, DecommitBase, DecommitSize);    Segment->NumberOfUnCommittedPages += (ULONG)(DecommitSize / PAGE_SIZE);    if (PrecedingSize)    {        /* Adjust size of this free entry and insert it */        FreeEntry->Flags = HEAP_ENTRY_LAST_ENTRY;        FreeEntry->Size = (USHORT)PrecedingSize;        Heap->TotalFreeSize += PrecedingSize;        /* Insert it into the free list */        RtlpInsertFreeBlockHelper(Heap, FreeEntry, PrecedingSize, FALSE);    }    else if (PrecedingInUseEntry)    {        /* Adjust preceding in use entry */        PrecedingInUseEntry->Flags |= HEAP_ENTRY_LAST_ENTRY;    }    /* Now the next one */    if (NextSize)    {        /* Adjust size of this free entry and insert it */        NextFreeEntry->Flags = 0;        NextFreeEntry->PreviousSize = 0;        NextFreeEntry->SegmentOffset = Segment->Entry.SegmentOffset;        NextFreeEntry->Size = (USHORT)NextSize;        ((PHEAP_FREE_ENTRY)((PHEAP_ENTRY)NextFreeEntry + NextSize))->PreviousSize = (USHORT)NextSize;        Heap->TotalFreeSize += NextSize;        RtlpInsertFreeBlockHelper(Heap, NextFreeEntry, NextSize, FALSE);    }    else if (NextInUseEntry)    {        NextInUseEntry->PreviousSize = 0;    }}

//比较难的函数，后期处理
现在我们来分析一下这个函数

RtlDestroyHeap

当然这是一个堆销毁函数，用来释放整个堆所占有的空间。

HANDLE NTAPIRtlDestroyHeap(HANDLE HeapPtr) /* [in] Handle of heap */{    PHEAP Heap = (PHEAP)HeapPtr;    PLIST_ENTRY Current;    PHEAP_UCR_SEGMENT UcrSegment;    PHEAP_VIRTUAL_ALLOC_ENTRY VirtualEntry;    PVOID BaseAddress;    SIZE_T Size;    LONG i;    PHEAP_SEGMENT Segment;    if (!HeapPtr) return NULL;    /* Call page heap routine if required */    if (Heap->ForceFlags & HEAP_FLAG_PAGE_ALLOCS) return RtlpPageHeapDestroy(HeapPtr);    /* Call special heap */    if (RtlpHeapIsSpecial(Heap->Flags))    {        if (!RtlDebugDestroyHeap(Heap)) return HeapPtr;    }    /* Check for a process heap */    if (RtlpGetMode() == UserMode &&        HeapPtr == NtCurrentPeb()->ProcessHeap) return HeapPtr;    /* Free up all big allocations */    Current = Heap->VirtualAllocdBlocks.Flink;    while (Current != &Heap->VirtualAllocdBlocks)    {        VirtualEntry = CONTAINING_RECORD(Current, HEAP_VIRTUAL_ALLOC_ENTRY, Entry);        BaseAddress = (PVOID)VirtualEntry;        Current = Current->Flink;        Size = 0;        ZwFreeVirtualMemory(NtCurrentProcess(),                            &BaseAddress,                            &Size,                            MEM_RELEASE);    }    /* Delete tags and remove heap from the process heaps list in user mode */    if (RtlpGetMode() == UserMode)    {        // FIXME DestroyTags        RtlpRemoveHeapFromProcessList(Heap);    }    /* Delete the heap lock */    if (!(Heap->Flags & HEAP_NO_SERIALIZE))    {        /* Delete it if it wasn't user allocated */        if (!(Heap->Flags & HEAP_LOCK_USER_ALLOCATED))            RtlDeleteHeapLock(Heap->LockVariable);        /* Clear out the lock variable */        Heap->LockVariable = NULL;    }    /* Free UCR segments if any were created */    Current = Heap->UCRSegments.Flink;    while (Current != &Heap->UCRSegments)    {        UcrSegment = CONTAINING_RECORD(Current, HEAP_UCR_SEGMENT, ListEntry);        /* Advance to the next descriptor */        Current = Current->Flink;        BaseAddress = (PVOID)UcrSegment;        Size = 0;        /* Release that memory */        ZwFreeVirtualMemory(NtCurrentProcess(),                            &BaseAddress,                            &Size,                            MEM_RELEASE);    }    /* Go through segments and destroy them */    for (i = HEAP_SEGMENTS - 1; i >= 0; i--)    {        Segment = Heap->Segments[i];        if (Segment) RtlpDestroyHeapSegment(Segment);    }    return NULL;}

函数开始进行参数判断，不允许参数为空，判断堆的性质，分别调用RtlpPageHeapDestroy或者是RtlDebugDestroyHeap，如果是正常的heap，我们还要检查是否是进程默认堆，如果是，直接返回。
我们获取VirtualAllocdBlocks，这个是直接向内存管理器申请的空间链表，我们先释放这些空间。
然后判断我们是不是在用户模式下，如果是操作用户模式下peb中对应的heap信息。
接着判断我们是否需要删除互斥锁，因为有时候互斥锁是用户提供的。
获取ucr 段的链表，依次进行释放

    /* Free UCR segments if any were created */    Current = Heap->UCRSegments.Flink;最后我们索引所有的段，一一进行销毁和释放空间。    /* Go through segments and destroy them */    for (i = HEAP_SEGMENTS - 1; i >= 0; i--)    {        Segment = Heap->Segments[i];        if (Segment) RtlpDestroyHeapSegment(Segment);    }

段的具体销毁较为简单，我们获得段的基地址Segment->BaseAddress;，调用内核函数ZwFreeVirtualMemory销毁这个段即可。

VOID NTAPIRtlpDestroyHeapSegment(PHEAP_SEGMENT Segment){    NTSTATUS Status;    PVOID BaseAddress;    SIZE_T Size = 0;    /* Make sure it's not user allocated */    if (Segment->SegmentFlags & HEAP_USER_ALLOCATED) return;    BaseAddress = Segment->BaseAddress;    DPRINT("Destroying segment %p, BA %p\n", Segment, BaseAddress);    /* Release virtual memory */    Status = ZwFreeVirtualMemory(NtCurrentProcess(),                                 &BaseAddress,                                 &Size,                                 MEM_RELEASE);    if (!NT_SUCCESS(Status))    {        DPRINT1("HEAP: Failed to release segment's memory with status 0x%08X\n", Status);    }}

RtlSizeHeap

堆中已申请内存大小的计算

SIZE_T NTAPIRtlSizeHeap(   HANDLE HeapPtr,   ULONG Flags,   PVOID Ptr){    PHEAP Heap = (PHEAP)HeapPtr;    PHEAP_ENTRY HeapEntry;    SIZE_T EntrySize;    // FIXME This is a hack around missing SEH support!    if (!Heap)    {        RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_INVALID_HANDLE);        return (SIZE_T)-1;    }    /* Force flags */    Flags |= Heap->ForceFlags;    /* Call special heap */    if (RtlpHeapIsSpecial(Flags))        return RtlDebugSizeHeap(Heap, Flags, Ptr);    /* Get the heap entry pointer */    HeapEntry = (PHEAP_ENTRY)Ptr - 1;    /* Return -1 if that entry is free */    if (!(HeapEntry->Flags & HEAP_ENTRY_BUSY))    {        RtlSetLastWin32ErrorAndNtStatusFromNtStatus(STATUS_INVALID_PARAMETER);        return (SIZE_T)-1;    }    /* Get size of this block depending if it's a usual or a big one */    if (HeapEntry->Flags & HEAP_ENTRY_VIRTUAL_ALLOC)    {        EntrySize = RtlpGetSizeOfBigBlock(HeapEntry);    }    else    {        /* Calculate it */        EntrySize = (HeapEntry->Size << HEAP_ENTRY_SHIFT) - HeapEntry->UnusedBytes;    }    /* Return calculated size */    return EntrySize;}

函数中我们可以知道我们首先获取堆项的头部指针HeapEntry = (PHEAP_ENTRY)Ptr - 1;
判断是否是大块的内存，如果是大块的，我们使用RtlpGetSizeOfBigBlock来进行特殊计算，如果是正常的，使用EntrySize = (HeapEntry->Size << HEAP_ENTRY_SHIFT) - HeapEntry->UnusedBytes;计算。

windbg 调试

kd> dt _PEB @$pebntdll!_PEB   +0x000 InheritedAddressSpace : 0 ''   +0x001 ReadImageFileExecOptions : 0 ''   +0x002 BeingDebugged    : 0 ''   +0x003 BitField         : 0x8 ''   +0x003 ImageUsesLargePages : 0y0   +0x003 IsProtectedProcess : 0y0   +0x003 IsLegacyProcess  : 0y0   +0x003 IsImageDynamicallyRelocated : 0y1   +0x003 SkipPatchingUser32Forwarders : 0y0   +0x003 SpareBits        : 0y000   +0x004 Mutant           : 0xffffffff Void   +0x008 ImageBaseAddress : 0x00270000 Void   +0x00c Ldr              : 0x77d47880 _PEB_LDR_DATA   +0x010 ProcessParameters : 0x003911b0 _RTL_USER_PROCESS_PARAMETERS   +0x014 SubSystemData    : (null)   +0x018 ProcessHeap      : 0x00390000 Void   +0x01c FastPebLock      : 0x77d47380 _RTL_CRITICAL_SECTION   +0x020 AtlThunkSListPtr : (null)   +0x024 IFEOKey          : (null)   +0x028 CrossProcessFlags : 0   +0x028 ProcessInJob     : 0y0   +0x028 ProcessInitializing : 0y0   +0x028 ProcessUsingVEH  : 0y0   +0x028 ProcessUsingVCH  : 0y0   +0x028 ProcessUsingFTH  : 0y0   +0x028 ReservedBits0    : 0y000000000000000000000000000 (0)   +0x02c KernelCallbackTable : 0x77bbd568 Void   +0x02c UserSharedInfoPtr : 0x77bbd568 Void   +0x030 SystemReserved   : [1] 0   +0x034 AtlThunkSListPtr32 : 0   +0x038 ApiSetMap        : 0x77eb0000 Void   +0x03c TlsExpansionCounter : 0   +0x040 TlsBitmap        : 0x77d47260 Void   +0x044 TlsBitmapBits    : [2] 0xffffff   +0x04c ReadOnlySharedMemoryBase : 0x7f6f0000 Void   +0x050 HotpatchInformation : (null)   +0x054 ReadOnlyStaticServerData : 0x7f6f0590  -> (null)   +0x058 AnsiCodePageData : 0x7ffa0000 Void   +0x05c OemCodePageData  : 0x7ffa0000 Void   +0x060 UnicodeCaseTableData : 0x7ffd0024 Void   +0x064 NumberOfProcessors : 1   +0x068 NtGlobalFlag     : 0   +0x070 CriticalSectionTimeout : _LARGE_INTEGER 0xffffe86d`079b8000   +0x078 HeapSegmentReserve : 0x100000   +0x07c HeapSegmentCommit : 0x2000   +0x080 HeapDeCommitTotalFreeThreshold : 0x10000   +0x084 HeapDeCommitFreeBlockThreshold : 0x1000   +0x088 NumberOfHeaps    : 6   +0x08c MaximumNumberOfHeaps : 0x10   +0x090 ProcessHeaps     : 0x77d47500  -> 0x00390000 Void   +0x094 GdiSharedHandleTable : 0x00560000 Void   +0x098 ProcessStarterHelper : (null)   +0x09c GdiDCAttributeList : 0x14   +0x0a0 LoaderLock       : 0x77d47340 _RTL_CRITICAL_SECTION   +0x0a4 OSMajorVersion   : 6   +0x0a8 OSMinorVersion   : 1   +0x0ac OSBuildNumber    : 0x1db1   +0x0ae OSCSDVersion     : 0x100   +0x0b0 OSPlatformId     : 2   +0x0b4 ImageSubsystem   : 2   +0x0b8 ImageSubsystemMajorVersion : 6   +0x0bc ImageSubsystemMinorVersion : 1   +0x0c0 ActiveProcessAffinityMask : 1   +0x0c4 GdiHandleBuffer  : [34] 0   +0x14c PostProcessInitRoutine : (null)   +0x150 TlsExpansionBitmap : 0x77d47268 Void   +0x154 TlsExpansionBitmapBits : [32] 1   +0x1d4 SessionId        : 1   +0x1d8 AppCompatFlags   : _ULARGE_INTEGER 0x0   +0x1e0 AppCompatFlagsUser : _ULARGE_INTEGER 0x0   +0x1e8 pShimData        : (null)   +0x1ec AppCompatInfo    : (null)   +0x1f0 CSDVersion       : _UNICODE_STRING "Service Pack 1"   +0x1f8 ActivationContextData : 0x00040000 _ACTIVATION_CONTEXT_DATA   +0x1fc ProcessAssemblyStorageMap : 0x0039e5e0 _ASSEMBLY_STORAGE_MAP   +0x200 SystemDefaultActivationContextData : 0x00030000 _ACTIVATION_CONTEXT_DATA   +0x204 SystemAssemblyStorageMap : 0x0039dbe0 _ASSEMBLY_STORAGE_MAP   +0x208 MinimumStackCommit : 0   +0x20c FlsCallback      : 0x003a1050 _FLS_CALLBACK_INFO   +0x210 FlsListHead      : _LIST_ENTRY [ 0x3a0de0 - 0x3da7d8 ]   +0x218 FlsBitmap        : 0x77d47270 Void   +0x21c FlsBitmapBits    : [4] 0xf   +0x22c FlsHighIndex     : 3   +0x230 WerRegistrationData : 0x00100000 Void   +0x234 WerShipAssertPtr : (null)   +0x238 pContextData     : 0x00050000 Void   +0x23c pImageHeaderHash : (null)   +0x240 TracingFlags     : 0   +0x240 HeapTracingEnabled : 0y0   +0x240 CritSecTracingEnabled : 0y0   +0x240 SpareTracingBits : 0y000000000000000000000000000000 (0)kd> dt _Heap 0x77d47500  ntdll!_HEAP   +0x000 Entry            : _HEAP_ENTRY   +0x008 SegmentSignature : 0x120000   +0x00c SegmentFlags     : 0x16b0000   +0x010 SegmentListEntry : _LIST_ENTRY [ 0x1a00000 - 0x1640000 ]   +0x018 Heap             : (null)   +0x01c BaseAddress      : (null)   +0x020 NumberOfPages    : 0   +0x024 FirstEntry       : (null)   +0x028 LastValidEntry   : (null)   +0x02c NumberOfUnCommittedPages : 0   +0x030 NumberOfUnCommittedRanges : 0   +0x034 SegmentAllocatorBackTraceIndex : 0   +0x036 Reserved         : 0   +0x038 UCRSegmentList   : _LIST_ENTRY [ 0x0 - 0x0 ]   +0x040 Flags            : 0   +0x044 ForceFlags       : 0x77d47340   +0x048 CompatibilityFlags : 0x77d4ab08   +0x04c EncodeFlagMask   : 0x77d47220   +0x050 Encoding         : _HEAP_ENTRY   +0x058 PointerKey       : 0   +0x05c Interceptor      : 0   +0x060 VirtualMemoryThreshold : 0x77d47220   +0x064 Signature        : 0x3cc270   +0x068 SegmentReserve   : 0   +0x06c SegmentCommit    : 0   +0x070 DeCommitFreeBlockThreshold : 0   +0x074 DeCommitTotalFreeThreshold : 0   +0x078 TotalFreeSize    : 0   +0x07c MaximumAllocationSize : 0   +0x080 ProcessHeapsListIndex : 0   +0x082 HeaderValidateLength : 0   +0x084 HeaderValidateCopy : (null)   +0x088 NextAvailableTagIndex : 0   +0x08a MaximumTagIndex  : 0   +0x08c TagEntries       : (null)   +0x090 UCRList          : _LIST_ENTRY [ 0x1 - 0xffffffff ]   +0x098 AlignRound       : 0   +0x09c AlignMask        : 0   +0x0a0 VirtualAllocdBlocks : _LIST_ENTRY [ 0x0 - 0x0 ]   +0x0a8 SegmentList      : _LIST_ENTRY [ 0x0 - 0x0 ]   +0x0b0 AllocatorBackTraceIndex : 0   +0x0b4 NonDedicatedListLength : 0   +0x0b8 BlocksIndex      : (null)   +0x0bc UCRIndex         : (null)   +0x0c0 PseudoTagEntries : (null)   +0x0c4 FreeLists        : _LIST_ENTRY [ 0x0 - 0x0 ]   +0x0cc LockVariable     : (null)   +0x0d0 CommitRoutine    : (null)   +0x0d4 FrontEndHeap     : (null)   +0x0d8 FrontHeapLockCount : 0   +0x0da FrontEndHeapType : 0 ''   +0x0dc Counters         : _HEAP_COUNTERS   +0x130 TuningParameters : _HEAP_TUNING_PARAMETERS