在win xp sp2下的ie7,对某个地址下写访问断点,结果来到ntdll!RtlpLowFragHeapFree,也就是会用该函数释放(前面的地址指向一个对象)。
但个人觉得RtlpLowFragHeapFree该函数貌似只有在vista之后启用LFH堆才有用吧, 怎么在xp sp2下也用LFH堆?
0:005> ba w4 001c3968
0:005> g
Breakpoint 1 hit
eax=00db0000 ebx=008800e9 ecx=0000000d edx=00000089 esi=001d3678 edi=001c3960
eip=7c9521a7 esp=01acfaf8 ebp=01acfb28 iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216
ntdll!RtlpLowFragHeapFree+0x7c:
7c9521a7 250000ffff and eax,0FFFF0000h
Windows XP, Windows Server 2003, and Windows 2000 with hotfix KB 816542:
The LFH is not enabled by default.
To enable the LFH for the specified heap, set the variable pointed to by the HeapInformation parameter to 2. After the LFH is enabled for a heap, it cannot be disabled.