[分享]Win10的RtlCreateHeap分析-逆向工程-看雪安全社区

[分享]Win10的RtlCreateHeap分析

发表于: 2025-2-21 00:41 8657

[分享]Win10的RtlCreateHeap分析

xichang13

2025-2-21 00:41

8657

自己分析了一下Win10的堆，但是有很多地方有不明白的。也可能分析错误，不要见怪，请求指正。

- [RtlCreateHeap](#rtlcreateheap)
- [RtlAllocateHeap](#rtlallocateheap)
- [RtlFreeHeap](#rtlfreeheap)
- [RtlpAllocateHeapInternal 未还原完](#rtlpallocateheapinternal-未还原完)

# RtlCreateHeap

- [RtlCreateHeap 源码](#rtlcreateheap-源码)

``` C++
NTSYSAPI PVOID RtlCreateHeap(
  [in]           ULONG                Flags,
  [in, optional] PVOID                HeapBase,
  [in, optional] SIZE_T               ReserveSize,
  [in, optional] SIZE_T               CommitSize,
  [in, optional] PVOID                Lock,
  [in, optional] PRTL_HEAP_PARAMETERS Parameters
);
```

![RtlCreateHeap](upload/attach/202502/998655_JFFVHECFSBPMZ94.webp)

![系统堆](upload/attach/202502/998655_GWBDH3J29F8CR9G.webp)

**系统堆**
判断是否是系统堆，如果是，则在判断系统兼容性(RtlpHpAppCompatDontChangePolicy())后创建段堆(Segment Heap)。

![堆段](upload/attach/202502/998655_2RBMQGCUU4EY6HS.webp)
**段堆**
如果不是系统堆则判断HEAP_CREATE_SEGMENT_HEAP(0x100)标志，如果是则调用(_RtlpHpEnvGetEnvHandleFromParams)获取上下文后调用(_RtlpHpHeapCreate())创建段堆，否则创建普通堆。

**普通堆**
 ![日志](upload/attach/202502/998655_RQVW47YFCMVUGHT.webp)
1. 在创建普通堆之前会打印日志。
 ![堆信息](upload/attach/202502/998655_3B2M2B87SQSDBFD.webp)
2. 申请堆创建信息空间，判断我们是否传入Parameters参数。如果传入则使用传入的参数，否则使用默认参数，这里默认参数为进程堆信息。
3. 有Parameters堆信息后，获取堆基址。
 ![调试堆](upload/attach/202502/998655_CXYK96Y7D5VWMAV.webp)
在获取堆基址之后会判断是否为调式堆。
 ![随机堆](upload/attach/202502/998655_94BE93YD2ZBSXQK.webp)
4. 调用(_RtlpHeapGenerateRandomValue)获取随机数创建随机堆。
 ![申请堆地址](upload/attach/202502/998655_7UNED2R3B7RJH9R.webp)
 ![Encoding](upload/attach/202502/998655_V7NGF82GK7AWSP9.webp)
 ![初始化堆段](upload/attach/202502/998655_FJYQ6F7Q86VHWQZ.webp)
5. 申请堆空间，并将堆信息写入堆空间。
 ![填入堆信息](upload/attach/202502/998655_HFRPMX6EZW8BGBB.webp)
6. 将堆基址加入堆链表。
 ![填入堆链表](upload/attach/202502/998655_VDKMAP4Y53YST3W.webp)

# RtlAllocateHeap

``` C++
PVOID RtlAllocateHeap(
	[in]           PVOID  HeapHandle,
	[in, optional] ULONG  Flags,
	[in]           SIZE_T Size
) {
	if (HeapHandle == NULL) {
		/*
		// 记录错误日志
		RtlpLogHeapFailure(0x13,0,0,0,0,0);
		*/
	}
	
	if (*((DWORD*)HeapHandle + 2) == 0xDDEEDDEE) {
		/*
		// 分配内存与异常处理
		return RtlpHpAllocWithExceptionProtection(HeapHandle,Size,Flags);
		*/
	}
	
	if (_RtlpHpHeapFeatures & 2 != 0) {
		/*
		// 分配内存
		RtlpHpTagAllocateHeap(HeapHandle,Size,Flags);
		*/
	}
	// 分配内存
	return RtlpAllocateHeapInternal(HeapHandle, Size, Flags, 0);
}
```

# RtlFreeHeap

``` C++
BOOL RtlFreeHeap(
[in]           PVOID                 HeapHandle,
[in, optional] ULONG                 Flags,
_Frees_ptr_opt_ PVOID BaseAddress
) {
	if (!BaseAddress)
		return 1;
	if (!HeapHandle)
		/*
		// 记录错误日志
		RtlpLogHeapFailure(HeapHandle,0,0,0,0,0);
		*/
	if (*(DWORD*)((DWORD)HeapHandle + 8) == 0xDDEEDDEE)
		/*
		// 在异常保护中释放内存
		return RtlpHpFreeWithExceptionProtection(HeapHandle,BaseAddress,Flags);
		*/
	if ((RtlpHpHeapFeatures & 2) != 0)
		/*
		// LFH 快速堆分配的释放
			return RtlpHpTagFreeHeap(HeapHandle, BaseAddress,Flags);
		*/
	/*
	// 释放内存
	return RtlpFreeHeapInternal(HeapHandle, BaseAddress, Flags, 0, 0);
	*/
	return FALSE;
}
```

# RtlCreateHeap 源码

``` C++
DWORD dword_4B3A32DC = 0;
DWORD dword_4B3A32F4 = 0; // 函数?
DWORD dword_4B3A32E4 = 0;
// 堆特性
DWORD RtlpHpHeapFeatures = 0;
// 堆的错误处理行为
DWORD RtlpHeapErrorHandlerThreshold = 0;
DWORD dwAllocationGranularity = 0;
DWORD _RtlHeapKey = 0;
DWORD RtlpDisableHeapLookaside = 0;
DWORD _RtlpDisableHeapLookaside = 0;
DWORD _RtlpProcessHeapsListLock = 0;

PVOID RtlCreateHeap(
	ULONG                Flags,
	PVOID                HeapBase,
	SIZE_T               ReserveSize,
	SIZE_T               CommitSize,
	PVOID                Lock,
	PRTL_HEAP_PARAMETERS Parameters
) {
	DWORD SizeOfHeap;
	DWORD var_C0 = CommitSize;
	DWORD RandValue;
	_PEB32* peb = (_PEB32*)NtCurrentTeb()->ProcessEnvironmentBlock;
	DWORD NtGlobalFlag = peb->NtGlobalFlag;
	DWORD var_E4 = 0;
	_HEAP* pHeapBase = 0;
	DWORD var_D0 = 0;
	DWORD var_4C;
	DWORD var_DC;
	DWORD var_D8;
	DWORD var_E0;
	DWORD var_CC;

DWORD edi = (DWORD)Parameters;
	DWORD esi = 0;
	DWORD eax = 0;

if (dword_4B3A32DC != 0) { // 是否是系统堆
		if (HeapBase == 0 && Lock == 0) {
			/*
			RtlpHpAppCompatDontChangePolicy() // 不允许应用程序更改兼容性策略
			DWORD Result = dword_4B3A32F4(Flags, 0, ReserveSize, CommitSize, 0, edi);
			if(Result != 0)
				return Result;
			if(edi != 0xFFFFFFFF)
				return NULL;
			*/
			edi = 0;
		}
	}
	else {
		if (dword_4B3A32E4 != 0) {
			if (edi == 1) {
				if ((Flags & 0x100) != 0)
					edi = 0;
			}
		}
	}
	
	Flags &= 0xF1FFFFFF;
	if ((Flags & 0x100) != 0) { //HEAP_CREATE_SEGMENT_HEAP        0x00000100
		if (Flags & 0x2 == 0 || HeapBase != 0 || ReserveSize != 0
			|| CommitSize != 0 || Lock != 0)
			return NULL;
		if (edi == 0xFFFFFFFF && dword_4B3A32E4 != 0) {
			edi = 0;
		}
		if (edi == 0) {
			esi = (DWORD)&var_4C;
		}
		else {
			esi = edi;
			/*
			// 检查参数是否合法
			if(!RtlpHpParametersVerify(edi))
				return NULL;
			*/
		}
	}
	else if (RtlpHpHeapFeatures & 1 != 0) {
		if (Flags & 0x2 != 0 && HeapBase == 0) {
			if (edi != 0) {
				/*
				// 检查参数是否合法
				if(!RtlpHpParametersVerify(edi))
					goto return53;
				*/
			}
			eax = 2;
			if (Lock == 0)
				esi = (DWORD)&var_4C;
		}
	}
return53:
	eax = 2;
return52:
	if (esi != 0) {
		// 创建一个有异常保护的堆
		// return RtlpHpCreateHeap;
	}

if (Flags & 0x10000000 == 0) {
		if (RtlpHeapErrorHandlerThreshold >= eax) {
			// 打印日志
		}
		if (Flags & 0xFFF80C00 != 0) {
			Flags &= 0x7F3FF;
		}
	}
	RTL_HEAP_PARAMETERS stParameters = { 0 };
	DWORD var_4;
	if (Parameters != 0) {
		var_4 = 0;
		if (Parameters->Length == 48) {
			memcpy(&stParameters, Parameters, 12);
		}
		var_4 = 0xFFFFFFFE;
	}

// 修改flag
	if (NtGlobalFlag & 0x10 != 0) {
		Flags |= 0x20;
	}
	if (NtGlobalFlag & 0x20 != 0) {
		Flags |= 0x40;
	}
	if (NtGlobalFlag & 0x200000 != 0) {
		Flags |= 0x80;
	}
	if (NtGlobalFlag & 0x40 != 0) {
		Flags |= 0x40000000;
	}
	if (NtGlobalFlag & 0x80 != 0) {
		Flags |= 0x20000000;
	}
	if (NtGlobalFlag & 0x1000 != 0) {
		Flags |= 0x8000000;
	}

// 填充结构体
	if (stParameters.SegmentReserve == 0)
		stParameters.SegmentReserve = peb->HeapSegmentReserve;
	if (stParameters.SegmentCommit == 0)
		stParameters.SegmentCommit = peb->HeapSegmentCommit;
	if (stParameters.DeCommitFreeBlockThreshold == 0)
		stParameters.DeCommitFreeBlockThreshold = peb->HeapDeCommitFreeBlockThreshold;
	if (stParameters.DeCommitTotalFreeThreshold == 0)
		stParameters.DeCommitTotalFreeThreshold = peb->HeapDeCommitTotalFreeThreshold;

if (dwAllocationGranularity == 0) {
		/*
		// 获取分配粒度
		NtQuerySystemInformation
		dwAllocationGranularity = dwAllocationGranularity;
		// 失败 
		return NULL;
		*/
	}
	if (stParameters.MaximumAllocationSize == 0)
		stParameters.MaximumAllocationSize = dwAllocationGranularity - 0x11000;
	if (stParameters.VirtualMemoryThreshold == 0 || stParameters.VirtualMemoryThreshold > 0x7F000)
		stParameters.VirtualMemoryThreshold = 0x7F000;

DWORD var_C4 = (CommitSize + 0xFFF) & 0xFFFFF000;
	DWORD var_BC = (var_C4 + 0xFFF) & 0xFFFFF000;
	if (ReserveSize != 0) {
		var_BC = (ReserveSize + 0xFFF) & 0xFFFFF000;
	}
	if (var_C4 > var_BC) {
		var_C4 = var_BC;
	}
	esi = var_C4;
	edi = (DWORD)HeapBase;
	if (Flags & 2 != 0 && HeapBase == 0) {
		NtGlobalFlag = 0x1000;
		var_E4 = 2;
		if (var_BC - 0x1000 < var_C4) {
			var_BC += 0x10FFF;
			var_BC &= 0xFFFF0000;
		}
	}
	else {
		NtGlobalFlag = 0;
	}
	DWORD ecx = var_BC;

if (esi == 0)
		return NULL;
	if (var_BC == 0)
		return NULL;
	if (Flags & 0x61000000 != 0 && Flags & 0x10000000 != 0) {
		/*
		return RtlDebugCreateHeap(x,x,x,x,x,x);
		*/
	}

SizeOfHeap = 0x258;
	if (Flags & 1 != 0) {
		if (Lock == 0)
			goto return28;
		return NULL;
	}
	if (Lock != 0) {
		Flags |= 0x80000000;
	}
	var_D0 = (DWORD)Lock == 0 ? 0 : (DWORD)Lock;
	SizeOfHeap = (DWORD)Lock == 0 ? 0x270 : 0x258;
return28:
	if (edi != 0) {
		if (stParameters.CommitRoutine != 0) {
			if (stParameters.InitialCommit == 0
				|| stParameters.InitialReserve == 0
				|| stParameters.InitialCommit > stParameters.InitialReserve
				|| Flags & 2 != 0)
				return NULL;
			var_CC = edi;
			var_C0 = edi + stParameters.InitialCommit;
			var_BC = stParameters.InitialReserve;
			memset((void*)edi, 0, 0x1000);
		}
		else {
			MEMORY_BASIC_INFORMATION32 MemInfo1 = { 0 };
			MEMORY_BASIC_INFORMATION32 MemInfo2 = { 0 };
			int Ret = 0;
			/*
			// 查询 HeapBase 内存页面信息
			Ret = NtQueryVirtualMemory(0xFFFFFFFF,(DWORD)HeapBase,3,&MemInfo1,0x1C,0);
			*/
			if (Ret < 0) {
				return NULL;
			}
			var_C0 = MemInfo1.BaseAddress;
			if (MemInfo1.BaseAddress != edi) {
				return NULL;
			}
			if (MemInfo1.State == 0x10000)
				return NULL;
			var_CC = MemInfo1.BaseAddress;
			if (MemInfo1.State != 0x1000) {
				var_BC = MemInfo1.RegionSize;
				if (var_C4 > MemInfo1.RegionSize) {
					var_C4 = MemInfo1.RegionSize;
				}
				if (var_C4 < 0x1000) {
					return NULL;
				}
			}
			else {
				if (Flags & 0x40000 != 0 && MemInfo1.Protect & 0x40 == 0)
					return NULL;
				/*
				// 查询 HeapBase 内存页面信息
				Ret = NtQueryVirtualMemory(0xFFFFFFFF,(DWORD)HeapBase,3,&MemInfo2,0x1C,0);
				*/
				if (Ret < 0) {
					return NULL;
				}
				var_BC = MemInfo2.RegionSize;
				var_C4 = MemInfo1.RegionSize;
				var_C0 = MemInfo1.RegionSize + var_CC;
			}
		}
		var_E4 |= 1;
		pHeapBase = (_HEAP*)edi;
		edi = Flags & 0x40000;
		ecx = var_C0;
		eax = var_CC;
	}
	else {
		var_DC = 0;
		if (stParameters.CommitRoutine != 0)
			return NULL;
		/*
		// 生成随机数
		RandValue = RtlpHeapGenerateRandomValue32();
		*/
		RandValue = 0;
		/*
		var_D8 = (RtlpHeapGenerateRandomValue32() & 1Fh) << 0x10;
		*/
		var_D8 = 0;
		var_E0 = var_D8 + var_BC;
		if (var_E0 < var_BC) {
			var_E0 = var_BC;
			var_D8 = 0;
		}
		/*
		// 申请内存
		int result = NtAllocateVirtualMemory(0xFFFFFFFF, &var_DC, 0, &var_E0, 0x2000, Flags & 0x40000 == 0 ? 0 : 0x40);;
		if(result < 0)
			return 0;
		*/
		pHeapBase = (_HEAP*)var_DC;
		var_BC = var_E0;
		if (var_D8 != 0) {
			/*
			// 释放内存
			RtlpSecMemFreeVirtualMemory(&var_DC,var_BC,&var_D8,0x8000);
			*/
			pHeapBase = (_HEAP*)(var_DC + var_D8);
			var_BC = var_E0 - var_D8;
		}
		var_CC = (DWORD)pHeapBase;
		var_C0 = (DWORD)pHeapBase;
	}

if (var_CC == var_C0) {
		char* p = NULL;
		/*
		// 申请内存
		int result = NtAllocateVirtualMemory(0xFFFFFFFF, &var_CC, 0, &var_C4, 0x1000, Flags & 0x40000 == 0 ? 0 : 0x40);;
		if(result < 0)
			return 0;
		// 获取会话ID
		char *p = NULL;
		if(RtlGetCurrentServiceSessionId()){
			p = _PEB.SharedData + 0x226;
		}else{
			p = 0x7FFE0380;
		}
		*/
		if (*p != 0) {
			if (peb->___u71.TracingFlags != 1) {
				/*
				// 记录堆提交操作
				RtlpLogHeapCommit(pHeapBase,var_CC,var_C4,1);
				*/
			}
		}
		var_C0 += var_C4;
	}
	edi = (DWORD)pHeapBase + 0x258;
	if (peb->NtGlobalFlag & 0x800 != 0) {
		// 进程被调试
		pHeapBase->PseudoTagEntries = (_HEAP_PSEUDO_TAG_ENTRY * )(((DWORD)pHeapBase + 0x25F) & 0x0FFFFFFF8);
		SizeOfHeap = 0x60C;
		edi = (DWORD)pHeapBase->PseudoTagEntries + 0x60C;
		Flags |= 0x4000000;
		esi = Flags;
	}
	RandValue = (SizeOfHeap + 7) & 0xFFFFFFF8;
	pHeapBase->___u0.Segment.Entry.___u0.__s1.Size = (RandValue >> 3) & 0xFFFF;
	pHeapBase->___u0.Segment.Entry.___u0.__s1.Flags = 1;
	pHeapBase->___u0.Segment.Entry.___u0.ExtendedEntry.ExtendedBlockSignature = 1;
	pHeapBase->Signature = 0xEEFFEEFF;
	pHeapBase->Flags = esi;
	pHeapBase->Interceptor = 0;
	memset(&pHeapBase->Counters, 0, sizeof(pHeapBase->Counters));
	/*
	// 初始化 Encoding 成员
	RtlpCreateHeapEncoding(pHeapBase);
	*/
	pHeapBase->Counters.HeapPollInterval = 1;
	if (pHeapBase->Flags & 0x8000000 != 0) {
		int result = 0;
		/*
		// 记录调试日志
		result = RtlpGetHeapInterceptorIndex(&RtlpStackTraceDatabaseLogPrefix);
		*/
		pHeapBase->Interceptor &= (result & 0xFFFF);
	}
	pHeapBase->ForceFlags = Flags & 0x6001007D;
	pHeapBase->HeaderValidateLength = edi - (DWORD)pHeapBase;
	pHeapBase->HeaderValidateCopy = NULL;
	pHeapBase->FreeLists.Blink = &pHeapBase->FreeLists;
	pHeapBase->FreeLists.Flink = &pHeapBase->FreeLists;
	pHeapBase->VirtualAllocdBlocks.Blink = &pHeapBase->VirtualAllocdBlocks;
	pHeapBase->VirtualAllocdBlocks.Flink = &pHeapBase->VirtualAllocdBlocks;
	pHeapBase->SegmentList.Blink = &pHeapBase->SegmentList;
	pHeapBase->SegmentList.Flink = &pHeapBase->SegmentList;
	pHeapBase->UCRList.Blink = &pHeapBase->UCRList;
	pHeapBase->UCRList.Flink = &pHeapBase->UCRList;
	if (var_D0 == 0 && Flags & 1 == 0) {
		var_D0 = edi;
		int Ret = 0;
		/*
		// 线程同步
		Ret = RtlInitializeCriticalSectionEx(var_D0,0,0x10000000);
		*/
		if (Ret < 0) {
			return NULL;
		}
		edi += 0x18;
		ecx = var_D0;
	}
	pHeapBase->LockVariable = (_HEAP_LOCK * )var_D0;
	pHeapBase->CompatibilityFlags |= 0x80000000;
	int Ret = 0;
	/*
	// 初始化堆段
	Ret = RtlpInitializeHeapSegment((DWORD)pHeapBase,(DWORD)pHeapBase,RandValue + 0x238,pHeapBase->LockVariable,var_E4,var_CC,var_C0,var_CC - NtGlobalFlag + var_BC);
	*/
	if (Ret == 0) {
		return NULL;
	}
	esi = 0x80;
	if (pHeapBase->___u0.Segment.Entry.___u0.__s5.InterceptorValue != 0) {
		memset((void*)edi, 0, 0x80);
	}
	char* p = (char*)edi;
	*(DWORD*)(p + 4) = 0x80;
	*(DWORD*)(p + 0x1C) = (DWORD)(p+0x24);
	*(DWORD*)(p + 0x18) = (DWORD)&pHeapBase->FreeLists;
	*(DWORD*)(p + 0x20) = (DWORD)(p + 0x34);
	/*
	// 初始化堆块
	RtlpPopulateListIndex(pHeapBase,edi);
	*/
	pHeapBase->ProcessHeapsListIndex = 0;
	pHeapBase->SegmentReserve = stParameters.SegmentReserve;
	pHeapBase->SegmentCommit = stParameters.SegmentCommit;
	pHeapBase->DeCommitFreeBlockThreshold = stParameters.DeCommitFreeBlockThreshold >> 3;
	pHeapBase->DeCommitTotalFreeThreshold = stParameters.DeCommitTotalFreeThreshold >> 3;
	pHeapBase->MaximumAllocationSize = stParameters.MaximumAllocationSize;
	pHeapBase->VirtualMemoryThreshold = (stParameters.VirtualMemoryThreshold + 7) >> 3;
	*(DWORD*)pHeapBase->CommitRoutine = (DWORD)stParameters.CommitRoutine ^ _RtlHeapKey;
	pHeapBase->TuningParameters.CommittThresholdShift = 4;
	pHeapBase->TuningParameters.MaxPreCommittThreshold = 0xFE000;
	if (RtlpDisableHeapLookaside & 1 != 0) {
		pHeapBase->CompatibilityFlags = 1;
	}
	if (Flags & 0x10000 == 0) {
		pHeapBase->AlignRound = 0xF;
		pHeapBase->AlignMask = 0xFFFFFFF8;
	}
	else {
		pHeapBase->AlignRound = 0x17;
		pHeapBase->AlignMask = 0xFFFFFFF0;
	}
	if (pHeapBase->Flags & 0x20 != 0) {
		pHeapBase->AlignRound += 8;
	}
	pHeapBase->FrontEndHeap = 0;
	pHeapBase->FrontHeapLockCount = 0;
	pHeapBase->FrontEndHeapType = 0;
	pHeapBase->RequestedFrontEndHeapType = 0;
	pHeapBase->UCRIndex = 0;
	if ((Flags & 3) == 2 ? 1 : 0 & _RtlpDisableHeapLookaside & 1 == 0 ? 1 : 0 != 0) {
		wchar_t* Ret = 0;
		/*
		// 申请内存
		Ret = RtlAllocateHeap(pHeapBase,0x80000A,0x256);
		*/
		pHeapBase->FrontEndHeapUsageData = Ret;
		if (pHeapBase->FrontEndHeapUsageData == 0) {
			return NULL;
		}
		*(pHeapBase->FrontEndHeapUsageData - 1) = 1;
		pHeapBase->FrontEndHeapMaximumIndex = 0x80;
	}
	/*
	// 进入临界区
	RtlEnterCriticalSection(&_RtlpProcessHeapsListLock);
	// 添加到堆列表
	RtlpAddHeapToUnprotectedList(pHeapBase);
	// 退出临界区
	RtlEnterCriticalSection(&_RtlpProcessHeapsListLock);
	*/
	if (pHeapBase->ProcessHeapsListIndex == 0) {
		return NULL;
	}
	DWORD SessionId = 0;
	/*
	// 获取会话ID
	SessionId = RtlGetCurrentServiceSessionId();
	*/
	if (SessionId != 0) {
		SessionId = (DWORD)peb->SharedData + 0x226;
	}
	else {
		SessionId = 0x7FFE0380;
	}
	if (*(char*)SessionId != 0 && peb->___u71.TracingFlags & 1 != 0) {
		/*
		// 获取会话ID
		SessionId = RtlGetCurrentServiceSessionId();
		*/
		if (SessionId != 0) {
			SessionId = (DWORD)peb->SharedData + 0x226;
		}
		/*
		// 记录日志
		RtlpLogHeapCreateEvent(pHeapBase,Flags,var_BC,var_C4,*(char*)SessionId);
		*/
	}
	else {
		esi = Flags;
	}
	/*
	// 获取会话ID
	SessionId = RtlGetCurrentServiceSessionId();
	*/
	if (SessionId != 0) {
		SessionId = (DWORD)peb->SharedData + 0x230;
	}
	else {
		SessionId = 0x7FFE038A;
	}
	if (*(char*)SessionId != 0) {
		/*
		// 获取会话ID
		SessionId = RtlGetCurrentServiceSessionId();
		*/
		if (SessionId != 0) {
			SessionId = (DWORD)peb->SharedData + 0x230;
		}
		/*
		// 记录日志
		RtlpLogHeapCreateEvent(pHeapBase,Flags,var_BC,var_C4,*(char*)SessionId);
		*/
	}
	/*
	// 获取会话ID
	SessionId = RtlGetCurrentServiceSessionId();
	*/
	if (SessionId != 0) {
		SessionId = (DWORD)peb->SharedData + 0x22E;
	}
	else {
		SessionId = 0x7FFE0388;
	}
	if (*(char*)SessionId != 0) {
		/*
		RtlpHeapLogRangeCreate(pHeapBase,var_BC,Flags);
		*/
	}
	pHeapBase->CompatibilityFlags = 0x7FFFFFFF;
	pHeapBase->StackTraceInitVar.Ptr = NULL;
	return (PVOID)pHeapBase;
}
```

# RtlpAllocateHeapInternal 未还原完

``` C++
DWORD dword_4B3A6834;
DWORD _RtlpHpEnvHandle;
DWORD _RtlpHpAppCompatFlags = 0x0B;
DWORD dword_4B3A32DC;
DWORD dword_4B3A4334;
DWORD _RtlpLargestLfhBlock = 0x4000;
DWORD* dword_4B3A4368;
DWORD dword_4B3A4364;

PVOID RtlpAllocateHeapInternal(
	[in]           PVOID  HeapHandle,
	[in]           SIZE_T Size,
	[in, optional] ULONG  Flags, 
	ULONG Tag
	) {
	_HEAP* pHeap = (_HEAP*)HeapHandle;
	_TEB32* pTeb = (_TEB32*)NtCurrentTeb();
	_PEB32* pPeb = (_PEB32*)pTeb->ProcessEnvironmentBlock;
	_HEAP* anonymous_11 = NULL;
	int anonymous_9;
	DWORD anonymous_8;
	DWORD anonymous_0;
	DWORD anonymous_7;
	DWORD anonymous_4;
	DWORD var_4C;
	DWORD var_58;
	DWORD var_8;
	DWORD var_5C;
	DWORD var_10;
	DWORD anonymous_3;
	DWORD anonymous_2;
	DWORD anonymous_10;
	DWORD anonymous_12;
	DWORD anonymous_6;
	DWORD dwDosError = 0;

DWORD esi;
	DWORD edi;
	DWORD ecx;
	DWORD eax;
	DWORD edx;

if (pHeap->___u0.Segment.SegmentSignature == 0xDDEEDDEE) {
		/*
		// 将堆页标志转为段标志
		var_4C = RtlpHpConvertFlagsToSegmentFlags(Flags);
		*/
		if (pHeap->NonDedicatedListLength != 0 && pTeb->ClientId.UniqueThread == 0) {
			var_4C |= 1;
		}
		if (_RtlpHpAppCompatFlags & 2 != 0) {
			esi = esi > 0x7EFF8 ? 0x20 : 0x8;
		}
		else {
			esi = 0;
		}
		if (esi + Size >= Size) {
			DWORD Ret = 0;
			/*
			// 分配内存
			Ret = RtlpHpAllocateHeap(HeapHandle,esi + Size,var_4C,Tag);
			*/
			if (Ret != 0) {
				edi = Ret;
				if (_RtlpHpAppCompatFlags & 2 != 0) {
					*(DWORD*)(Ret + esi - 8) = esi;
					if (esi > 8)
						*(DWORD*)Ret = esi;
					edi = Ret + esi;
				}
				esi = (DWORD)HeapHandle;
				BOOL IsLogEnabled = 0;
				/*
				// 检查跟踪日志是否启动
				IsLogEnabled = RtlpHpStackLoggingEnabled(HeapHandle);
				*/
				if (IsLogEnabled == 0)
					goto return1;
				goto return2;
			}
		}
		pTeb->LastStatusValue = 0xC0000017;
		DWORD dwDosError = 0;
		/*
		// Nt状态转换为Dos错误码
		dwDosError = RtlNtStatusToDosError(0xC0000017);
		*/
		pTeb->LastErrorValue = dwDosError;
		if (var_4C >= 0) {
			if (pHeap->___u0.Segment.SegmentFlags >= 0)
				return NULL;
		}
		/*
		// 引发异常
		RtlpAllocateHeapRaiseException(Size);
		*/
		return NULL;
	}
	anonymous_8 = 0;
	var_4C = 0;
	eax = pHeap->ForceFlags;
	anonymous_3 = pHeap->ForceFlags | Flags;
	anonymous_2 = 0;
	if (Size > 0x7FFFFFFF) {
		anonymous_8 = 5;
		goto return18;
	}
	eax &= 0x1000000;
	esi = Size;
	if (eax == 0 && eax == dword_4B3A32DC) {
		ecx = pHeap->CommitLimitData.MaxAllocationSizeBytes;
		if (pHeap->CommitLimitData.MaxAllocationSizeBytes == 0) {
			ecx = dword_4B3A4334;
			if (dword_4B3A4334 == 0) {
				goto return157;
			}
		}
		if (esi <= ecx)
			goto return157;
		eax = pHeap->CommitLimitData.AllocationLimitFailureCode;
		if (eax != 0) {
			/*
			// 记录堆分配失败日志
			RtlpLogHeapFailure(0x14,HeapHandle,0,eax,esi,pHeap->CommitLimitData.MaxAllocationSizeBytes);
			*/
		}
		anonymous_8 = 5;
		goto return18;
	}
return157:
	ecx = anonymous_3;
return156:

edx = pHeap->Interceptor;
	anonymous_7 = edx;
	if (edx != 0) {
		if (ecx != 0x3C000102 || eax != 0) {
			anonymous_7 = 0;
			goto return154;
		}
		ecx = anonymous_7;
		DWORD Ret = 0;
		/*
		// 
		Ret = RtlpCallInterceptRoutine(anonymous_7,HeapHandle,0,1,&anonymous_2);
		*/
		if (Ret < 0)
			goto return18;
		ecx = anonymous_2;
		esi += 8;
		ecx += 7;
		ecx &= 0xFFFFFFF8;
		esi += ecx;
		Size = esi;
		eax = ecx + 8;
		anonymous_2 = eax;
	}

return154:
	eax = Size;
	if (Size == 0)
		eax = 1;

var_4C = (eax + 0xF) & 0xFFFFFFF8;
	anonymous_10 = (var_4C >> 3);

if (anonymous_3 & 0x7D810F61 != 0)
		goto return21;
	if (Size > _RtlpLargestLfhBlock)
		goto return27;

edx = pHeap->FrontEndHeapStatusBitmap[anonymous_10 >> 3];
	eax = 1 << (anonymous_10 & 7);
	if (edx & eax == 0)
		goto return28;

/*寄存器分界线 eax ecx edx esi 
	edi = pHeap*/
	edx = (DWORD)pHeap->FrontEndHeap;
	anonymous_8 = 2;
	anonymous_11 = (_HEAP*)edx;
	eax = pHeap->FrontEndHeapUsageData[anonymous_10];
	ecx = 0;
	eax += 0x6F;
	anonymous_9 = 0;
	eax = eax * 4 + edx;
	anonymous_12 = eax;
	if (pHeap->FrontEndHeapStatusBitmap[0xC6] & 1 == 0) {
		eax = *(char*)(eax + 3);
		if (eax & 1 != 0) {
			anonymous_9 = (pTeb->HeapData & 0xFF) - 1;
			if (anonymous_9 < 0 && dword_4B3A4368[anonymous_9] != (DWORD)HeapHandle) {
				DWORD dwProcessorNumber = 0;
				/*
				// 获取允许当前线程的处理器数量
				dwProcessorNumber = NtGetCurrentProcessorNumber();
				*/
				anonymous_9 = dword_4B3A4364 & dwProcessorNumber;
				pTeb->HeapData = anonymous_9 + 1;
				dword_4B3A4368[anonymous_9] = (DWORD)HeapHandle;
				edx = (DWORD)anonymous_11;
			}
		}
	}

var_58 = (DWORD)anonymous_11 + ((anonymous_9 + 0x7D) * 2 + anonymous_9) * 8;
	esi = *(WORD*)anonymous_12;
	eax = *(BYTE*)(anonymous_12 + 2);
	var_5C = esi << 3;
	if (anonymous_9 == 0) {
		ecx = *(DWORD*)((DWORD)anonymous_11 + eax * 4 + 0x3C0);
		var_8 = ecx;
		anonymous_0 = var_8 + 4;
	}
	else {
		ecx = *(DWORD*)((DWORD)anonymous_11 + eax * 4 + 0x5C4);
		ecx += anonymous_9 * 0x68 - 0x68;
		var_8 = ecx;
		anonymous_0 = var_8 + 4;
	}
	eax = anonymous_0;
	ecx = var_8;

eax = *(DWORD*)eax;
	anonymous_6 = eax;
	if (anonymous_6 != 0) {
		edi = eax + 0x10;
		var_10 = 0;
		eax = *(DWORD*)edi;
		eax >>= 0x10;
		ecx = *(DWORD*)ecx;
		ecx = *(DWORD*)(ecx + 0xC);
		anonymous_4 = ecx;
		if ((short)eax < 0) {
			edx = var_8;
			var_10 = 1;
			eax = *(WORD*)(edx + 0x5C);
			esi = ecx + eax * 4;
			eax = *(BYTE*)(esi + 0x1BF);
			if (eax & 1 == 0) {
				edx = *(BYTE*)(esi + 0x1BE);
				/*
				// 将堆段信息指针与堆桶（Bucket）关联
				RtlpAffinitizeSegmentInfoForBucket(ecx,edx);
				*/

}
		}
	return142:

}
return134:

return28:

return27:

return21:

return18:
	edi = 0;
return17:
	pTeb->LastStatusValue = 0xC0000017;
	/*
	// Nt状态转换为Dos错误码
	dwError = RtlNtStatusToDosError(0xC0000017);
	*/
	pTeb->LastErrorValue = dwDosError;
	if (anonymous_3 & 4 == 0)
		goto return12;
	ecx = var_4C;
	if (ecx == 0) {
		ecx = Size;
	}
	/*
	// 分配失败引发异常
	RtlpAllocateHeapRaiseException(ecx);
	*/
return15:
	esi = (DWORD)HeapHandle;
return14:
	ecx = anonymous_3;
return13:
	if (pPeb->TlsBitmapBits[1] == 0)
		goto return11;
	if (*(DWORD*)pPeb->TlsBitmapBits[1] == 0)
		goto return11;
	eax = pPeb->TlsBitmapBits[1] + 0x226;
	goto return10;
return12:
	esi = (DWORD)HeapHandle;
	goto return13;
return11:
	eax = 0x7FFE0380;
return10:
	if (*(char*)eax == 0)
		goto return5;
	if (pPeb->___u71.TracingFlags & 1 == 0)
		goto return5;
	if (((_HEAP*)esi)->ForceFlags & 0x1000000 != 0)
		goto return5;
	if (ecx & 0x61000000 == 0)
		goto return9;
	if (ecx & 0x10000000 == 0)
		goto return5;
return9:
	if (anonymous_8 == 5)
		goto return5;
	if (edi == 0)
		goto return6;
	ecx = edi - 8;
	edx = edi - 8;
	if (*(char*)(edi - 1) != 5)
		goto return8;
	eax = *(char*)(edx + 6) << 3;
	ecx -= eax;
	eax = *(char*)(edx + 7);
return8:
	if (*(char*)(edx + 7) < 0)
		goto return6;
	if (eax != 5)
		goto return7;
	eax = *(char*)(edx + 6) << 3;
	edx -= eax;
return7:
	ecx = (pHeap->EncodeFlagMask >> 0x11) & pHeap->Encoding.___u0.UnpackedEntry.___u0.__s0.Flags;
	eax = *(char*)(edx + 2);
	ecx ^= eax;
	if (ecx & 8 != 0)
		goto return5;
return6:
	/*
	// 记录堆分配事件
	RtlpLogHeapAllocateEvent(HeapHandle,edi,Size,anonymous_8);
	*/
	goto return3;
return5:
	esi = (DWORD)HeapHandle;
return3:
	eax = dword_4B3A6834;
	if (eax & 1 == 0 || eax & 2 == 0)
		goto return1;
	if (pPeb->ProcessHeap == 0)
		goto return1;
	/*
	// 获取堆Context
	 RtlpHpMetadataHeapCtxGet(_RtlpHpEnvHandle,pHeapContext);
	*/
	if ((DWORD)HeapHandle == *(DWORD*)eax)
		goto return1;
	if (edi == 0)
		goto return1;
	if (anonymous_3 & 0x10000000)
		goto return1;
return2:
	/*
	// 堆栈追踪，记录堆栈信息
	RtlpHpStackTraceAddStack(HeapHandle,edi);
	*/
return1:
	return (PVOID)edi;
}
```

登录后可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

#其他内容

收藏・4

点赞・3

打赏

最新回复 (4)
TeddyBe4r 雪币： 4437 活跃值： (3804) 能力值： ( LV12，RANK：330 ) 在线值：发帖 17 回帖 37 粉丝 135 关注私信	TeddyBe4r 6 2 楼博哥yes!!! 2025-3-1 18:59 0
BitWarden 雪币： 2473 活跃值： (1910) 能力值： ( LV8，RANK：120 ) 在线值：发帖 10 回帖 53 粉丝 70 关注私信	BitWarden 2 3 楼博哥牛逼 2025-3-2 20:30 0
mb_xrcdmrqz 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 17 粉丝 0 关注私信	mb_xrcdmrqz 4 楼 BitWarden 博哥牛逼博哥是谁 2025-7-8 19:09 0
mb_srlcyqpq 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 10 粉丝 0 关注私信	mb_srlcyqpq 5 楼 32位的windows10？ 2026-4-26 17:45 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

xichang13

发帖

回帖

RANK

关注

私信

他的文章

[原创]so文件upx壳的脱壳 4962
[分享]Win10的RtlCreateHeap分析 8657

关于我们

联系我们

企业服务

看雪公众号

最新回复 (4)
TeddyBe4r 雪币： 4437 活跃值： (3804) 能力值： ( LV12，RANK：330 ) 在线值：发帖 17 回帖 37 粉丝 135 关注私信	TeddyBe4r 6 2 楼博哥yes!!! 2025-3-1 18:59 0
BitWarden 雪币： 2473 活跃值： (1910) 能力值： ( LV8，RANK：120 ) 在线值：发帖 10 回帖 53 粉丝 70 关注私信	BitWarden 2 3 楼博哥牛逼 2025-3-2 20:30 0
mb_xrcdmrqz 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 17 粉丝 0 关注私信	mb_xrcdmrqz 4 楼 BitWarden 博哥牛逼博哥是谁 2025-7-8 19:09 0
mb_srlcyqpq 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 10 粉丝 0 关注私信	mb_srlcyqpq 5 楼 32位的windows10？ 2026-4-26 17:45 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复