Posts

Showing posts from February, 2008

Checking Memory Corruption using Gflags and NTSD debugger

>gflags /p /enable mmladc.exe path: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options mmladc.exe: page heap enabled >gflags /p path: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options mmladc.exe: page heap enabled with flags (traces ) >ntsd -g -x -pn mmladc.exe If there is a heap corruption you will see something like this =========================================================== VERIFIER STOP 00000006: pid 0x3634: corrupted heap pointer or using wrong heap 01421000 : Heap used in the call 0152C100 : Heap block 00000000 : Block size 70F0F0F0 : Heap owning the block =========================================================== >.lines Line number information will be loaded >kb