用于新运算符和删除运算符的DLL [英] DLL for new and delete operators

问题描述

我想钩住new和delete运算符.但是我无法找到这些运算符所在的原始DLL.我使用了msvcr90.dll，msvsr90d.dll，msvcrt.dll，kernal32.dll，ole32.dll和其他一些dll.但是我的间谍应用程序无法找到新的和删除的运算符.

如果有人可以告诉我在哪个DLL中定义了new和delete运算符

I want to hook new and delete operators. But I am unable to locate the original DLLs where these operators reside. I used msvcr90.dll, msvsr90d.dll, msvcrt.dll, kernal32.dll, ole32.dll and some more dlls as well. But my spying application is unable to locate new and delete operators.

Kindly if someone could tell me in which DLL new and delete operators are defined

推荐答案

new/delete运算符作为函数实现到标准库中.这些功能会-或早或晚-最终成为malloc 和随后的HeapAlloc.

如果将标准库链接为DLL，则MSVCxxx.DLL中包含"operator new(...)"函数重载集(如上一篇文章中所述).
如果您静态链接标准库，它们将被绑定到您的"exe"文件中.如您在上一篇文章中所见.

The new/delete operators are implemented as functions into the standard library. These function will -sooner or later- end up into a malloc and later HeapAlloc.

If you link the standard library as a DLL, the "operator new(...)" function overload set is in MSVCxxx.DLL (as said in a previous post).
If you link the standard library statically, they will be binded into your "exe" file; as you see in you last post.

您对哪个和新的运算符感兴趣?那里...

-单个运算符new和运算符delete
-数组运算符new和运算符delete
-展示位置运算符new和运算符delete

为什么不在对new的调用上添加断点，介入并查看最终结果呢?

干杯，

Ash

Which new and delete operators are you interested in? Theres...

- single operator new and operator delete
- array operator new and operator delete
- placement operator new and operator delete

Why not stick a breakpoint on a call to new, step in and see where you end up?

Cheers,

Ash

感谢您对Aescleal的迅速答复.

我说的是单个运算符new和运算符delete.

我已经尝试了断点，但最终出现在new.cpp中，但这不是我想要的，因为我需要dll而不是.cpp或.h

由ASH

当您进入new.cpp时，请查看您的应用程序调用堆栈.它将告诉您正在逐步执行的代码在哪个DLL中.

(调试时从菜单上的VC ++设置中的ALT-7或debug-> windows->调用堆栈.)

干杯，

灰

Thank you for your prompt reply Aescleal.

I am talking about single operator new and operator delete.

I have tried out the break point and it ends up in new.cpp but this is not what i wanted as i need the dll and not .cpp or .h

EDIT BY ASH:

When you end up in new.cpp have a look at your applications call stack. That''ll tell you what DLL the code you''re stepping through is in.

(ALT-7 on my VC++ setup or debug->windows->call stack from the menu while debugging.)

Cheers,

Ash

这篇关于用于新运算符和删除运算符的DLL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！