What do the different columns in the “!heap -flt -s xxxx” windbg command represent

Question

I\'ve been doing some work on high memory issues, and I\'ve been doing a lot of heap analysis in windbg, and I was curious what the different columns really mean in \"!heap

Answer 1

HEAP_ENTRY Heaps store allocated blocks in contiguous Segments of memory, each allocated block starts with a 8-bytes header followed by the actual allocated data. The HEAP_ENTRY column is the address of the beginning of the header of the allocated block.

Size The heap manager handles blocks in multiple of 8 bytes. The column is the number of 8 bytes chunk allocated. In your sample, 0044 means that the block takes 0x220 bytes (0x44*8).

Prev Multiply per 8 to have the negative offset in bytes to the previous heap block.

Flags This is a bitmask that encodes the following information

0x01 - HEAP_ENTRY_BUSY
0x02 - HEAP_ENTRY_EXTRA_PRESENT
0x04 - HEAP_ENTRY_FILL_PATTERN
0x08 - HEAP_ENTRY_VIRTUAL_ALLOC
0x10 - HEAP_ENTRY_LAST_ENTRY

UserPtr This is the pointer returned to the application by the HeapAlloc (callbed by malloc/new) function. Since the header is always 8 bytes long, it is always HEAP_ENTRY +8.

UserSize This is the size passed the HeapAlloc function.

state This is a decoding of the Flags column, telling if the entry is busy, freed, last of its segment, …

Be aware that in Windows 7/2008 R2, heaps are by default using a front-end named LFH (Low fragmented heap) that uses the default heap manager to allocate chunks in which it dispatched user allocated data. For these heaps, UserPtr and UserSize will not point to real user data. The output of !heap -s displays which heaps are LFH enabled.