1

I have an address (i.e. 0x010f73fc) and I need to know where this address exist ? is it on stack or heap ?

In another way, how to differentiate between addresses that belong to the stack and addresses that belong to heap ?

2
  • It depends on the OS and the compiler. – user93353 Aug 3 '13 at 18:27
  • I think there is a memory map feature, which lists regions of memory together with their purpose. – CodesInChaos Oct 6 '13 at 18:38
1

As a general rule, you can't know just from the address. But with some context you can. Look at the SP register, for example. The stack and the heap typically grow toward each other, so in a low memory pressure environment, the addresses should be far apart.

1

You cannot really know that because each thread has its own stack, and the stacks for threads are allocated... on the heap.

A given OS will normally have a reserved pre-allocated area for the stack of the "main thread", but this depends on the exact version of the OS and it may even, conceptually, be moved around randomly at each execution. Your debugger, though, if attached to the process, should be able to give you the list of currently running threads and, for each of them, their current stack pointer, giving you clues as to the whereabouts of all these stacks.

0

Well you can find it on your system at a particular time but you cannot judge that at all times that address ( even on your machine) will be in stack or heap .

In old days before ASLR you could simply open the program in a debugger ( like immunity) and see where the address belongs to , for that particular program . Now its not possible even for the same program .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.