Click here to Skip to main content
Sign Up to vote bad
good
I want to hook new and delete operators. But I am unable to locate the original DLLs where these operators reside. I used msvcr90.dll, msvsr90d.dll, msvcrt.dll, kernal32.dll, ole32.dll and some more dlls as well. But my spying application is unable to locate new and delete operators.
 
Kindly if someone could tell me in which DLL new and delete operators are defined
Posted 2 Jun '10 - 0:27
ah123ah206
Edited 2 Jun '10 - 2:22
Moak11.3K


5 solutions

The new/delete operators are implemented as functions into the standard library. These function will -sooner or later- end up into a malloc and later HeapAlloc.
 
If you link the standard library as a DLL, the "operator new(...)" function overload set is in MSVCxxx.DLL (as said in a previous post).
If you link the standard library statically, they will be binded into your "exe" file; as you see in you last post.
  Permalink  
Which new and delete operators are you interested in? Theres...
 
- single operator new and operator delete
- array operator new and operator delete
- placement operator new and operator delete
 
Why not stick a breakpoint on a call to new, step in and see where you end up?
 
Cheers,
 
Ash
  Permalink  
Thank you for your prompt reply Aescleal.
 
I am talking about single operator new and operator delete.
 
I have tried out the break point and it ends up in new.cpp but this is not what i wanted as i need the dll and not .cpp or .h
 
EDIT BY ASH:
 
When you end up in new.cpp have a look at your applications call stack. That'll tell you what DLL the code you're stepping through is in.
 
(ALT-7 on my VC++ setup or debug->windows->call stack from the menu while debugging.)
 
Cheers,
 
Ash
  Permalink  
When you put a breakpoint on and step in, if you look at the call stack it should tell you what module you are in.
 
So for example the call stack might look like similar to this:
 
Test.exe!MyNamespace::MyClass::MyFunction() Line 52
Test.exe!WinMain(hInstance=0x01230000, hPrevInstance=0x00000000, lpCmdLine=0x00123456, nCmdShow=1) Line 67 + 0x89
 
Where the first thing it tells you is the module, we can see here that we are in our own application Test.exe
 
If your call stack isn't showing you the module names, right-click and then click on Show Module Names
 

EDIT: After a quick look myself it seems that the DLL you are looking for is: msvcr90.dll Though I strongly urge you to check yourself.
  Permalink  
No Sir the break point does not provide me with enough information. i.e. Dll Name. it always provide me with the current application name.
 
moeover on right click menu there are no such information regarding module name etc.
 
I have already said that my application is unable to locate the operators in msvcr90.dll
  Permalink  

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Your Filters
Interested
Ignored
     
0 Sergey Alexandrovich Kryukov 443
1 Arun Vasu 381
2 OriginalGriff 345
3 Maciej Los 191
4 Aarti Meswania 190
0 Sergey Alexandrovich Kryukov 9,755
1 OriginalGriff 7,559
2 CPallini 4,018
3 Rohan Leuva 3,362
4 Maciej Los 2,951


Advertise | Privacy | Mobile
Web01 | 2.6.130523.1 | Last Updated 2 Jun 2010
Copyright © CodeProject, 1999-2013
All Rights Reserved. Terms of Use
Layout: fixed | fluid