Click here to Skip to main content
15,300,338 members
Please Sign up or sign in to vote.
5.00/5 (1 vote)
See more:
I want to hook new and delete operators. But I am unable to locate the original DLLs where these operators reside. I used msvcr90.dll, msvsr90d.dll, msvcrt.dll, kernal32.dll, ole32.dll and some more dlls as well. But my spying application is unable to locate new and delete operators.

Kindly if someone could tell me in which DLL new and delete operators are defined
Updated 2-Jun-10 2:22am

The new/delete operators are implemented as functions into the standard library. These function will -sooner or later- end up into a malloc and later HeapAlloc.

If you link the standard library as a DLL, the "operator new(...)" function overload set is in MSVCxxx.DLL (as said in a previous post).
If you link the standard library statically, they will be binded into your "exe" file; as you see in you last post.
Which new and delete operators are you interested in? Theres...

- single operator new and operator delete
- array operator new and operator delete
- placement operator new and operator delete

Why not stick a breakpoint on a call to new, step in and see where you end up?


Thank you for your prompt reply Aescleal.

I am talking about single operator new and operator delete.

I have tried out the break point and it ends up in new.cpp but this is not what i wanted as i need the dll and not .cpp or .h


When you end up in new.cpp have a look at your applications call stack. That'll tell you what DLL the code you're stepping through is in.

(ALT-7 on my VC++ setup or debug->windows->call stack from the menu while debugging.)


When you put a breakpoint on and step in, if you look at the call stack it should tell you what module you are in.

So for example the call stack might look like similar to this:

Test.exe!MyNamespace::MyClass::MyFunction() Line 52
Test.exe!WinMain(hInstance=0x01230000, hPrevInstance=0x00000000, lpCmdLine=0x00123456, nCmdShow=1) Line 67 + 0x89

Where the first thing it tells you is the module, we can see here that we are in our own application Test.exe

If your call stack isn't showing you the module names, right-click and then click on Show Module Names

EDIT: After a quick look myself it seems that the DLL you are looking for is: msvcr90.dll Though I strongly urge you to check yourself.
No Sir the break point does not provide me with enough information. i.e. Dll Name. it always provide me with the current application name.

moeover on right click menu there are no such information regarding module name etc.

I have already said that my application is unable to locate the operators in msvcr90.dll

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900