Click here to Skip to main content
15,867,594 members
Please Sign up or sign in to vote.
5.00/5 (1 vote)
See more:
I want to hook new and delete operators. But I am unable to locate the original DLLs where these operators reside. I used msvcr90.dll, msvsr90d.dll, msvcrt.dll, kernal32.dll, ole32.dll and some more dlls as well. But my spying application is unable to locate new and delete operators.

Kindly if someone could tell me in which DLL new and delete operators are defined
Posted
Updated 2-Jun-10 2:22am
v3

The new/delete operators are implemented as functions into the standard library. These function will -sooner or later- end up into a malloc and later HeapAlloc.

If you link the standard library as a DLL, the "operator new(...)" function overload set is in MSVCxxx.DLL (as said in a previous post).
If you link the standard library statically, they will be binded into your "exe" file; as you see in you last post.
 
Share this answer
 
No Sir the break point does not provide me with enough information. i.e. Dll Name. it always provide me with the current application name.

moeover on right click menu there are no such information regarding module name etc.

I have already said that my application is unable to locate the operators in msvcr90.dll
 
Share this answer
 
When you put a breakpoint on and step in, if you look at the call stack it should tell you what module you are in.

So for example the call stack might look like similar to this:

Test.exe!MyNamespace::MyClass::MyFunction() Line 52
Test.exe!WinMain(hInstance=0x01230000, hPrevInstance=0x00000000, lpCmdLine=0x00123456, nCmdShow=1) Line 67 + 0x89


Where the first thing it tells you is the module, we can see here that we are in our own application Test.exe

If your call stack isn't showing you the module names, right-click and then click on Show Module Names


EDIT: After a quick look myself it seems that the DLL you are looking for is: msvcr90.dll Though I strongly urge you to check yourself.
 
Share this answer
 
v2
Thank you for your prompt reply Aescleal.

I am talking about single operator new and operator delete.

I have tried out the break point and it ends up in new.cpp but this is not what i wanted as i need the dll and not .cpp or .h

EDIT BY ASH:

When you end up in new.cpp have a look at your applications call stack. That'll tell you what DLL the code you're stepping through is in.

(ALT-7 on my VC++ setup or debug->windows->call stack from the menu while debugging.)

Cheers,

Ash
 
Share this answer
 
v2
Which new and delete operators are you interested in? Theres...

- single operator new and operator delete
- array operator new and operator delete
- placement operator new and operator delete

Why not stick a breakpoint on a call to new, step in and see where you end up?

Cheers,

Ash
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900