kohnakagawa/HeapLayoutChecker.cpp

## HeapLayoutChecker.cpp
#include <iostream>
#include <Windows.h>
#include <vector>
#include <algorithm>

class OffsetTracker
{
	std::vector<int> offsets;

public:

	void Register(int i)
	{
        offsets.push_back(i);
	}

	void Summerize()
	{
        std::sort(offsets.begin(), offsets.end());
        auto head = *offsets.begin();
        int cnt = 0;
        for (auto offset : offsets)
        {
			if (head != offset)
			{
                std::cout << "offset: " << offset << " cnt: " << cnt << std::endl;
                head = offset;
                cnt = 0;
			}
			cnt++;
        }

		std::cout << "offset: " << *(offsets.end() - 1) << " cnt: " << cnt << std::endl;
	}
};

class SomeObject
{
    int i;
    int j;
public:
    SomeObject()
    {
        i = j = 0;
    }
};

#define OBJECT_COUNT 1297

void SprayTest() {
    OffsetTracker offsetTracker;
    LPVOID* objects = new LPVOID[OBJECT_COUNT];

    for (int i = 0; i < OBJECT_COUNT; i++) {
        SomeObject* obj = new SomeObject();
        objects[i] = obj;
        if (i > 0) {
            int offset = (int)objects[i] - (int)objects[i - 1];
            offsetTracker.Register(offset);
            printf("Object at 0x%08x. Offset to previous = 0x%08x\n", (int)obj, offset);
        }
        else {
            printf("Object at 0x%08x\n", (int)obj);
        }
    }

    offsetTracker.Summerize();
}

int main()
{
    SprayTest();
}
	#include <iostream>
	#include <Windows.h>
	#include <vector>
	#include <algorithm>

	class OffsetTracker
	{
	std::vector<int> offsets;

	public:

	void Register(int i)
	{
	offsets.push_back(i);
	}

	void Summerize()
	{
	std::sort(offsets.begin(), offsets.end());
	auto head = *offsets.begin();
	int cnt = 0;
	for (auto offset : offsets)
	{
	if (head != offset)
	{
	std::cout << "offset: " << offset << " cnt: " << cnt << std::endl;
	head = offset;
	cnt = 0;
	}
	cnt++;
	}

	std::cout << "offset: " << *(offsets.end() - 1) << " cnt: " << cnt << std::endl;
	}
	};

	class SomeObject
	{
	int i;
	int j;
	public:
	SomeObject()
	{
	i = j = 0;
	}
	};

	#define OBJECT_COUNT 1297

	void SprayTest() {
	OffsetTracker offsetTracker;
	LPVOID* objects = new LPVOID[OBJECT_COUNT];

	for (int i = 0; i < OBJECT_COUNT; i++) {
	SomeObject* obj = new SomeObject();
	objects[i] = obj;
	if (i > 0) {
	int offset = (int)objects[i] - (int)objects[i - 1];
	offsetTracker.Register(offset);
	printf("Object at 0x%08x. Offset to previous = 0x%08x\n", (int)obj, offset);
	}
	else {
	printf("Object at 0x%08x\n", (int)obj);
	}
	}

	offsetTracker.Summerize();
	}

	int main()
	{
	SprayTest();
	}