Is there an allocate winapi call in x86 EXEs?

Question

How is allocation handled within a C++ compiled EXE? Is the allocation manager baked into the app making it impossible to track allocations / unallocations if you don't have the code? Or is there a WinAPI call or something similar for memory allocation?

Answer 1

The basis for the memory allocation is indeed some WinAPI call (typically the Heap functionality). These are "hidden" behind the operator new and malloc and other related functionality. You should be able to identify the calls to the Heap Functions, but there are probably several layers of functions between the raw heap and the actual memory allocation call.

Edit: Clearly, if the program is compiled to use the C runtime as a .DLL, the code to actually perform the allocation is not in the executable at all - it would be in the DLL.

And of course, it's interely possible that the programmer who wrote the code: 1. didn't use C/C++, in which case all bets are off. 2. wrote their own version of memory management in some way, using for example VirtualAlloc

Answer 2

Generally, the allocation function is provided by your C runtime library. That library in turn is written by your vendor. Microsoft's Visual C++ will presumably use Windows kernel routines to implement allo­cations, but you should check the documentation and/or ask your vendor.

Answer 3

There's usually some of both. Normal code allocates memory via the heap manager that's built into the standard library. That, in turn, allocates larger blocks of memory from the OS, then allows the rest of the code to allocate smaller pieces of memory out of that big block.

Whether the heap manager is actually in the application or not depends how it was compiled and linked. If it uses the standard library in a DLL, then it'll use code from the standard library DLL. If it's linked to the standard library statically, then the heap manager code will be linked into the executable itself.