Funny Memory Values

Introduction

Microsoft has put quite a lot of memory leak detection helpers in Windows NT. They have not done a good job of advertising it. This document describes some of the things I've deciphered while debugging code.

Funny Memory Values

Many times while debugging programs, I will come across memory that is filled with "funny" values. After some playing around (i.e. hacking) with the Win32 API, I was able to figure out what they meant. Some of these values have been documented in places but never all together. The values for the tags presented here are hexadecimal because that's the way Developer's Studio presents them in the memory window.

Value	Meaning
0xAB or  0xABAB  or  0xABABABAB	Memory following a block allocated by LocalAlloc().
0xBAADF00D	Bad Food. Get it? This is memory allocated via LocalAlloc( LMEM_FIXED, ... ). It is memory that has been allocated but not yet written to.
0xFEEE  0xFEEEFEEE	This seems to be memory that has been dedicated to a heap but not yet allocated by HeapAlloc() or LocalAlloc().
0xCC or  0xCCCC or  0xCCCCCCCC	Microsoft Visual C++ compiled code with the /GZ is automatically initialized the uninitialized variable with this value.
0xCD or  0xCDCD or  0xCDCDCDCD	Microsoft Visual C++ compiled code with memory leak detection turned on. Usually, DEBUG_NEW was defined. Memory with this tag signifies memory that has been allocated (by malloc() or new) but never written to the application.
0xDD or  0xDDDD or  0xDDDDDDDD	Microsoft Visual C++ compiled code with memory leak detection turned on. Usually, DEBUG_NEW was defined. Memory with this tag signifies memory that has been freed (by free() or delete) by the application. It is how you can detect writing to memory that has already been freed. For example, if you look at an allocated memory structure (or C++ class) and most of the members contain this tag value, you are probably writing to a structure that has been freed.
0xFD or  0xFDFD or  0xFDFDFDFD	Microsoft Visual C++ compiled code with memory leak detection turned on. Usually, DEBUG_NEW was defined. Memory with this tag signifies memory that is in "no-mans-land." These are bytes just before and just after an allocated block. They are used to detect array-out-of-bounds errors. This is great for detecting off-by-one errors.

http://www.samblackburn.com/