if(Size == 0x0)
    Size = 0x1;

//ensure that this number is 8‐byte aligned
//保证分配量是8字节对齐
int RoundSize = Round(Size);

int BlocksSize = Size/8;

//get the HeapListLookup, which determines if we should use the LFH
//获取HeapListLookup，判断是否该使用LFH
_HEAP_LIST_LOOKUP *BlocksIndex = (_HEAP_LIST_LOOKUP*)heap‐>BlocksIndex;

//loop through the HeapListLookup structures to determine which one to use
//遍历HeapListLookup结构，找出需要使用的是哪一个
while(BlocksSize >= BlocksIndex‐>ArraySize)
{
    if(BlocksIndex‐>ExtendedLookup == NULL)
    {
        BlocksSize = BlocksIndex‐>ArraySize‐1;
        break;
    }
    BlocksIndex = BlocksIndex‐>ExtendedLookup;
}

//get the appropriate freelist to use based on size
//基于大小获取对应的FreeList
int FreeListIndex = BlocksSize ‐ HeapListLookup‐>BaseIndex;

_LIST_ENTRY *FreeList = &HeapListLookup‐>ListHints[FreeListIndex];
if(FreeList)
{
    //check FreeList[index]‐>Blink to see if the heap bucket context has been populated via RtlpGetLFHContext()
    //RtlpGetLFHContext() stores the HeapBucket context + 1 in the Blink
    //检查FreeList[index]‐>Blink，看看heap bucket context是否由RtlpGetLFHContext()填充过
    //RtlpGetLFHContext()在Blink中存储了HeapBucket context + 1
    _HEAP_BUCKET *HeapBucket = FreeList‐>Blink;

    if(HeapBucket & 1)
    {
        RetChunk = RtlpLowFragHeapAllocFromContext(HeapBucket‐1, aBytes);

        if(RetChunk && heap‐>Flags == HEAP_ZERO_MEMORY)
            memset(RetChunk, 0, RoundSize);
    }
}

//if the front‐end allocator did not succeed, use the back‐end
//如果前端分配器没有成功分配，那就用后端分配器
if(!RetChunk)
{
    RetChunk = RtlpAllocateHeap(heap, Flags | 2, Size, RoundSize, FreeList);
}

int RoundSize;

//if the FreeList isn't NULL, the rounding has already been preformed
//如果FreeList不是NULL，那么就已经完成大小对齐了
if(FreeList)
{
    RoundSize = RoundSize;
}
else
{
    int MinSize = 1;
    if(Size)
        MinSize = Size;

    //rounds to the nearest 8‐byte aligned number
    //向上取舍到最近的8字节对齐大小
    RoundSize = Round(MinSize);
}

int SizeInBlocks = RoundSize/8;

if(SizeInBlocks < 2)
{
    //RoundSize += sizeof(_HEAP_ENTRY)
    RoundSize = RoundSize + 8;
    SizeInBlocks = 2;
}

//if NOT HEAP_NO_SERIALIZE, use locking mechanisms
//LFH CANNOT be enabled if this path isn't taken
//如果没有设置HEAP_NO_SERIALIZE，就使用锁定机制
//如果没有使用此路径，则无法启用LFH
if(!(Flags & HEAP_NO_SERIALIZE))
{
    //setup locking mechanisms here
    //设置锁定机制

    //if we have certain compaitibility flags(either set below, or otherwise, 
    //then we will call 'RtlpPerformHeapMaintenance'
    //which will activate the LFH and setup an ExtendedListLookup as well
    //如果有具体的兼容性标志，就会调用'RtlpPerformHeapMaintenance'
    //它会激活LFH，也会设置ExtendedListLookup
    if(Heap‐>CompatibilityFlags & 0x60000000)
        RtlpPerformHeapMaintenance(Heap);
}

if(FreeList != NULL)
{
    //if this freelist doesn't hold a _HEAP_BUCKET, update the counters and attempt to get the LFH context
    //如果freelist未拥有一个_HEAP_BUCKET,就更新计数器并试图获取LFH上下文
    if(!(FreeList‐>Blink & 1)) //未启用LFH
    {
        //add a certain amount to the blink
        //为blink增加一个具体的数量
        FreeList‐>Blink += 0x10002;

        //if the counter has ran more than 0x10 times, OR
        //we haven't successfully entered the critical section, OR we've been through 0x1000 iterations
        //then attempt to set the Compatibility flags(which, in turn, will call RtlpPerformHeapMaintenance())
        //如果计数器已经执行了超过0x10次，或者我们不曾成功进入到关键部分，或者我们已经进行了0x1000次迭代
        //那么就会试图设置这个Compatibility标志(这就意味着我们会调用到RtlpPerformHeapMaintenance())
        if((WORD)FreeList‐>Blink > 0x20 || FreeList‐>Blink > 0x10000000)
        {
            //if the FrontEndHeapType is LFH (0x2) assign it
            //如果FrontEndHeapType是LFH(0x2)，进行赋值
            int FrontEndHeap;
            if(Heap‐>FrontEndHeapType == 0x2)
                FrontEndHeap = Heap‐>FrontEndHeap;
            else
                FrontEndHeap = NULL;

            //this function gets a _HEAP_BUCKET, stored in _LFH_HEAP‐>Bucket[BucketSize]
            //if the LFH hasn't been activated yet, it will return NULL
            //该函数获取一个_HEAP_BUCKET,它存储于_LFH_HEAP‐>Bucket[BucketSize]
            //如果LFH仍未被激活，就返回NULL
            char *LFHContext = RtlpGetLFHContext(FrontEndHeap, Size);

            //if the context isn't set and we've seen 0x10+ allocations, set the flags
            //如果上下文没有设置并且我们已经进行了0x10+次分配，也要设置该标志
            if(LFHContext == NULL)
            {
                if((WORD)FreeList‐>Blink > 0x20)
                {
                    //RtlpPerformHeapMaintenance heurstic
                    //RtlpPerformHeapMaintenance启发式机制
                    if(Heap‐>FrontEndHeapType == NULL)
                        Heap‐>CompatibilityFlags |= 0x20000000;
                }
            }
            else
            {
                //save the _HEAP_BUCKET in the Blink
                //+1 == _HEAP_BUCKET
                //保存_HEAP_BUCKET到Blink
                FreeList‐>Blink = LFHContext + 1;
            }
        }
    }
}

//attempt to use the Flink
//试图使用Flink
if(FreeList != NULL && FreeList‐>Flink != NULL)
{
    int SizeToUse;

    //saved values,保存值
    _HEAP_ENTRY *Blink = FreeList‐>Blink;
    _HEAP_ENTRY *Flink = FreeList‐>Flink;

    //get the heap chunk header by subtracting 8
    //通过减去8来获取堆头
    _HEAP_ENTRY *ChunkToUseHeader = Flink ‐ 8;

    //decode the header if applicable
    //解码头部(如果适用)
    if(Heap‐>EncodeFlagMask)
        DecodeAndValidateChecksum(ChunkToUseHeader);

    //ensure safe unlinking before acquiring this chunk for use
    //在获取该块以供使用之前，确保安全解除链接
    if(Blink‐>Flink != Flink‐>Blink || Blink‐>Flink != FreeList)
    {
        RtlpLogHeapFailure();
        //XXX RtlNtStatusToDosError and return
    }

    //decrement the total heap size
    //减小整体堆大小
    Heap‐>TotalFreeSize ‐= ChunkToUseHeader‐>Size;

    //iterate through the BlocksIndex structures
    //If no sufficient BlocksIndex is found, use BlocksIndex‐>ArraySize ‐ 1
    //迭代BlocksIndex结构体，如果找不到充足的BlocksIndex，就用BlocksIndex‐>ArraySize ‐ 1
    _HEAP_LIST_LOOKUP *BlocksIndex = Heap‐>BlocksIndex;
    if(BlocksIndex)
    {
        int ListHintIndex = GetListHintIndex(BlocksIndex, Size);
        int RelativeOffset = ListHintIndex ‐ BlocksIndex‐>BaseIndex;

        //if there are more of the same size，don't update the bitmap
        //如果相同大小的Chunk有很多，就不用更新位图
        if(Flink‐>Flink != BlocksIndex‐>ListHead && Flink.Size == Flink‐>Flink.Size)
        {
            BlocksIndex‐>ListHints[FreeListOffset] = Flink‐>Flink;
        }
        else
        {
            BlocksIndex‐>ListHints[FreeListOffset] = NULL;
            BlocksIndex‐>ListsInUseUlong[RelativeOffset >> 5] &= ~(1 << RelativeOffset & 0x1F);
        }
    }

    //unlink the current chunk to be allocated
    //将当前Chunk从FreeList上取下，以待分配
    Blink‐>Flink = Flink;
    Flink‐>Blink = Blink;
}

//attempt to use the FreeLists
//试图使用FreeLists
_LIST_ENTRY *HeapFreeLists = &Heap‐>FreeLists;
_HEAP_LIST_LOOKUP *BlocksIndex = Heap‐>BlocksIndex;
_LIST_ENTRY *ChunkToUse;

//find an appropriate chunk on the FreeLists
//在FreeLists上寻找合适的chunk
_HEAP_LIST_LOOKUP *CurrBlocksIndex = BlocksIndex;

while(1)
{
    //if we've ran out of structures abort and we'll extend the heap
    //如果搜索完了所有的BlocksIndex结构体还是找不到合适的Chunk，就扩展堆
    if(CurrBlocksIndex == NULL)
    {
        ChunkToUse = CurrBlocksIndex‐>ListHead;
        break;
    }

    //remember that ListHead and HeapFreeLists point to the same location
    //记住ListHead和HeapFreeLists指向同一位置
    CurrListHead = CurrBlocksIndex‐>ListHead;

    //if we've came upon an empty FreeList extend the heap
    //如果我们遇到了一个空的FreeList，就扩展heap
    if(CurrListHead == CurrListHead‐>Blink)
    {
        ChunkToUse = CurrListHead;
        break;
    }

    _HEAP_ENTRY *BlinkHeader = (CurrListHead‐>Blink ‐ 8);   //FreeLists中最大的Chunk的头指针

    //if the chunk is encoded decode it
    //如果该Chunk被编码了，就先解码
    if(Heap‐>EncodeFlagMask && Heap‐>EncodeFlagMask & BlinkHeader)
    {
        DecodeHeader(BlinkHeader);
    }

    //if the chunk can't be serviced by the largest chunk extend the heap
    //如果最大的Chunk不能服务，那么就扩展堆
    if(SizeInBlocks > BlinkHeader‐>Size)
    {
        ChunkToUse = CurrListHead;
        break;
    }

    _HEAP_ENTRY *FlinkHeader = CurrListHead‐>Flink‐8;   //FreeLists中最小的Chunk的头指针

    //if the chunk is encoded decode it
    //如果Chunk被编码了，就先解码
    if(Heap‐>EncodeFlagMask && Heap‐>EncodeFlagMask & FlinkHeader)
    {
        DecodeHeader(FlinkHeader);
    }

    //if the first chunk is sufficient use it otherwise loop through the rest
    //如果第一个Chunk的大小是足够的，就使用它，否则继续循环剩余的
    if(FlinkHeader‐>Size >= SizeInBlocks)
    {
        ChunkToUse = CurrListHead‐>Flink;
        break;
    }
    else
    {
        //loop through all the BlocksIndex‐>ListHints, looking for a sufficiently sized chunk
        //then update the bitmap accordingly
        //循环所有的BlocksIndex‐>ListHints,寻找一个大小足够的Chunk,然后相应的更新bitmap
    }

    //look at the next BlocksIndex
    //下一个BlocksIndex
    CurrBlocksIndex = CurrBlocksIndex‐>ExtendedLookup;
}

int LocalDataIndex = 0;

//uses the SizeIndex of the _HEAP_BUCKET to get the address of the LFH for this bucket
//使用_HEAP_BUCKET的SizeIndex来为该bucket获取LFH的地址
_LFH_HEAP *LFH = GetLFHFromBucket(HeapBucket);

//figure this out yourself :)
//这个请自己研究
if(HeapBucket‐>Affinity == 1)
{
    AllocateAndUpdateLocalDataIndex();
}

//get the LocalData and LocalSegmentInfo structures based on Affinity and SizeIndex
//根据Affinity和SizeIndex获取LocalData和LocalSegmentInfo结构
_HEAP_LOCAL_DATA *HeapLocalData = LFH‐>LocalData[LocalDataIndex];
_HEAP_LOCAL_SEGMENT_INFO *HeapLocalSegmentInfo = HeapLocalData‐>SegmentInfo[HeapBucket‐>SizeIndex];

//try to use the 'Hint' SubSegment first otherwise this would be 'ActiveSubsegment'
//首先尝试使用'Hint' Subsegment,不成再尝试使用'ActiveSubsegment'
_HEAP_SUBSEGMENT *SubSeg = HeapLocalSegmentInfo‐>Hint;
_HEAP_SUBSEGMENT *SubSeg_Saved = HeapLocalSegmentInfo‐>Hint;

if(SubSeg)
{
    while(1)
    {
        //get the current AggregateExchange information
        //获取当前的AggregateExchange信息
        _INTERLOCK_SEQ *AggrExchg = SubSeg‐>AggregateExchg;
        int Offset = AggrExchg‐>FreeEntryOffset;
        int Depth = AggrExchg‐>Depth;
        int Sequence = AggrExchg‐>Sequence;

        //store the old values, to ensure atomic swapping
        //存储旧值，保证原子交换
        _INTERLOCK_SEQ AggrExchg_Saved;
        AggrExchg_Saved.OffsetAndDepth = AggrExchg.OffsetAndDepth;
        AggrExchg_Saved.Sequence = Sequence;

        //continue only if this is a valid SubSegment
        //仅在是合法的SubSegment情形下才继续
        _HEAP_USERDATA_HEADER *UserBlocks = SubSeg‐>UserBlocks;
        if(!Depth || !UserBlocks || SubSeg‐>LocalInfo != HeapLocalSegmentInfo)
        {
            break;
        }

        //this gets the offset from the AggregateExchg(block size) and creates a byte offset
        //从AggregateExchg中获取offset(以blocks为单位)，计算出字节偏移
        int ByteOffset = Offset * 8;
        LFHChunk = UserBlocks + ByteOffset;

        //the next offset is store in the 1st 2‐bytes of the userdata (this can probably be abused :))
        //下一个offset存储于用户数据的前两个字节中(这可能会被滥用)
        short NextOffset = UserBlocks + ByteOffset + sizeof(_HEAP_ENTRY);

        //store the updated offset, depth and sequence
        //存储更新的offset，depth和sequence
        //new_offset = current_offset += BucketSize
        //new_depth = current_deth‐‐
        //new_sequence = depends on current depth
        _INTERLOCK_SEQ AggrExchg_New;
        AggrExchg_New.Offset = NextOffset;
        AggrExchg_New.Depth = Depth‐‐;
        if(AggrExchg_New.Depth == ‐1)
            AggrExchg_New.Sequence = Sequence‐‐;
        else
            AggrExchg_New.Sequence = Sequence;

        //i.e InterLockedCompareExchange
        if(AtomicSwap(AggrExchg, AggrExchg_New))
        {
            UpdateHeaders(LFHChunk);
            return LFHChunk;
        }
        else
        {
            UpdateAffinity();
            SubSeg = SubSeg_Saved;
        }
    }
}

int TotalBlocks = HeapLocalSegmentInfo‐>Counters‐>TotalBlocks;

if(MaxRunLenReached)
    TotalBlocks = TotalBlocks / 16;

int BucketAffinity = HeapBucket‐>Affinity & 1;

int BucketBytesSize = RtlpBucketBlockSizes[HeapBucket‐>SizeIndex];

int StartIndex = 7;

if(BucketBytesSize < 256)
    BucketAffinity‐‐;
if(dword_77F97594 > RtlpHeapMaxAffinity >> 1)
    BucketAffinity++;

int BlockMultiplier = 4 ‐ BucketAffinity;

if(TotalBlocks < (1 << BlockMultiplier))
    TotalBlocks = 1 << BlockMultiplier;

if(TotalBlocks > 1024)
    TotalBlocks = 1024;

//used to calculate cache index and size to allocate
//用于计算要分配的缓存索引和大小
int TotalBlockSize = TotalBlocks * (BucketBytesSize + sizeof(_HEAP_ENTRY)) + 0x18l

if(TotalBlockSize > 0x78000)
    TotalBlockSize = 0x78000;

//calculate the cache index upon a cache miss,this index will determine the amount of memory to be allocated
//根据缓存命中计算缓存索引，索引将决定待分配的内存总量
if(TotalBlockSize >= 0x80)
{
    do
    {
        StartIndex++;
    }while(TotalBlockSize >> StartIndex);
}

//we will @ most, only allocate 40 pages (0x1000 bytes per page)
//我们至少要分配40个页(0x1000字节/页)
if((unsigned)StartIndex > 0x12)
    StartIndex = 0x12;

int UserBlockCacheIndex = StartIndex;

if(HeapBucket‐>Affinity & 6)
    UserBlockCacheIndex = 0x12;

//allocate space for a _HEAP_USERDATA_HEADER along with room
//for ((1 << UserBlockCacheIndex)/BucketBytesSize) heap chunks
//为_HEAP_USERDATA_HEADER和((1 << UserBlockCacheIndex)/BucketBytesSize)个堆Chunks分配空间
void *pUserData = RtlpAllocateUserBlock(LFH, UserBlockCacheIndex, BucketByteSize + 8);

_HEAP_USERDATA_HEADER *UserData = (_HEAP_USERDATA_HEADER*)pUserData;

if(!pUserData)
    return 0;

int AllocAmount = 1 << UserBlockCacheIndex;
if(AllocAmount > 0x78000)
    AllocAmount = 0x78000;

UserBlock = RtlAllocateHeap(LFH‐>Heap, 0x800000, AllocAmount ‐ 8);
if(UserBlock)
{
    LFH‐>CacheAllocs++;

    //Assign the _HEAP_USERDATA_HEADER‐>SizeIndex
    //赋值_HEAP_USERDATA_HEADER‐>SizeIndex
    *(UserBlock+8) = UserBlockCacheIndex;
}

return UserBlock;

int UserDataBytesSize = 1 << UserData‐>AvailableBlocks;
if(UserDataBytesSize > 0x78000)
    UserDataBytesSize = 0x78000;

int UserDataAllocSize = UserDataBytesSize ‐ 8;

//Increment SegmentCreate to denote a new SubSegment created
//递增SegmentCreate来指示一个新的SubSegment被创建了
InterlockedExchangeAdd(&LFH‐>SegmentCreate, 1);

DeletedSubSegment = ExInterlockedPopEntrySList(HeapLocalData);
_HEAP_SUBSEGMENT *NewSubSegment = NULL;
if(DeletedSubSegment)
{
    // if there are any deleted subsegments, use them
    // 如果有被删除的subsegments，就使用它
    NewSubSegment = (_HEAP_SUBSEGMENT*)(DeletedSubSegment ‐ 0x18);
}
else
{
    NewSubSegment = RtlpLowFragHeapAllocateFromZone(LFH, LocalDataIndex);

    //return failure use back‐end
    //返回失败，使用后端
    if(!NewSubsegment)
        return 0;
}

//this function will setup the _HEAP_SUBSEGMENT structure
//and check out the data in 'UserData' to be of HeapBucket‐>SizeIndex chunks
//该函数会设置_HEAP_SUBSEGMENT结构体,并检查'UserData'中的数据是否为HeapBucket‐>SizeIndex Chunks
RtlpSubSegmentInitialize(LFH,
                         NewSubSegment,
                         UserBlock,
                         RtlpBucketBlockSizes[HeapBucket‐>SizeIndex],
                         UserDataAllocSize,
                         HeapBucket);

//each UserBlock starts with the same sig
//每个UserBlock一开始都有着相同的标记
UserBlock‐>Signature = 0xF0E0D0C0;

_LFH_BLOCK_ZONE *CrtZone = LFH‐>LocalData[LocalDataIndex]‐>CrtZone;
_LFH_BLOCK_ZONE *CrtZoneFlink = NULL;

while(1)
{
    while(1)
    {
        while(1)
        {
            //Flink == NULL => create initial zones
            CrtZoneFlink = CrtZone‐>ListEntry‐>Flink;
            if(!CrtZone‐>Flink)
                break;

            void *FreePointer = CrtZoneFlink‐>FreePointer;

            //This will increment it to the next SubSegment
            //这会递增到下一个SubSegment
            void *FreePointer_New = FreePointer + LFH‐>ZoneBlockSize;

            //if we've exceeded the limit create more zones
            //如果超出了限制，就创建更多的zones
            if(FreePointer_New >= CrtZoneFlink‐>Limit)
                break;

            //InterlockedCompareExchange
            //loop if this fails
            //如果失败就一直循环，原子操作
            if(CompareExchange(&CrtZoneFlink‐>FreePointer,FreePointer_New))
                return FreePointer;
        }

        if(CrtZoneFlink == CrtZone‐>ListEntry.Flink)
            break;
    }

    //this will effectively give us 31 _LFH_BLOCK_ZONE structures to use for keeping track of userdata
    //这将有效的给我们31个_LFH_BLOCK_ZONE结构体，用于跟踪用户数据
    void *NewLFHBlockZone = RtlAllocateHeap(LFH‐>Heap, 0x80000u, 0x3F8u);
    if(!NewLFHBlockZone)
        return 0;

    //if the CrtZone's ListEntry is empty
    //如果CrtZone的ListEntry是空的
    if(CrtZoneFlink == CrtZone‐>ListEntry.Flink)
    {
        //link in the newly created structure into the LFH‐>SubSegmentZones
        //把新创建的结构链入到LFH‐>SubSegmentZones
        LinkInBlockZone(LFH, NewLFHBlockZone);

        //points to the end of the allocations
        //指向分配的末尾
        NewLFHBlockZone‐>Limit = NewLFHBlockZone + 0x3F8;

        //sizeof(_LFH_BLOCK_ZONE) == 0x10
        char *AlignedZone = RoundAlign(NewLFHBlockZone + 0x10);

        NewLFHBlockZone‐>FreePointer = AlignedZone;
        CrtZone‐>ListEntry.Flink = NewLFHBlockZone;
        continue;
    }
    // if we failed, free the data
    // 如果失败了，就释放数据
    RtlFreeHeap(LFH‐>Heap, 0x800000, NewLFHBlockZone);
}

void *UserBlockData = UserBlock + sizeof(_HEAP_USERDATA_HEADER);

_HEAP_LOCAL_SEGMENT_INFO *LocalSegmentInfo =
    LFH‐>LocalData[NewSubSegment‐>AffinityIndex]‐>SegmentInfo[HeapBucket‐>SizeIndex];

_HEAP_LOCAL_DATA *LocalData =
    LFH‐>LocalData[NewSubSegment‐>AffinityIndex]‐>Segmentinfo[HeapBucket‐>SizeIndex]‐>LocalData;

if (!((HeapBucket‐>Affinity >> 1) & 3))
{
    int TotalBucketByteSize = BucketByteSize + sizeof(_HEAP_ENTRY);
    int BucketBlockSize = TotalBucketByteSize / 8;

    //sizeof(_HEAP_USERDATA_HEADER) == 0x10
    int NumberOfChunks = (UserDataAllocSize ‐ 0x10) / TotalBucketByteSize;

    //skip past the header, so we can start chunking
    //跳过头部，我们可以开始Chunking
    void *pUserData = UserBlock + sizeof(_HEAP_USERDATA_HEADER);

    //assign the SubSegment
    //赋值给SubSegment
    UserBlock‐>SubSegment = NewSubSegment;

    //sizeof(_HEAP_USERDATA_HEADER) == 0x10 (2 blocks)
    int SegmentOffset = 2;

    _INTERLOCK_SEQ AggrExchg_New;
    AggrExchg_New.FreeEntryOffset = 2;

    if(NumberOfChunks)
    {
        int NumberOfChunksItor = NumberOfChunks;
        do
        {
            SegmentOffset += BucketBlockSize;
            pUserData = UserBlockData;
            UserBlockData += BucketByteSize;

            //next FreeEntryOffset
            *(WORD*)(pUserData + 8) = SegmentOffset;

            //Set _HEAP_ENTRY.LFHFlags
            *(BYTE*)(pUserData + 6) = 0x0;

            //Set _HEAP_ENTRY.UnusedBytes
            *(BYTE*)(pUserData + 7) = 0x80;

            EncodeDWORD(LFH, pUserData)
        }
        while(NumberOfChunksItor‐‐);
    }

    //‐1 indicates last chunk in the UserBlock (_HEAP_USERDATA_HEADER)
    //‐1表示UserBlock中的最后一个chunk
    *(WORD*)(pUserData + 8) = ‐1;

    //Sets all the values for this subsegment
    //为该subsegment设置所有的值
    InitSubSegment(NewSubSegment);

    //updates the bucket counter to reflect NumberOfChunk as total blocks and sets the SubSegmentCount
    //更新bucket计数器，以反映NumberOfChunk作为总块数，并设置SubSegmentCount
    UpdateBucketCounters(LocalSegmentInfo);

    //will be atomically assigned to the NewSubSegment's _INTERLOCK_SEQ
    //将原子的对NewSubSegment的_INTERLOCK_SEQ结构赋值
    AggrExchg_New.Depth = NumberOfChunks;
    AggrExchg_New.Sequence = AggrExchg_Saved.Sequence + 1;

    //InterlockedCompareExchange64
    AtomicSwap(&NewSubSegment‐>AggregateExchg, AggrExchg_New);
}

//now used for LFH allocation for a specific bucket size
//现在为特定bucket大小做LFH分配
AtomicSwap(&HeapLocalSegmentInfo‐>ActiveSegment, NewSubSegment);

ChunkHeader = NULL;

//it will not operate on NULL
//如果为NULL，将无需操作
if(ChunkToFree == NULL)
    return;

//ensure the chunk is 8‐byte aligned
//确保要释放的Chunk的地址8字节对齐
if(!(ChunkToFree & 7))
{
    //subtract the sizeof(_HEAP_ENTRY)
    //剪掉sizeof(_HEAP_ENTRY)
    ChunkHeader = ChunkToFree ‐ 0x8;

    //use the index to find the size
    //使用index来寻找大小
    if(ChunkHeader‐>UnusedBytes == 0x5)
        ChunkHeader ‐= 0x8 * (BYTE)ChunkToFreeHeader‐>SegmentOffset;
}
else
{
    RtlpLogHeapFailure();
    return;
}

//position 0x7 in the header denotes whether the chunk was allocated via
//the front‐end or the back‐end (non‐encoded ;) )
//头部的0x7位置指示了chunk是前端还是后端分配的(未编码)
if(ChunkHeader‐>UnusedBytes & 0x80)
    RtlpLowFragHeapFree(Heap, ChunkToFree);                     // 前端释放器
else
    RtlpFreeHeap(Heap, Flags | 2, ChunkHeader, ChunkToFree);    // 后端释放器

return;

if(Heap‐>EncodeFlagMask)
    DecodeAndValidateChecksum(ChunkHeader);

int ChunkSize = ChunkHeader‐>Size;
_HEAP_LIST_LOOKUP *BlocksIndex = Heap‐>BlocksIndex;

while(1)
{
    //if the chunk will fit in this BlocksIndex, break out
    //如果Chunk匹配该BlocksIndex，跳出去
    if(ChunkSize < BlocksIndex‐>ArraySize)
        break;

    //if the chunk is too big for this blocksindex and there is NOT
    //and extended lookup, then free onto FreeList[BlocksIndex‐>ArraySize‐1]
    //如果chunk太大了，且后面没有扩展了，就释放到FreeList[BlocksIndex‐>ArraySize‐1]
    if(!BlocksIndex‐>ExtendedLookup)
    {
        ChunkSize = BlocksIndex‐>ArraySize ‐ 1;
        break;
    }

    //next item in the linked list
    //BlocksIndex链表的下一个条目
    BlocksIndex = BlocksIndex‐>ExtendedLookup;
}

//attempt to locate a freelist
//试图定位freelist
_LIST_ENTRY *ListHint = NULL;

//if the chunk can be managed by specific BlocksIndex
//如果Chunk可以由特定BlocksIndex来管理
if(ChunkSize < (BlocksIndex‐>ArraySize ‐ 1) ||
    BlocksIndex‐>ExtendedLookup != 0x0 &&
    ChunkSize == (BlocksIndex‐>ArraySize ‐ 1))
{
    //get the offset into the ListHints
    //获取ListHints的Offset
    int BaseIndex = BlocksIndex‐>BaseIndex;
    int FreeListIndex = RelativeSize(BlocksIndex, ChunkSize ‐ BaseIndex);

    //acquire a freelist
    //获得一个freelist
    ListHint = BlocksIndex‐>ListHints[FreeListIndex];
}

if(ListHint != NULL)
{
    int FreeListBlink = ListHint‐>Blink;

    //if the blink is not populated with a HeapBucket
    //decrement the counter, as we just freed a chunk
    //如果blink没有用HeapBucket填充
    //递减计数器，因为我们释放了一个Chunk
    if( !(BYTE)FreeListBlink & 1)
    {
        if(FreeListBlink >= 2)
            ListHint‐>Blink = FreeListBlink ‐ 2;
    }
}

//unless the heap says otherwise, coalesce the adjacent free blocks
//除非特定情形，堆将合并毗邻的free blocks
int ChunkSize = ChunkHeader‐>Size;

if( !(Heap‐>Flags & 0x80) )
{
    //combine the adjacent blocks
    //合并毗邻blocks
    ChunkHeader = RtlpCoalesceFreeBlocks(Heap, ChunkHeader, &ChunkSize, 0x0);
}

//reassign the ChunkSize if neccessary
//如果有必要，重置ChunkSize
ChunkSize = ChunkHeader‐>Size;

//if the coalesced chunk is bigger than the decommit threshold for this heap, decommit the memory
//如果合并后的Chunk大于该堆的decommit阈值，就decommit该内存
if(ChunkHeader‐>Size > DeCommitThreshold
    || ChunkHeader‐>Size + TotalFreeBlocks > DeCommitThreshold)
{
    RtlpDeCommitFreeBlock(Heap, ChunkHeader, ChunkSize, 0x0);
    return;
}

//VirtualMemoryThreshold=0xFE00
if(ChunkSize > 0xFE00)
{
    RtlpInsertFreeBlock(Heap, ChunkHeader, ChunkSize);
    UpdateTagEntry(ChunkHeader);
    return;
}

//mark the chunk as FREE
//标记该Chunk为FREE
ChunkToFreeHeader‐>Flags = 0x0;
ChunkToFreeHeader‐>UnusedBytes = 0x0;

//FreeList will determine where, if anywhere there is space
//FreeList将确定在哪里有空间
BlocksIndex = Heap‐>BlocksIndex;
_LIST_ENTRY *InsertList = Heap‐>FreeLists;

//attempt to find where to insert this item on the ListHead list for a particular BlocksIndex
//试图在特定BlocksIndex的ListHead链表中找到插入该条目的位置
if(BlocksIndex)
{
    //find a BlocksIndex for storage
    //查找用于存储的BlocksIndex
    int FreeListIndex = BlocksIndexSearch(BlocksIndex, ChunkSize);

    while(BlocksIndex != NULL)
    {
        _HEAP_ENTRY *ListHead = BlocksIndex‐>ListHead;

        //if the ListHead is empty,our insert list will be the sentinel node
        //如果ListHead为空,我们的插入链表的位置就是哨兵节点
        if(ListHead == ListHead‐>Blink)
        {
            InsertList = ListHead;
            break;
        }

        //if the chunk is larger than the largest entry, we'll insert it after
        //如果Chunk大于最大的条目，就插入到最大条目的后面
        if(ChunkSize > ListHead‐>Blink.Size)
        {
            InsertList = ListHead;
            break;
        }

        //pick the insertion point behind the 1st chunk larger than the ChunkToFree
        //找到第一个大于ChunkToFree的Chunk位置，选择其为插入点
        _LIST_ENTRY *NextChunk = ListHead‐>Flink;
        if(NextChunk.Size > ChunkSize)
        {
            InsertList = NextChunk;
            break;
        }

        NextChunk = BlocksIndex‐>ListHints[FreeListIndex];
        while(NextChunk != ListHead)
        {
            //there is actually some decoding done here
            //实际上是一些解码操作
            if(NextChunk.Size > ChunkSize)
            {
                InsertList = NextChunk;
                break;
            }
            NextChunk = NextChunk‐>Flink;
        }

        //if we've found an insertion spot terminate the loop
        //如果找到了插入点，就终止循环
        if(InsertList != Heap‐>FreeLists)
            break;
        BlocksIndex = BlocksIndex‐>ExtendedLookup;
    }
}

while(InsertList != Heap‐>FreeLists)
{
    if(InsertList.Size > ChunkSize)
        break;
    InsertList = InsertList‐>Flink;
}

//R.I.P FreeList Insertion Attack
//R.I.P FreeList插入攻击
if(InsertList‐>Blink‐>Flink == InsertList)
{
    ChunkToFree‐>Flink = InsertList;
    ChunkToFree‐>Blink = InsertList‐>Blink;
    InsertList‐>Blink‐>Flink = ChunkToFree;
    InsertList‐>Blink = ChunkToFree;
}
else
{
    RtlpLogHeapFailure();
}

BlocksIndex = Heap‐>BlocksIndex;
if(BlocksIndex)
{
    FreeListIndex = BlocksIndexSearch(BlocksIndex, ChunkSize);
    int RelSize = ChunkSize ‐ BlocksIndex‐>BaseIndex;
    FreeListIndex = RelativeSize(BlocksIndex, RelSize);
    _LIST_ENTRY *FreeListToUse = BlocksIndex‐>ListHints[FreeListIndex];
    if(ChunkSize >= FreeListToUse.Size)
    {
        BlocksIndex‐>ListHints[FreeListIndex] = ChunkToFree;
    }

    //bitwise OR instead of the XP XOR (R.I.P Bitmap flipping (hi nico))
    //按位或操作取代了XP时代的异或
    if(!FreeListToUse)
    {
        int UlongIndex = Chunkize ‐ BlocksIndex‐>BaseIndex >> 5;
        int Shifter = ChunkSize ‐ BlocksIndex‐>BaseIndex & 1F;
        BlocksIndex‐>ListsInUseUlong[UlongIndex] |= 1 << Shifter;
    }
    EncodeHeader(ChunkHeader);
}

//hi ben hawkes :)
_HEAP_ENTRY *ChunkHeader = ChunkToFree ‐ sizeof(_HEAP_ENTRY); 
if(ChunkHeader‐>UnusedBytes == 0x5)
    ChunkHeader ‐= 8 * (BYTE)ChunkHeader‐>SegmentOffset;

_HEAP_ENTRY *ChunkHeader_Saved = ChunkHeader;

//gets the subsegment based off the LFHKey, Heap and ChunkHeader
//根据LFHKey,Heap,ChunkHeader获得Subsegment
_HEAP_SUBSEGMENT SubSegment = GetSubSegment(Heap, ChunkToFree);
_HEAP_USERDATA_HEADER *UserBlocks = SubSegment‐>UserBlocks;

//Set flags to 0x80 for LFH_FREE (offset 0x7)
//设置ExtendedBlockSignature为0x80,表示此由LFH管理的块的状态为Free
ChunkHeader‐>UnusedBytes = 0x80;

//Set SegmentOffset or LFHFlags (offset 0x6)
//设置SegmentOffset或LFHFlags
ChunkHeader‐>SegmentOffset = 0x0;

while(1)
{
    _INTERLOCK_SEQ AggrExchg;
    AggrExchg.OffsetAndDepth = SubSegment‐>AggregateExchg.OffsetAndDepth;
    AggrExchg.Sequence = SubSegment‐>AggregateExchg.Sequence;

    int Sequence_New = AggrExchg.Sequence + 1;
    if(AggrExchg.OffsetAndDepth >= ‐1)
        Sequence_New‐‐;

    int Depth = SubSegment‐>AggrExchg.Depth;
    _HEAP_LOCAL_SEGMENT_INFO *LocalSegmentInfo = SubSegment‐>LocalInfo;
    unsigned int Sequence = SubSegment‐>LocalInfo‐>LocalData‐>Sequence;
    unsigned int LastOpSequence = LocalSegmentInfo‐>LastOpSequence;

    //setup the new INTERLOCK_SEQ
    //设置新的INTERLOCK_SEQ
    _INTERLOCK_SEQ AggrExchg_New;
    AggrExchg_New.Sequence = Sequence_New;

    if(Depth != SubSegment‐>BlockCount
        || LocalSegmentInfo‐>Counters.SubSegmentCounts == 1)
    {
        if(Sequence >= LastOpSequence && (Sequence ‐ LastOpSequence) < 0x20)
        {
            //set the FreeEntryOffset of ChunkToFree
            //为ChunkToFree设置FreeEntryOffset
            *(WORD)(ChunkHeader + 8) = AggrExchg.FreeEntryOffset;

            //Subtract the size of the block being freed from the current offset; 
            //which will give you the next free chunk
            //从当前Offset扣除释放的block大小；得到下一个free chunk的Offset
            int NewOffset = AggrExchg.FreeEntryOffset ‐ (ChunkHeader ‐ UserBlocks) / 8;
            AggrExchg_New.FreeEntryOffset = NewOffset;

            //increase depth because we're freeing
            //递增Depth，因为我们释放了Chunk
            AggrExchg_New.Depth = Depth + 1;

            //set the Hint in the subsegment
            //在Subsegment中设置Hint
            Sequence = 1;
            SubSegment‐>LocalInfo‐>Hint = SubSegment;
        }
        else
        {
            Sequence = 3;
            AggrExchg_New.Depth = ‐1; //last entry
            AggrExchg_New.FreeEntryOffset = 0; //no offset
        }
    }
    else
    {
        Sequence = 3;
        AggrExchg_New.Depth = ‐1; //last entry
        AggrExchg_New.FreeEntryOffset = 0; //no offset
    }

    //_InterlockedCompareExchange64
    if(AtomicSwap(&SubSegment‐>AggregateExchg, AggrExchg_New, AggrExchg))
        break;

    //if something has changed since swapping, try again
    //交换时如果发生了什么变化，就重试
    ChunkHeader = ChunkHeader_Saved;
}

//if there are cached items handle them
//如果有缓存条目，就处理它们
UpdateCache(SubSegment);

//if we've freed every item in the list update the subsegment and free the UserBlock
//如果我们释放了list中每一个条目，就更新Subsegment并释放UserBlock
if(Sequence == 3)
{
    PerformSubSegmentMaintenance(SubSegment);
    RtlpFreeUserBlock(LFH, SubSegment‐>UserBlocks);
}

return 1;

int BaseAddress = Zero;
int RandPad = Zero;

//get page aligned size to use as a random pad
//获取页对齐大小作为随机数pad
int RandPad = (RtlpHeapGenerateRandomValue64() & 0x1F) << 0x10;

//if maxsize + pad wraps, null out the randpad
//如果maxsize + pad溢出了，就零化randpad
int TotalMaxSize = MaximumSize + RandPad;
if(TotalMaxSize < MaximumSize)
{
    TotalMaxSize = MaximumSize;
    RandPad = Zero;
}

//0x2000 = MEM_RESERVE
//0x40 = PAGE_EXECUTE_READWRITE
//0x04 = PAGE_READWRITE
//this will reserve the memory at the baseaddress but NOT actually commit any memory at this point
//这将保留位于基址的内存，但此时不会实际提交任何内存
int Opts = 0x4;
if(Options & 0x40000)
    Opts = 0x40;

if(NtAllocateVirtualmemory(‐1, &BaseAddress, 0x0, &TotalMaxSize, 0x2000, Opts)
    return 0;

Heap = (_HEAP*)BaseAddress;

//adjust the heap pointer by randpad if possible
//如果可能的话，用randpad来调整堆指针
if(RandPad != Zero)
{
    if(RtlpSecMemFreeVirtualMemory(‐1, &BaseAddress, &RandPad, 0x8000) >= 0 )
    {
        Heap = (_HEAP*)RandPad + BaseAddress;
        MaximumSize = TotalSize ‐ RandPad;
    }
}

EncodeHeader(_HEAP_ENTRY *Header, _HEAP *Heap)
{
    if(Heap‐>EncodeFlagMask)
    {
        Header‐>SmallTagIndex =
            (BYTE)Header ^ (Byte)Header+1 ^ (Byte)Header+2;
        (DWORD)Header ^= Heap‐>Encoding;
    }
}

DecodeHeader(_HEAP_ENTRY *Header, _HEAP *Heap)
{
    if(Heap‐>EncodeFlagMask && (Header & Heap‐>EncodeFlagMask))
    {
        (DWORD)Header ^= Heap‐>Encoding;
    }
}

// if we unlinked from a dedicated free list and emptied it,clear the bitmap
// 如果我们对专门的freelist摘除并清空，就会清除bitmap
if (reqsize < 0x80 && nextchunk == prevchunk)
{
    size = SIZE(chunk);
    BitMask = 1 << (size & 7);

    // note that this is an xor
    // 注意到这是个xor
    FreeListsInUseBitmap[size >> 3] ^= vBitMask;
}

//HeapAlloc
size = SIZE(chunk);
BitMask = 1 << (Size & 0x1F);
BlocksIndex‐>ListInUseUlong[Size >> 5] &= ~BitMask;

//HeapFree
size = SIZE(chunk);
BitMask = 1 << (Size & 0x1F);
BlocksIndex‐>ListInUseUlong[Size >> 5] |= BitMask;

if(InsertList‐>Blink‐>Flink == InsertList)
{
    ChunkToFree‐>Flink = InsertList;
    ChunkToFree‐>Blink = InsertList‐>Blink;
    InsertList‐>Blink‐>Flink = ChunkToFree;
    InsertList‐>Blink = ChunkToFree;
}
else
{
    RtlpLogHeapFailure();
}

//0x10 => Heap‐>CompatibilityFlags |= 0x20000000;
//0x11 => RtlpPerformHeapMaintenance(Heap);
//0x11 => FreeList‐>Blink = LFHContext + 1;
for(i = 0; i < 0x12; i++)
{
    printf("Allocation 0x%02x for 0x%02x bytes\n", i, SIZE);
    allocb[i] = HeapAlloc(pHeap, 0x0, SIZE);
}

//now that the _HEAP_BUCKET is in the ListHint‐>Blink, the LFH will be used
//现在_HEAP_BUCKET在ListHint‐>Blink中，LFH会被使用
printf("Allocation 0x%02x for 0x%02x bytes\n", i++, SIZE);
printf("\tFirst serviced by the LFH\n");
allocb[i] = HeapAlloc(pHeap, 0x0, SIZE);

EnableLFH(SIZE);
NormalizeLFH(SIZE);

alloc1 = HeapAlloc(pHeap, 0x0, SIZE);

alloc2 = HeapAlloc(pHeap, 0x0, SIZE);
memset(alloc2, 0x42, SIZE);
*(alloc2 + SIZE‐1) = '\0';

alloc3 = HeapAlloc(pHeap, 0x0, SIZE);
memset(alloc3, 0x43, SIZE);
*(alloc3 + SIZE‐1) = '\0';

printf("alloc2 => %s\n", alloc2);
printf("alloc3 => %s\n", alloc3);

memset(alloc1, 0x41, SIZE * 3);

printf("Post overflow..\n");
printf("alloc2 => %s\n", alloc2);
printf("alloc3 => %s\n", alloc3);

alloc1 = HeapAlloc(pHeap, 0x0, SIZE);
alloc2 = HeapAlloc(pHeap, 0x0, SIZE);
alloc3 = HeapAlloc(pHeap, 0x0, SIZE);

HeapFree(pHeap, 0x0, alloc2);

//overflow‐able chunk just like alloc1 could reside in same position as alloc2
//像alloc1那样的可溢出块同样可以驻留在与alloc2相同的位置上
alloc4 = HeapAlloc(pHeap, 0x0, SIZE);

memcpy(alloc4, src, user_controlled_size);

EnableLFH(SIZE);
NormalizeLFH(SIZE);

for(i = 0; i < 0x10; i++)
{
    //分配堆块并初始化
    printf("Allocation 0x%02x for 0x%02x bytes => ", i, SIZE);
    allocb[i] = HeapAlloc(pHeap, 0x0, SIZE);
    memset(allocb[i], 0x41 + i, SIZE);
    //打印内容
    for(j=0; j<12; j++)
        printf("%.2X", allocb[i][j]);
    printf("\n");
}

//释放所有堆块
printf("Freeing all chunks!\n");
for(i = 0; i < 0x10; i++)
{
    HeapFree(pHeap, 0x0, allocb[i]);
}

//再次分配
printf("Allocating again\n");
for(i = 0; i < 0x10; i++)
{
    //再次分配，但不初始化
    printf("Allocation 0x%02x for 0x%02x bytes => ", i, SIZE);
    allocb[i] = HeapAlloc(pHeap, 0x0, SIZE);
    //打印内容
    for(j=0; j<12; j++)
        printf("%.2X", allocb[i][j]);
    printf("\n");
}

//LFH is enabled
//LFH已经被启用

//0x30 byte object
var obj = new FakeObj();

//.
//.
//.
//obj goes out of scope & garbage collected
//.
//.
//.

var heap = new heapLib.ie();

//this will allocate the same location in memeory as obj
//这将在内存中分配到与obj相同位置的堆块
heap.alloc("A" * 0x30, "overwrite");

//vtable == 0x41414141
//假的虚表指针
obj.DoStuff();

_HEAP_ENTRY *ChunkHeader = ChunkToFree ‐ sizeof(_HEAP_ENTRY);
if(ChunkHeader‐>UnusedBytes == 0x5)
    ChunkHeader ‐= 8 * (BYTE)ChunkHeader‐>SegmentOffset;

class Paser
{
public:
    Parser();
    virtual void DoThings();
    ~Parser();
private:
    int Items;
    int Values;
    int Stuff;
    int Things;
};

void *buffer, *output;
int action, copy_size = 0x40;
Parser *p;

while(1)
{
    action = ReadInt();
    if(action == 0x1)
        p = new Parser();
    else if(action == 0x2)
        buffer = malloc(sizeof(Parser));
    else if(action == 0xFF)
        break;

    action = ReadInt();
    if(action == 0x3)
        p.DoThings();
    else if(action == 0x4)
        ReadBytes(buffer, copy_size);
    else if(action == 0x5)
        free(buffer);
    else if(action == 0x6)
        delete p;
    else if(action == 0x7)
        ReadBytes(buffer, 0x10);
}

try {
    //the next offset is stored in the 1st 2‐bytes of userdata
    //下一个偏移量存储在userdata的前2个字节中
    short NextOffset = UserBlocks + BlockOffset + sizeof(_HEAP_ENTRY);

    _INTERLOCK_SEQ AggrExchg_New;
    AggrExchg_New.Offset = NextOffset;
}
catch
{
    return 0;
}