This is also a test in posting images in my blog ..
In this scenario you may have noticed a handle leak in an application via perfmon using the Process counters:
Or simply via Task Manager :
Once you know which process is leaking handles you can approach it in a more direct manner. Depending on the code size it may be easy to track down where the bug is, but in my case .. the OS is a pretty big piece of code to try and find the leak without some help. I suppose I could set a break on access for the handle table and log the stacks everytime we increment the count, but that could get ugly.
I think this would be easier...
Download and install Application verifier
Configure it to track handles:
Let the application run for a bit – presumably leaking like a sieve.
Attach the debugger to the process, and make sure you have good symbols. For this example I used the Microsoft public symbols server:
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Handle = 0x000001A6 - CLOSE
Thread ID = 0x000008B4, Process ID = 0x00000564
Handle = 0x000005DC - OPEN
Handle = 0x00000600 - CLOSE
Parsed 0x892 stack traces.
Dumped 0x892 stack traces
If you are doing this from Kernel, you specify the process and you will see the stacks reflect the calls to the Object Manager to open and close the handles.
NOTE: if you cant do a live debug you can get a kernel dump of the machine and it will contain the stacks. A user mode dump will not have the stack data.
Now, unfortunately there is no snap comparison tool like UMDH to compare and log the 'bad stacks' but it wouldnt be too hard to do this when you look at unmatched opens.
I am pretty sure this only works on XP and greater...
July 17 2005- added this:
Looks like its user mode only..
!htrace -enable...!htrace -snapshot... leak code!htrace -diff
Hope it helps someone one day ;o)
Additonal random posts I found interesting this morning:
New Rootkit Revealer available!
Why does the debugger show me the wrong virtual function?
HOWTO: Setup for SmartPhone Development (UPDATED)
Ourmedia.org and Brightcove: 2 sides of the broadband content coin - this one is pretty cool. I may try to host some video here soon.
[ edit -- guess that didnt work so well eh? I'll try to fix it in a bit -- tips from anyone else on how to do this? :: UPDATE - looks like it did work after all]
I have a serious handle leak in "System". Can you assist me from this point?