如何追踪 Windows USER 对象泄漏？
我有一个程序正在泄漏 USER 对象，可以在任务管理器中看到该对象。有没有办法确定正在泄漏的资源类型？我使用过像 GDI View 这样的程序来检查 GDI 泄漏，它可以按对象类型对其进行分解。 USER 对象有类似的东西吗？
I have a program that is leaking USER objects which can be seen in Task Manager. Is there a way to determine which type of resource is being leaked? I've used programs like GDI View for GDI leaks which breaks it down by object type. Is there anything similar to this for USER objects?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以通过挂钩 Create/DestroyWindow 来追踪窗口句柄泄漏，然后追踪传递的句柄。这样，您就可以使用 ETW 轻松生成 WPA 中的跟踪图，其中尚未删除的多余句柄将被排除在外。
请参阅http://geekswithblogs.net/akraus1/archive/2016/01 /30/172079.aspx
使用我的 EasyHook 分支，它也适用于 Win 8 及更高版本上的 x64。
下面是使用 ETWStackwalk.exe 创建的图像，它是我的 EasyHook 分支的一部分。使用 WPA，您可以通过检查 AllocSize 列中的值 > 来查看所有打开和关闭的窗口以及哪些窗口仍然打开。 0。
然后过滤句柄仍然打开的事件，您可以直接获得分配但迄今为止从未释放的调用堆栈。
如果您需要画笔或字体，则需要针对您怀疑造成泄漏的方法扩展该工具。只要您知道哪些方法被怀疑造成了泄漏，并且您能够挂钩资源分配和释放调用，所提出的方法就能够解决任何资源泄漏。
You can track down Window Handle leaks down by hooking Create/DestroyWindow and then trace out the passed handle. That way you can easily generate with ETW tracing a graph in WPA where the excess handles which are not yet deleted stay out.
See http://geekswithblogs.net/akraus1/archive/2016/01/30/172079.aspx
With my fork of EasyHook it works also for x64 on Win 8 and later.
Below is an image which was created with the ETWStackwalk.exe which is part of my EasyHook fork. With WPA you see all opened and closed and which windows are still open by checking the AllocSize column for values > 0.
Then filter for the events which have still the handle open and you get directly the call stacks where it was allocated but never freed so far.
If you are after Brushes or Fonts you need to extend the tool for the methods you suspect responsible for the leak. The presented approach is capable to solve any resource leak as long as you know which methods are suspected to create the leak and you are able to hook the resource allocation and free calls.
有一个名为 windbg 的调试器。它可以做这些事情，但学习曲线是惊人的。
There's a debugger called windbg. It can do these sorts of things but the learning curve is staggering.