How to track a leak of a Windows USER object?

Question

I have a program that skips USER objects that can be seen in the task manager. Is there a way to determine what type of resource is leaking? I used programs like GDI View for GDI leaks that break it down by type of object. Is there something similar for USER objects?

Answer 1

There is a windbg debugger there . He can do such things, but the learning curve fluctuates.

Answer 2

You can track the leak of a window handle by running Create / DestroyWindow, and then draw a handle to it. That way, you can easily generate graph tracing with ETW in WPA, where redundant descriptors that are not yet deleted are left out.

See http://geekswithblogs.net/akraus1/archive/2016/01/30/172079.aspx

With my EasyHook fork, it works for x64 on Win 8 and later. The following is an image created using ETWStackwalk.exe, which is part of my EasyHook fork. With WPA, you see all open and closed and which windows are still open, checking the AllocSize column for values> 0. Then filter the events that are still open and you get directly the call stacks where they were allocated but still not freed .

If you use brushes or fonts, you need to expand the tool for methods that you suspect are responsible for the leak. The presented approach is capable of resolving any leakage of resources if you know what methods are supposed to create a leak, and you can connect resource allocation and free calls.