Where was the pen selected?

Question

I am wondering if it is possible to use WinDbg to close a column that will result in descriptor distribution.

For example:

#include <windows.h>
#include <conio.h>
#include <iostream>

using namespace std;

int _tmain(int argc, _TCHAR* argv[])
{
    cout << "Press ENTER to leak handles." << endl;

    _getch();

    cout << "Leaking handles" << endl;

    for (int i = 0; i < 100; ++i)
    {
        HANDLE h = CreateEvent(NULL, FALSE, FALSE, NULL);
        if (h != NULL)
        {
            cout << ".";
        }
    }

    cout << "Handles leaked. Press ENTER to exit." << endl;

    _getch();

    return 0;
}

After creating this sample and running it in WinDbg, you can get the call column that selected the descriptors, in the example above the line:

HANDLE h = CreateEvent(NULL, FALSE, FALSE, NULL);

I lead the team !handle, but so far no progress has been made.

This applies to leak analysis. I know that !htrace -enableand !htrace -diff, but this is a different usage scenario (if there any way of combining or other vector to use it, please provide information).

Answer 1

Found what seems like a solution:

• Enable tracing with !htrace -enable
• !htrace <handle>

0:001> !htrace -enable
Handle tracing enabled.
Handle tracing information snapshot successfully taken.
0:001> g
0:001> !handle
...

Handle 7d8
  Type          Event
...
111 Handles
Type            Count
Event           103
File            3
Port            1
Directory       2
WindowStation   1
KeyedEvent      1
0:001> !htrace 7d8
--------------------------------------
Handle = 0x000007d8 - OPEN
Thread ID = 0x00000fc4, Process ID = 0x000017a8

0x0040106d: TestMemHandleLeak!wmain+0x0000006d
0x0040151b: TestMemHandleLeak!__tmainCRTStartup+0x0000010f
0x7c817077: kernel32!BaseProcessStart+0x00000023

--------------------------------------
Parsed 0x64 stack traces.
Dumped 0x1 stack traces.

, :

0:001> ln TestMemHandleLeak!wmain+0x0000006d
f:\temp\windowsapplication3\testmemhandleleak\testmemhandleleak.cpp(22)