用Windbg检查句柄泄露步骤

1. 启动句柄操作的栈回溯

0:000> !htrace -enable
Handle tracing enabled.
Handle tracing information snapshot successfully taken.
0:000> g

 

2. 抓取快照

0:001> !htrace -snapshot
Handle tracing information snapshot successfully taken.
0:001> g

 

3. 运行程序，产生句柄泄露，分析

0:001> !htrace -diff
Handle tracing information snapshot successfully taken.
0x2 new stack traces since the previous snapshot.
Ignoring handles that were already closed...
Outstanding handles opened since the previous snapshot:
--------------------------------------
Handle = 0x00000358 - OPEN
Thread ID = 0x00000c8c, Process ID = 0x000013ec

0x773443e0: ntdll!ZwCreateFile+0x0000000c
0x75d1b088: kernel32!CreateFileW+0x00000379
0x013a146a: TestHandleLeak!CTestHandleLeakDlg::OnBnClickedButton1+0x0000001a
0x562ed3e9: mfc90u+0x0008d3e9
0x562dde60: mfc90u+0x0007de60
0x562bff73: mfc90u+0x0005ff73
0x562bf75b: mfc90u+0x0005f75b
0x562bf6ce: mfc90u+0x0005f6ce
0x562be2f4: mfc90u+0x0005e2f4
0x562be580: mfc90u+0x0005e580
0x562bc247: mfc90u+0x0005c247
0x75e9fd72: USER32!InternalCallWinProc+0x00000023
--------------------------------------
Handle = 0x00000354 - OPEN
Thread ID = 0x00000c8c, Process ID = 0x000013ec

0x773443e0: ntdll!ZwCreateFile+0x0000000c
0x75d1b088: kernel32!CreateFileW+0x00000379
0x013a146a: TestHandleLeak!CTestHandleLeakDlg::OnBnClickedButton1+0x0000001a
0x562ed3e9: mfc90u+0x0008d3e9
0x562dde60: mfc90u+0x0007de60
0x562bff73: mfc90u+0x0005ff73
0x562bf75b: mfc90u+0x0005f75b
0x562bf6ce: mfc90u+0x0005f6ce
0x562be2f4: mfc90u+0x0005e2f4
0x562be580: mfc90u+0x0005e580
0x562bc247: mfc90u+0x0005c247
0x75e9fd72: USER32!InternalCallWinProc+0x00000023
--------------------------------------
Displayed 0x2 stack traces for outstanding handles opened since the previous snapshot.

 

4. 通过上面的栈回溯信息，很清楚可以看到句柄打开的地方。