windbg小工具umdh查找内存泄露
微软自带的调试工具windbg很强大，除了调试能力外，工具包里面附带的这个umdh工具，可以用于内存泄露的排查。
0, 简介
umdh.exe有2个工作模式，一个是【记录模式】，一个是【统计模式】
1，测试代码:
#include <stdio.h>
#include <stdlib.h>
void f4(){
char * array [100];
for (int i = 0; i < 100; i ++){
array[i] = new char [0x1000];
}
for (int i = 0; i < 100; i ++){
if (i%2){
delete [] array[i];
}
}
}
void f3(){
f4();
}
void f2(){
f3();
}
void f1(){
f2();
}
/*
* invoke chain: main->f1->f2->f3->f4()
*/
int main(int argc, char * argv []){
printf("CrtMemState.0\n");
getchar();
f1();
printf("CrtMemState.1\n");
getchar();
return 0;
}
2，编译测试代码:
最好是带符号表，如果没，可能看到的都是二进制的地址，不清爽.
cl /Od /W0 /Zi cppmemleak.cpp /link /debug
得到
可执行文件cppmemleak.exe 和符号表cppmemleak.pdb
3, 分析
3.1 运行程序记录分配前状态
start cppmemleak.exe
这个时候，cppmemleak打印CrtMemState.0。表示这个时候还没有进行用户的内存操作。
记录一下，
umdh -pn:cppmemleak.exe -f:0.log
3.2 回车一下记录分配后状态
回车一下让cppmemleak进入状态1,打印CrtMemState.1
再记录一下：
umdh -pn:cppmemleak.exe -f:1.log
3.3 开始统计
这个时候，可以关闭cppmemleak程序了。开始【统计模式】
umdh -d 0.log 1.log
得到统计结果:
还有50处内存分配没有被释放，总共使用了204800（-d表示十进制打印）字节。
// Debug library initialized ...
DBGHELP: cppmemleak - private symbols & lines
.\cppmemleak.pdb
DBGHELP: ntdll - public symbols
d:\symbolcache\wntdll.pdb\4A252F11C9FF495DBA896EE81DFBE40B2\wntdll.pdb
DBGHELP: kernel32 - public symbols
d:\symbolcache\wkernel32.pdb\139CA12C1AB645F6A7F2DD1A098696692\wkernel32.pdb
DBGHELP: KERNELBASE - public symbols
d:\symbolcache\wkernelbase.pdb\864B511E61824938A1D55F7DD1CEC4101\wkernelbase.pdb
//
// Each log entry has the following syntax:
//
// + BYTES_DELTA (NEW_BYTES - OLD_BYTES) NEW_COUNT allocs BackTrace TRACEID
// + COUNT_DELTA (NEW_COUNT - OLD_COUNT) BackTrace TRACEID allocations
// ... stack trace ...
//
// where:
//
// BYTES_DELTA - increase in bytes between before and after log
// NEW_BYTES - bytes in after log
// OLD_BYTES - bytes in before log
// COUNT_DELTA - increase in allocations between before and after log
// NEW_COUNT - number of allocations in after log
// OLD_COUNT - number of allocations in before log
// TRACEID - decimal index of the stack trace in the trace database
// (can be used to search for allocation instances in the original
// UMDH logs).
//
+ 204800 ( 204800 - 0) 50 allocs BackTrace1
+ 50 ( 50 - 0) BackTrace1 allocations
ntdll!RtlLogStackBackTrace+00000007
ntdll!RtlAllocateHeap+0000023A
cppmemleak!malloc+00000079 (f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.c, 163)
cppmemleak!operator new+0000001F (f:\dd\vctools\crt_bld\self_x86\crt\src\new.cpp, 59)
cppmemleak!f4+00000037 (h:\cppmemleak.cpp, 7)
cppmemleak!f3+00000008 (h:\cppmemleak.cpp, 18)
cppmemleak!f2+00000008 (h:\cppmemleak.cpp, 22)
cppmemleak!f1+00000008 (h:\cppmemleak.cpp, 26)
cppmemleak!main+0000001A (h:\cppmemleak.cpp, 32)
cppmemleak!__tmainCRTStartup+000000FB (f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c, 266)
kernel32!BaseThreadInitThunk+0000000E
ntdll!__RtlUserThreadStart+00000070
ntdll!_RtlUserThreadStart+0000001B
Total increase == 204800 requested + 800 overhead = 205600
如果有符号表，会自动在{1. 当前路径; 2. _NT_SYMBOL_PATH环境变量}下搜索，加载。
4. 附录：
0.log
//
// UMDH: version 6.1.7015.0: Logtime 2013-09-26 13:58 - Machine=HARRYWU-PC - PID=3904
//
// Debug privilege has been enabled.
// OS version 6.1 Service Pack 1
// Umdh OS version 6.1
//
// Preparing to dump heap allocations.
// Only allocations for which the heap manager collected a stack are dumped. Allocations whithout stack are ignored.
// The stack trace for an allocation is dumped as a list of addresses. They will be resolved to function names at compare time.
//
// Connecting to process 3904 ...
// Process 3904 opened handle=52.
// Loaded modules:
// Base Size Module
// 400000 31000 H:\cppmemleak.exe
// 77400000 180000 C:\Windows\SysWOW64\ntdll.dll
// 76850000 110000 C:\Windows\syswow64\kernel32.dll
// 76960000 47000 C:\Windows\syswow64\KERNELBASE.dll
//
// Process modules enumerated.
// Debug library initialized ...
DBGHELP: ntdll - public symbols
d:\symbolcache\wntdll.pdb\4A252F11C9FF495DBA896EE81DFBE40B2\wntdll.pdb
*- - - - - - - - - - Start of data for heap @ 290000 - - - - - - - - - -
REQUESTED bytes + OVERHEAD at ADDRESS by BackTraceID
STACK if not already dumped.
*- - - - - - - - - - Heap 290000 Hogs - - - - - - - - - -
18 bytes + 8 at 2907D0 by BackTrace0
1E14 bytes + C at 2907F0 by BackTrace0
2C50 bytes + 8 at 292610 by BackTrace0
3C bytes + C at 295268 by BackTrace0
30 bytes + 8 at 2952B0 by BackTrace0
78 bytes + 8 at 2952E8 by BackTrace0
78 bytes + 8 at 295368 by BackTrace0
3C bytes + C at 2953E8 by BackTrace0
220 bytes + 8 at 295430 by BackTrace0
42 bytes + E at 295658 by BackTrace0
78 bytes + 8 at 2956A8 by BackTrace0
10 bytes + 8 at 295728 by BackTrace0
46 bytes + A at 295740 by BackTrace0
78 bytes + 8 at 295790 by BackTrace0
10 bytes + 8 at 295810 by BackTrace0
10 bytes + 8 at 295828 by BackTrace0
10 bytes + 8 at 295840 by BackTrace0
64 bytes + C at 295858 by BackTrace0
200 bytes + 8 at 2958C8 by BackTrace0
200 bytes + 8 at 295AD0 by BackTrace0
24 bytes + C at 295CD8 by BackTrace0
30 bytes + 8 at 295D08 by BackTrace0
20 bytes + 8 at 295D40 by BackTrace0
20 bytes + 8 at 295D68 by BackTrace0
30 bytes + 8 at 295D90 by BackTrace0
20 bytes + 8 at 295DC8 by BackTrace0
20 bytes + 8 at 295DF0 by BackTrace0
10 bytes + 8 at 295E18 by BackTrace0
20 bytes + 8 at 295E30 by BackTrace0
20 bytes + 8 at 295E58 by BackTrace0
20 bytes + 8 at 295E80 by BackTrace0
20 bytes + 8 at 295EA8 by BackTrace0
20 bytes + 8 at 295ED0 by BackTrace0
20 bytes + 8 at 295EF8 by BackTrace0
20 bytes + 8 at 295F20 by BackTrace0
20 bytes + 8 at 295F48 by BackTrace0
20 bytes + 8 at 295F70 by BackTrace0
20 bytes + 8 at 295F98 by BackTrace0
20 bytes + 8 at 295FC0 by BackTrace0
20 bytes + 8 at 295FE8 by BackTrace0
20 bytes + 8 at 296010 by BackTrace0
20 bytes + 8 at 2B7548 by BackTrace0
20 bytes + 8 at 2B7570 by BackTrace0
20 bytes + 8 at 2B75B0 by BackTrace0
20 bytes + 8 at 2B75D8 by BackTrace0
20 bytes + 8 at 2B7600 by BackTrace0
20 bytes + 8 at 2B7628 by BackTrace0
208 bytes + 8 at 2B8198 by BackTrace0
400 bytes + 8 at 2B83A8 by BackTrace0
44 bytes + C at 2B87B0 by BackTrace0
1 bytes + F at 2B8800 by BackTrace0
10 bytes + 8 at 2B8810 by BackTrace0
12 bytes + E at 2B8828 by BackTrace0
440 bytes + 8 at 2B8848 by BackTrace0
*- - - - - - - - - - End of data for heap @ 290000 - - - - - - - - - -
*- - - - - - - - - - Start of data for heap @ 5E0000 - - - - - - - - - -
REQUESTED bytes + OVERHEAD at ADDRESS by BackTraceID
STACK if not already dumped.
*- - - - - - - - - - Heap 5E0000 Hogs - - - - - - - - - -
214 bytes + C at 5E07D0 by BackTrace0
800 bytes + 8 at 5E09F0 by BackTrace0
220 bytes + 8 at 5E2110 by BackTrace0
17 bytes + 9 at 5E2338 by BackTrace0
E4 bytes + C at 5E2358 by BackTrace0
31 bytes + F at 5E2448 by BackTrace0
1F bytes + 9 at 5E2488 by BackTrace0
2F bytes + 9 at 5E24B0 by BackTrace0
37 bytes + 9 at 5E24E8 by BackTrace0
3C bytes + C at 5E2528 by BackTrace0
31 bytes + F at 5E2570 by BackTrace0
18 bytes + 8 at 5E25B0 by BackTrace0
24 bytes + C at 5E25D0 by BackTrace0
49 bytes + F at 5E2600 by BackTrace0
14 bytes + C at 5E2658 by BackTrace0
18 bytes + 8 at 5E2678 by BackTrace0
30 bytes + 8 at 5E2698 by BackTrace0
1C bytes + C at 5E26D0 by BackTrace0
1C bytes + C at 5E26F8 by BackTrace0
D bytes + B at 5E2720 by BackTrace0
1E bytes + A at 5E2738 by BackTrace0
C2 bytes + E at 5E2760 by BackTrace0
33 bytes + D at 5E2830 by BackTrace0
B2 bytes + E at 5E2870 by BackTrace0
DA bytes + E at 5E2930 by BackTrace0
32 bytes + E at 5E2A18 by BackTrace0
19 bytes + F at 5E2A58 by BackTrace0
17 bytes + 9 at 5E2A80 by BackTrace0
E bytes + A at 5E2AA0 by BackTrace0
47E bytes + A at 5E2AB8 by BackTrace0
3E bytes + A at 5E2F40 by BackTrace0
1B bytes + D at 5E2F88 by BackTrace0
1D bytes + B at 5E2FB0 by BackTrace0
48 bytes + 8 at 5E2FD8 by BackTrace0
12 bytes + E at 5E3028 by BackTrace0
18 bytes + 8 at 5E3048 by BackTrace0
1B bytes + D at 5E3068 by BackTrace0
24 bytes + C at 5E3090 by BackTrace0
29 bytes + F at 5E30C0 by BackTrace0
1E bytes + A at 5E30F8 by BackTrace0
C bytes + C at 5E3120 by BackTrace0
41 bytes + F at 5E3138 by BackTrace0
17 bytes + 9 at 5E3188 by BackTrace0
2D bytes + B at 5E31A8 by BackTrace0
14 bytes + C at 5E31E0 by BackTrace0
F bytes + 9 at 5E3200 by BackTrace0
16 bytes + A at 5E3218 by BackTrace0
2A bytes + E at 5E3238 by BackTrace0
36 bytes + A at 5E3270 by BackTrace0
29 bytes + F at 5E32B0 by BackTrace0
16 bytes + A at 5E32E8 by BackTrace0
17 bytes + 9 at 5E3308 by BackTrace0
23 bytes + D at 5E3328 by BackTrace0
43 bytes + D at 5E3358 by BackTrace0
50 bytes + 8 at 5E33A8 by BackTrace0
40 bytes + 8 at 5E3400 by BackTrace0
12 bytes + E at 5E3448 by BackTrace0
3D bytes + B at 5E3468 by BackTrace0
18 bytes + 8 at 5E34B0 by BackTrace0
46 bytes + A at 5E34D0 by BackTrace0
5C bytes + C at 5E3520 by BackTrace0
80 bytes + 8 at 5E3588 by BackTrace0
800 bytes + 8 at 5E3610 by BackTrace0
1000 bytes + 8 at 5E3E18 by BackTrace0
*- - - - - - - - - - End of data for heap @ 5E0000 - - - - - - - - - -
Warning:
Warning: UMDH didn't find any allocations that have stacks collected.
Warning: UMDH has enabled allocation stack collection for the current running process.
Warning: To persist the setting for the application run GFLAGS.
Warning: A 32bit GFLAGS must be used. The command is:
Warning: gflags -i cppmemleak.exe +ust
Warning:
1.log
//
// UMDH: version 6.1.7015.0: Logtime 2013-09-26 13:58 - Machine=HARRYWU-PC - PID=3904
//
// Debug privilege has been enabled.
// OS version 6.1 Service Pack 1
// Umdh OS version 6.1
//
// Preparing to dump heap allocations.
// Only allocations for which the heap manager collected a stack are dumped. Allocations whithout stack are ignored.
// The stack trace for an allocation is dumped as a list of addresses. They will be resolved to function names at compare time.
//
// Connecting to process 3904 ...
// Process 3904 opened handle=52.
// Loaded modules:
// Base Size Module
// 400000 31000 H:\cppmemleak.exe
// 77400000 180000 C:\Windows\SysWOW64\ntdll.dll
// 76850000 110000 C:\Windows\syswow64\kernel32.dll
// 76960000 47000 C:\Windows\syswow64\KERNELBASE.dll
//
// Process modules enumerated.
// Debug library initialized ...
DBGHELP: ntdll - public symbols
d:\symbolcache\wntdll.pdb\4A252F11C9FF495DBA896EE81DFBE40B2\wntdll.pdb
*- - - - - - - - - - Start of data for heap @ 290000 - - - - - - - - - -
REQUESTED bytes + OVERHEAD at ADDRESS by BackTraceID
STACK if not already dumped.
*- - - - - - - - - - Heap 290000 Hogs - - - - - - - - - -
18 bytes + 8 at 2907D0 by BackTrace0
1E14 bytes + C at 2907F0 by BackTrace0
2C50 bytes + 8 at 292610 by BackTrace0
3C bytes + C at 295268 by BackTrace0
30 bytes + 8 at 2952B0 by BackTrace0
78 bytes + 8 at 2952E8 by BackTrace0
78 bytes + 8 at 295368 by BackTrace0
3C bytes + C at 2953E8 by BackTrace0
220 bytes + 8 at 295430 by BackTrace0
42 bytes + E at 295658 by BackTrace0
78 bytes + 8 at 2956A8 by BackTrace0
10 bytes + 8 at 295728 by BackTrace0
46 bytes + A at 295740 by BackTrace0
78 bytes + 8 at 295790 by BackTrace0
10 bytes + 8 at 295810 by BackTrace0
10 bytes + 8 at 295828 by BackTrace0
10 bytes + 8 at 295840 by BackTrace0
64 bytes + C at 295858 by BackTrace0
200 bytes + 8 at 2958C8 by BackTrace0
200 bytes + 8 at 295AD0 by BackTrace0
24 bytes + C at 295CD8 by BackTrace0
30 bytes + 8 at 295D08 by BackTrace0
20 bytes + 8 at 295D40 by BackTrace0
20 bytes + 8 at 295D68 by BackTrace0
30 bytes + 8 at 295D90 by BackTrace0
20 bytes + 8 at 295DC8 by BackTrace0
20 bytes + 8 at 295DF0 by BackTrace0
10 bytes + 8 at 295E18 by BackTrace0
20 bytes + 8 at 295E30 by BackTrace0
20 bytes + 8 at 295E58 by BackTrace0
20 bytes + 8 at 295E80 by BackTrace0
20 bytes + 8 at 295EA8 by BackTrace0
20 bytes + 8 at 295ED0 by BackTrace0
20 bytes + 8 at 295EF8 by BackTrace0
20 bytes + 8 at 295F20 by BackTrace0
20 bytes + 8 at 295F48 by BackTrace0
20 bytes + 8 at 295F70 by BackTrace0
20 bytes + 8 at 295F98 by BackTrace0
20 bytes + 8 at 295FC0 by BackTrace0
20 bytes + 8 at 295FE8 by BackTrace0
20 bytes + 8 at 296010 by BackTrace0
20 bytes + 8 at 2B7548 by BackTrace0
20 bytes + 8 at 2B7570 by BackTrace0
20 bytes + 8 at 2B75B0 by BackTrace0
20 bytes + 8 at 2B75D8 by BackTrace0
20 bytes + 8 at 2B7600 by BackTrace0
20 bytes + 8 at 2B7628 by BackTrace0
208 bytes + 8 at 2B8198 by BackTrace0
400 bytes + 8 at 2B83A8 by BackTrace0
44 bytes + C at 2B87B0 by BackTrace0
1 bytes + F at 2B8800 by BackTrace0
10 bytes + 8 at 2B8810 by BackTrace0
12 bytes + E at 2B8828 by BackTrace0
440 bytes + 8 at 2B8848 by BackTrace0
*- - - - - - - - - - End of data for heap @ 290000 - - - - - - - - - -
*- - - - - - - - - - Start of data for heap @ 5E0000 - - - - - - - - - -
REQUESTED bytes + OVERHEAD at ADDRESS by BackTraceID
STACK if not already dumped.
*- - - - - - - - - - Heap 5E0000 Hogs - - - - - - - - - -
214 bytes + C at 5E07D0 by BackTrace0
800 bytes + 8 at 5E09F0 by BackTrace0
220 bytes + 8 at 5E2110 by BackTrace0
17 bytes + 9 at 5E2338 by BackTrace0
E4 bytes + C at 5E2358 by BackTrace0
31 bytes + F at 5E2448 by BackTrace0
1F bytes + 9 at 5E2488 by BackTrace0
2F bytes + 9 at 5E24B0 by BackTrace0
37 bytes + 9 at 5E24E8 by BackTrace0
3C bytes + C at 5E2528 by BackTrace0
31 bytes + F at 5E2570 by BackTrace0
18 bytes + 8 at 5E25B0 by BackTrace0
24 bytes + C at 5E25D0 by BackTrace0
49 bytes + F at 5E2600 by BackTrace0
14 bytes + C at 5E2658 by BackTrace0
18 bytes + 8 at 5E2678 by BackTrace0
30 bytes + 8 at 5E2698 by BackTrace0
1C bytes + C at 5E26D0 by BackTrace0
1C bytes + C at 5E26F8 by BackTrace0
D bytes + B at 5E2720 by BackTrace0
1E bytes + A at 5E2738 by BackTrace0
C2 bytes + E at 5E2760 by BackTrace0
33 bytes + D at 5E2830 by BackTrace0
B2 bytes + E at 5E2870 by BackTrace0
DA bytes + E at 5E2930 by BackTrace0
32 bytes + E at 5E2A18 by BackTrace0
19 bytes + F at 5E2A58 by BackTrace0
17 bytes + 9 at 5E2A80 by BackTrace0
E bytes + A at 5E2AA0 by BackTrace0
47E bytes + A at 5E2AB8 by BackTrace0
3E bytes + A at 5E2F40 by BackTrace0
1B bytes + D at 5E2F88 by BackTrace0
1D bytes + B at 5E2FB0 by BackTrace0
48 bytes + 8 at 5E2FD8 by BackTrace0
12 bytes + E at 5E3028 by BackTrace0
18 bytes + 8 at 5E3048 by BackTrace0
1B bytes + D at 5E3068 by BackTrace0
24 bytes + C at 5E3090 by BackTrace0
29 bytes + F at 5E30C0 by BackTrace0
1E bytes + A at 5E30F8 by BackTrace0
C bytes + C at 5E3120 by BackTrace0
41 bytes + F at 5E3138 by BackTrace0
17 bytes + 9 at 5E3188 by BackTrace0
2D bytes + B at 5E31A8 by BackTrace0
14 bytes + C at 5E31E0 by BackTrace0
F bytes + 9 at 5E3200 by BackTrace0
16 bytes + A at 5E3218 by BackTrace0
2A bytes + E at 5E3238 by BackTrace0
36 bytes + A at 5E3270 by BackTrace0
29 bytes + F at 5E32B0 by BackTrace0
16 bytes + A at 5E32E8 by BackTrace0
17 bytes + 9 at 5E3308 by BackTrace0
23 bytes + D at 5E3328 by BackTrace0
43 bytes + D at 5E3358 by BackTrace0
50 bytes + 8 at 5E33A8 by BackTrace0
40 bytes + 8 at 5E3400 by BackTrace0
12 bytes + E at 5E3448 by BackTrace0
3D bytes + B at 5E3468 by BackTrace0
18 bytes + 8 at 5E34B0 by BackTrace0
46 bytes + A at 5E34D0 by BackTrace0
5C bytes + C at 5E3520 by BackTrace0
80 bytes + 8 at 5E3588 by BackTrace0
800 bytes + 8 at 5E3610 by BackTrace0
1000 bytes + 8 at 5E3E18 by BackTrace0
1000 bytes + 10 at 5E4E20 by BackTrace1
774C9955
77433CFE
401C77
40123C
401077
401108
401118
401128
40114A
401569
7686336A
77439F72
77439F45
1000 bytes + 10 at 5E6E40 by BackTrace1
1000 bytes + 10 at 5E8E60 by BackTrace1
1000 bytes + 10 at 5EAE80 by BackTrace1
1000 bytes + 10 at 5ECEA0 by BackTrace1
1000 bytes + 10 at 5EEEC0 by BackTrace1
1000 bytes + 10 at 441058 by BackTrace1
1000 bytes + 10 at 443078 by BackTrace1
1000 bytes + 10 at 445098 by BackTrace1
1000 bytes + 10 at 4470B8 by BackTrace1
1000 bytes + 10 at 4490D8 by BackTrace1
1000 bytes + 10 at 44B0F8 by BackTrace1
1000 bytes + 10 at 44D118 by BackTrace1
1000 bytes + 10 at 44F138 by BackTrace1
1000 bytes + 10 at 451158 by BackTrace1
1000 bytes + 10 at 453178 by BackTrace1
1000 bytes + 10 at 455198 by BackTrace1
1000 bytes + 10 at 4571B8 by BackTrace1
1000 bytes + 10 at 4591D8 by BackTrace1
1000 bytes + 10 at 45B1F8 by BackTrace1
1000 bytes + 10 at 45D218 by BackTrace1
1000 bytes + 10 at 45F238 by BackTrace1
1000 bytes + 10 at 461258 by BackTrace1
1000 bytes + 10 at 463278 by BackTrace1
1000 bytes + 10 at 465298 by BackTrace1
1000 bytes + 10 at 4672B8 by BackTrace1
1000 bytes + 10 at 4692D8 by BackTrace1
1000 bytes + 10 at 46B2F8 by BackTrace1
1000 bytes + 10 at 46D318 by BackTrace1
1000 bytes + 10 at 46F338 by BackTrace1
1000 bytes + 10 at 471358 by BackTrace1
1000 bytes + 10 at 473378 by BackTrace1
1000 bytes + 10 at 475398 by BackTrace1
1000 bytes + 10 at 4773B8 by BackTrace1
1000 bytes + 10 at 4793D8 by BackTrace1
1000 bytes + 10 at 47B3F8 by BackTrace1
1000 bytes + 10 at 47D418 by BackTrace1
1000 bytes + 10 at 47F438 by BackTrace1
1000 bytes + 10 at 481458 by BackTrace1
1000 bytes + 10 at 483478 by BackTrace1
1000 bytes + 10 at 485498 by BackTrace1
1000 bytes + 10 at 4874B8 by BackTrace1
1000 bytes + 10 at 4894D8 by BackTrace1
1000 bytes + 10 at 48B4F8 by BackTrace1
1000 bytes + 10 at 48D518 by BackTrace1
1000 bytes + 10 at 48F538 by BackTrace1
1000 bytes + 10 at 491558 by BackTrace1
1000 bytes + 10 at 493578 by BackTrace1
1000 bytes + 10 at 495598 by BackTrace1
1000 bytes + 10 at 4975B8 by BackTrace1
*- - - - - - - - - - End of data for heap @ 5E0000 - - - - - - - - - -