Windows调试——使用windbg查找内存泄露

内存泄露查找方法

C++程序员经常不注意内存使用的关闭，虽然此类问题不会导致程序逻辑问题，但随着时间的推移，内存占用量越来越多，最终导致程序崩掉。对服务端的程序，内存泄漏经常是致命的。

对于已经存在内存泄露的程序，可能Windbg查找内存泄露的代码。下面介绍如果通过Windbg查找内存泄露。

Windbg 加载程序依赖库所用pdb文件。

挂载进程或者加载已生成的pdb文件

输入命令查看内存。

3.1 !heap –s 查看程序内存状况

0:000> !heap -s

NtGlobalFlag enables following debugging aids for new heaps:

stack back traces

LFH Key : 0x73ccd2bf

Termination on corruption : DISABLED

Heap Flags Reserv Commit Virt Free List UCR Virt Lock Fast

(k) (k) (k) (k) length blocks cont. heap

004e0000 08000002 4096 3968 4096 45 86 3 0 0 LFH

006f0000 08001002 1088 804 1088 40 3 2 0 0 LFH

002d0000 08001002 1280 292 1280 9 16 2 0 0 LFH

Virtual block: 05f10000 - 05f10000 (size 00000000)

Virtual block: 45fd0000 - 45fd0000 (size 00000000)

Virtual block: 466d0000 - 466d0000 (size 00000000)

Virtual block: 47310000 - 47310000 (size 00000000)

00b70000 08001002 250748 250044 250748 3122 925 58 4 9 LFH

00480000 08001002 256 148 256 6 1 1 0 0 LFH

04f80000 08001002 256 4 256 2 1 1 0 0

00bb0000 08011002 256 80 256 74 3 1 0 0

04ed0000 08001002 64 16 64 13 1 1 0 0

059e0000 08001002 64 4 64 2 1 1 0 0

05bd0000 08001002 64 4 64 2 1 1 0 0

05dc0000 08001002 256 4 256 1 2 1 0 0

04e40000 08001002 1280 300 1280 49 12 2 0 0 LFH

Virtual block: 6b310000 - 6b310000 (size 00000000)

Virtual block: 6b520000 - 6b520000 (size 00000000)

180f0000 08001002 1088 676 1088 267 5 2 2 23

18740000 08001002 7232 6236 7232 3956 49 13 0 26 LFH

External fragmentation 63 % (49 free blocks)

18b60000 08001002 1088 220 1088 24 8 2 0 0 LFH

04e30000 08001002 1088 148 1088 2 4 2 0 0 LFH

过一段时间再次通过!heap –s 查看程序内存状况。找出增长较快的内存块，如00b70000。

3.2 !heap -stat –h 查看00b70000内存详细情况

0:000> !heap -stat -h 00b70000

heap @ 00b70000

group-by: TOTSIZE max-display: 20

size #blocks total ( %) (percent of total busy bytes)

ea60 f88 - e382300 (57.83)

9c61334 1 - 9c61334 (39.75)

1b7730 1 - 1b7730 (0.44)

147254 1 - 147254 (0.32)

124f74 1 - 124f74 (0.29)

c de5e - a6c68 (0.17)

2000 41 - 82000 (0.13)

214 3d1 - 7ee54 (0.13)

28 2a67 - 6a018 (0.11)

42b0 14 - 535c0 (0.08)

1c 2914 - 47e30 (0.07)

2b70 14 - 364c0 (0.05)

14 29b4 - 34210 (0.05)

32000 1 - 32000 (0.05)

18 1ac1 - 28218 (0.04)

4 7df4 - 1f7d0 (0.03)

1d4c4 1 - 1d4c4 (0.03)

1740 14 - 1d100 (0.03)

2408 c - 1b060 (0.03)

208 cc - 19e60 (0.03)

3.3 !heap -flt s 查进程中size=ea60的所有内存

0:000> !heap -flt s ea60

_HEAP @ 4e0000

_HEAP @ 6f0000

_HEAP @ 2d0000

_HEAP @ b70000

HEAP_ENTRY Size Prev Flags UserPtr UserSize - state

5272cc18 1d4f 0000 [00] 5272cc30 0ea60 - (busy)

537bc578 1d4f 1d4f [00] 537bc590 0ea60 - (busy)

537cbf98 1d4f 1d4f [00] 537cbfb0 0ea60 - (busy)

53862f20 1d4f 1d4f [00] 53862f38 0ea60 - (busy)

53871998 1d4f 1d4f [00] 538719b0 0ea60 - (busy)

53890608 1d4f 1d4f [00] 53890620 0ea60 - (busy)

538ace68 1d4f 1d4f [00] 538ace80 0ea60 - (busy)

538bb8e0 1d4f 1d4f [00] 538bb8f8 0ea60 - (busy)

538dcec8 1d4f 1d4f [00] 538dcee0 0ea60 - (busy)

53901af8 1d4f 1d4f [00] 53901b10 0ea60 - (busy)

53910570 1d4f 1d4f [00] 53910588 0ea60 - (busy)

5391efe8 1d4f 1d4f [00] 5391f000 0ea60 - (busy)

539b71a0 1d4f 1d4f [00] 539b71b8 0ea60 - (busy)

539c5c18 1d4f 1d4f [00] 539c5c30 0ea60 - (busy)

539d4690 1d4f 1d4f [00] 539d46a8 0ea60 - (busy)

539e3108 1d4f 1d4f [00] 539e3120 0ea60 - (busy)

539f1b80 1d4f 1d4f [00] 539f1b98 0ea60 - (busy)

53a005f8 1d4f 1d4f [00] 53a00610 0ea60 - (busy)

53a0f070 1d4f 1d4f [00] 53a0f088 0ea60 - (busy)

53a20f98 1d4f 1d4f [00] 53a20fb0 0ea60 - (busy)

53a2fa10 1d4f 1d4f [00] 53a2fa28 0ea60 - (busy)

53a4e6b8 1d4f 1d4f [00] 53a4e6d0 0ea60 - (busy)

53a66fa0 1d4f 1d4f [00] 53a66fb8 0ea60 - (busy)

53a75a18 1d4f 1d4f [00] 53a75a30 0ea60 - (busy)

71614e20 1d4f 1d4f [00] 71614e38 0ea60 - (busy)

71623898 1d4f 1d4f [00] 716238b0 0ea60 - (busy)

71632310 1d4f 1d4f [00] 71632328 0ea60 - (busy)

……………………………..

3.4 !heap -p –a 查看内存堆栈，定位泄露根源。

0:000> !heap -p -a 71614e38

address 71614e38 found in

_HEAP @ b70000

HEAP_ENTRY Size Prev Flags UserPtr UserSize - state

71614e20 1d4f 0000 [00] 71614e38 0ea60 - (busy)

Trace: 5be4158

76f5dfa2 ntdll!RtlAllocateHeap+0x00000274

72873db8 MSVCR90!malloc+0x00000079

70e7b9dd BInterface!osip_malloc+0x0000000d

70e83f93 BInterface!sdp_message_to_str+0x00000073

70e3751f BInterface!CSdpParse::sdp_to_str+0x0000001f

70e14b06 BInterface!CUserAgent::DoStartStream+0x00000316

70e26e3b BInterface!BI_StartRealStream+0x000000fb

0:000> !heap -p -a 721acf68

address 721acf68 found in

_HEAP @ b70000

HEAP_ENTRY Size Prev Flags UserPtr UserSize - state

721acf50 1d4f 0000 [00] 721acf68 0ea60 - (busy)

Trace: 5be4158

76f5dfa2 ntdll!RtlAllocateHeap+0x00000274

72873db8 MSVCR90!malloc+0x00000079

70e7b9dd BInterface!osip_malloc+0x0000000d

70e83f93 BInterface!sdp_message_to_str+0x00000073

70e3751f BInterface!CSdpParse::sdp_to_str+0x0000001f

70e14b06 BInterface!CUserAgent::DoStartStream+0x00000316

70e26e3b BInterface!BI_StartRealStream+0x000000fb

通过以上分析可以定位到BInterface相关接口导致内存泄露。