How do I track down a Windows USER object leak?

Question

I have a program that is leaking USER objects which can be seen in Task Manager. Is there a way to determine which type of resource is being leaked? I've used programs like GDI View for GDI leaks which breaks it down by object type. Is there anything similar to this for USER objects?

Answer 1

There's a debugger called windbg. It can do these sorts of things but the learning curve is staggering.

Answer 2

You can track down Window Handle leaks down by hooking Create/DestroyWindow and then trace out the passed handle. That way you can easily generate with ETW tracing a graph in WPA where the excess handles which are not yet deleted stay out.

See http://geekswithblogs.net/akraus1/archive/2016/01/30/172079.aspx

With my fork of EasyHook it works also for x64 on Win 8 and later. Below is an image which was created with the ETWStackwalk.exe which is part of my EasyHook fork. With WPA you see all opened and closed and which windows are still open by checking the AllocSize column for values > 0. Then filter for the events which have still the handle open and you get directly the call stacks where it was allocated but never freed so far.

If you are after Brushes or Fonts you need to extend the tool for the methods you suspect responsible for the leak. The presented approach is capable to solve any resource leak as long as you know which methods are suspected to create the leak and you are able to hook the resource allocation and free calls.