Is there a way to get userstack for all heap userptr - c++

Question

I was reading through this article detecting memory leak using windbg. I am trying to find a way to print userstack for all userptrs that appear when heap is filtered for a block of memory for a particular size. Is this possible ?
I am looking to achieve something like:
foreach(userPtr)
dump_to_a_file !heap -p -a userPtr
where userPtr is: UserPtr as under
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
003360e0 03f0 0000 [07] 003360e8 01f64 - (busy)
00338060 03f0 03f0 [07] 00338068 01f64 - (busy)
00339fe0 03f0 03f0 [07] 00339fe8 01f64 - (busy)
I am trying to do this in order to avoid a manual checking for thousands of such UserPtr. Thanks for any help that you could give.

Answer 1

This is the output of the !heap -flt s xxx command which contains a lot of text before and after the heap entry table. Let's get rid of that additional text by doing the hack
.shell -ci "!heap -flt s xxx" find "["
Now it's quite stable output, which can be used in a foreach loop:
.foreach (userptr {.shell -ci "!heap -flt s xxx" find "["}) { .echo ${userptr}}
See how it splits each line. Let's get rid of the first 4 tokens (entry, size, prev, flags) and last 3 tokens (usersize, -, state) using /pS 4 /ps 7.
.foreach /pS 4 /ps 7 (userptr {.shell -ci "!heap -flt s xxx" find "["}) { .echo ${userptr}}
Now that you have the pure addresses, do something useful with it, which is !heap -p -a
.foreach /pS 4 /ps 7 (userptr {.shell -ci "!heap -flt s xxx" find "["}) { !heap -p -a ${userptr}}
To dump it into a file, surround it by a log (.logopen and .logclose):
.logopen d:\debug\logs\heap.log; .foreach /pS 4 /ps 7 (userptr {.shell -ci "!heap -flt s xxx" find "["}) { !heap -p -a ${userptr}}; .logclose
There you go.

Answer 2

You can use umdh.exe for this. Umdh can dump all allocations, or a delta between two snapshots of the same process, which is the most convenient way to locate memory leaks. You can find the tool in the location where you install Windows debugger tools.
The catch when using umdh.exe that you need to know, is that is only resolves symbols when performing delta operation, i.e. comparing two snapshots of the process. If you really-really need every callstack, just make a fist snapshot at the very beginning of process execution.
Umdh.exe also aggregates allocations with the same callstack into buckets, so in diff output you will see something like this:
+ 18f0 ( 2354 - a64) 11 allocs BackTrace113457DC
+ c ( 11 - 5) BackTrace113457DC allocations
ntdll!RtlAllocateHeap+38CB9
msvcrt!_calloc_impl+134
msvcrt!_calloc_crt+16
msvcrt!_CRTDLL_INIT+FC
ntdll!LdrxCallInitRoutine+16
ntdll!LdrpCallInitRoutine+43
ntdll!LdrpInitializeThread+106
ntdll!_LdrpInitialize+6A
ntdll!LdrInitializeThunk+10
which is an example of call stack for 11 allocations, with number of allocations for this call stack increasing from 5 to 11 between snapshots, and memory consumed by these allocations from 0xa64 to 0x2354 bytes.
Sample steps to show how to use umdh.exe:
Set up _NT_SYMBOL_PATH environment variable, required for umdh. Assuming you are in directory where you have your private symbols (%CD%)
set _NT_SYMBOL_PATH=%CD%;srv*http://msdl.microsoft.com/download/symbols
Start your process under debugger, stop it at breakpoint or wherever you need.
Create your first snapshot:
umdh -p: -f:MyFirstSnapshot.txt
Resume execution of your process, stop it second time in place you need.
Create your second snapshot:
umdh -p: -f:MySecondSnapshot.txt
Create a diff with symbols resolved:
umdh MyFirstSnapshot.txt MySecondSnapshot.txt -f:MyDiff.txt