Windows process handle count continues to grow

0

I'm working on a C++ project on Windows 10, its been noticed that over time the Handles associated with the process increases and continues to grow.

Searching online for a reason I'm not sure if this means that the process has a memory leak or if this is normal.

When memory is allocated and then freed, would I see the handles increase and decrease?

I've been using this as I'm struggling to find what the cause is: https://docs.microsoft.com/en-us/archive/blogs/markrussinovich/pushing-the-limits-of-windows-handles

I cannot find any calls to anything that creates a handle in the code.

[Edit] Using windbg to open the dumped process content:

Microsoft (R) Windows Debugger Version 10.0.18362.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\u49100\Downloads\ManagementServiceGroup.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 16299 MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
16299.637.x86fre.rs3_release_svc.180808-1748
Machine Name:
Debug session time: Wed Feb  5 09:56:54.000 2020 (UTC + 0:00)
System Uptime: 0 days 0:44:55.871
Process Uptime: 0 days 0:02:30.000
................................................................
.....................................
This dump file has a breakpoint exception stored in it.
The stored exception information can be accessed via .ecxr.
For analysis of this file, run !analyze -v
eax=002f1000 ebx=00000000 ecx=7707a080 edx=7707a080 esi=7707a080 edi=7707a080
eip=77041900 esp=0d24ff54 ebp=0d24ff80 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000244
ntdll!DbgBreakPoint:
77041900 cc              int     3
0:075> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for PlatformSG.dll
*** WARNING: Unable to verify checksum for ManagementServiceGroup.exe
*** WARNING: Unable to verify checksum for SlaveCommsSG.dll
*** WARNING: Unable to verify checksum for CalibrationFramework.dll
*** WARNING: Unable to verify checksum for SPLINTServer.dll
*** WARNING: Unable to verify checksum for TCPIPManager.dll
*** WARNING: Unable to verify checksum for MillikanFaults.dll
*** WARNING: Unable to verify checksum for MillikanCalibration.dll
*** WARNING: Unable to verify checksum for HBC.dll
*** WARNING: Unable to verify checksum for Machine.dll
*** WARNING: Unable to verify checksum for Vibrator.dll
*** WARNING: Unable to verify checksum for TelnetServer.dll
*** WARNING: Unable to verify checksum for UserDefects.dll
*** WARNING: Unable to verify checksum for HBCStatCollector.dll
*** WARNING: Unable to verify checksum for StatisticsArchiver.dll
*** WARNING: Unable to verify checksum for SplintVibratorCalibration.dll
*** WARNING: Unable to verify checksum for StatisticsHistorian.dll
*** WARNING: Unable to verify checksum for ModeManager.dll
*** WARNING: Unable to verify checksum for SPLINTStatDistributor.dll
*** WARNING: Unable to verify checksum for IOMillikan.dll
*** WARNING: Unable to verify checksum for ProcessControlSG.dll
*** WARNING: Unable to verify checksum for CameraGroup.dll
*** WARNING: Unable to verify checksum for ComponentLifeMonitor.dll

KEY_VALUES_STRING: 1

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 2695

    Key  : Timeline.Process.Start.DeltaSec
    Value: 150

PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

Timeline: !analyze.Start
    Name: <blank>
    Time: 2020-02-05T10:01:43.660Z
    Diff: 289660 mSec

Timeline: Dump.Current
    Name: <blank>
    Time: 2020-02-05T09:56:54.0Z
    Diff: 0 mSec

Timeline: Process.Start
    Name: <blank>
    Time: 2020-02-05T09:54:24.0Z
    Diff: 150000 mSec

Timeline: OS.Boot
    Name: <blank>
    Time: 2020-02-05T09:11:59.0Z
    Diff: 2695000 mSec

DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
eax=002f1000 ebx=00000000 ecx=7707a080 edx=7707a080 esi=7707a080 edi=7707a080
eip=77041900 esp=0d24ff54 ebp=0d24ff80 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000244
ntdll!DbgBreakPoint:
77041900 cc              int     3
Resetting default scope

FAULTING_IP: 
ntdll!DbgBreakPoint+0
77041900 cc              int     3

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 77041900 (ntdll!DbgBreakPoint)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 00000000

PROCESS_NAME:  ManagementServiceGroup.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

EXCEPTION_CODE_STR:  80000003

EXCEPTION_PARAMETER1:  00000000

WATSON_BKT_PROCSTAMP:  5e38030b

WATSON_BKT_MODULE:  ntdll.dll

WATSON_BKT_MODSTAMP:  7b4896c1

WATSON_BKT_MODOFFSET:  71900

WATSON_BKT_MODVER:  10.0.16299.936

MODULE_VER_PRODUCT:  Microsoft® Windows® Operating System

BUILD_VERSION_STRING:  16299.637.x86fre.rs3_release_svc.180808-1748

MODLIST_WITH_TSCHKSUM_HASH:  70177fe8843802a721ebc9381c39ea0930d91d47

MODLIST_SHA1_HASH:  88c13d9b0d70b5ff412cbabd039482499bc59744

NTGLOBALFLAG:  1100

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  80000004

CHKIMG_EXTENSION: !chkimg -lo 50 -d !ntdll
    77030eb0-77030eb4  5 bytes - ntdll!LdrLoadDll
      [ 8b ff 55 8b ec:e9 9b 68 8c fc ]
    7703f780-7703f784  5 bytes - ntdll!NtAllocateVirtualMemory (+0xe8d0)
      [ b8 18 00 00 00:e9 0b 69 8b fc ]
    7703f800-7703f804  5 bytes - ntdll!NtFreeVirtualMemory (+0x80)
      [ b8 1e 00 00 00:e9 eb 6c 8b fc ]
    7703f8a0-7703f8a4  5 bytes - ntdll!NtMapViewOfSection (+0xa0)
      [ b8 28 00 00 00:e9 5b 77 8b fc ]
    7703f8c0-7703f8c4  5 bytes - ntdll!NtUnmapViewOfSection (+0x20)
      [ b8 2a 00 00 00:e9 cb 7b 8b fc ]
    7703f9c0-7703f9c4  5 bytes - ntdll!NtWriteVirtualMemory (+0x100)
      [ b8 3a 00 00 00:e9 bb 73 8b fc ]
    7703fa10-7703fa14  5 bytes - ntdll!NtReadVirtualMemory (+0x50)
      [ b8 3f 00 00 00:e9 ab 74 8b fc ]
    7703fa70-7703fa74  5 bytes - ntdll!NtQueueApcThread (+0x60)
      [ b8 45 00 00 00:e9 cb 7b 8b fc ]
    7703fb20-7703fb24  5 bytes - ntdll!NtProtectVirtualMemory (+0xb0)
      [ b8 50 00 00 00:e9 db 6a 8b fc ]
    7703fd80-7703fd84  5 bytes - ntdll!NtAlpcConnectPort (+0x260)
      [ b8 76 00 00 00:e9 ab 89 8b fc ]
    77040e30-77040e34  5 bytes - ntdll!NtSetContextThread (+0x10b0)
      [ b8 81 01 00 00:e9 eb 76 8b fc ]
    77041290-77041294  5 bytes - ntdll!NtWaitForDebugEvent (+0x460)
      [ b8 c7 01 00 00:e9 7b 00 8d fc ]
    77041930-77041934  5 bytes - ntdll!KiUserApcDispatcher (+0x6a0)
      [ 83 3d 98 77 0e:e9 2b 82 91 fc ]
65 errors : !ntdll (77030eb0-77041934)

PRODUCT_TYPE:  1

SUITE_MASK:  272

DUMP_FLAGS:  c07

DUMP_TYPE:  3

APPLICATION_VERIFIER_LOADED: 1

ANALYSIS_SESSION_HOST:  HW-WOP-113835

ANALYSIS_SESSION_TIME:  02-05-2020 10:01:43.0660

ANALYSIS_VERSION: 10.0.18362.1 x86fre

THREAD_ATTRIBUTES: 
ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

OS_LOCALE:  ENG

BUGCHECK_STR:  MEMORY_CORRUPTION_PATCH_AVRF

DEFAULT_BUCKET_ID:  MEMORY_CORRUPTION_PATCH_AVRF

PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION

PROBLEM_CLASSES: 

    ID:     [0n98]
    Type:   [AVRF]
    Class:  Addendum
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x4254]
    TID:    [0x445c]
    Frame:  [0] : ntdll!DbgBreakPoint

    ID:     [0n209]
    Type:   [MEMORY_CORRUPTION]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x4254]
    TID:    [0x445c]
    Frame:  [Unspecified]

    ID:     [0n157]
    Type:   [PATCH]
    Class:  Addendum
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x4254]
    TID:    [0x445c]
    Frame:  [Unspecified]

LAST_CONTROL_TRANSFER:  from 7707a0b9 to 77041900

STACK_TEXT:  
00000000 00000000 memory_corruption!ntdll+0x0


STACK_COMMAND:  ** Pseudo Context ** ManagedPseudo ** Value: 173e49f0 ** ; kb

THREAD_SHA1_HASH_MOD_FUNC:  646019e7612e819fc8aba56460d68e5912f8f117

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  70e2aeaf8a93e9fa2f653f0a0ed9deec52e32f7e

THREAD_SHA1_HASH_MOD:  7da7fbec386ce361a40d03d69a994bc4836f03e8

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  memory_corruption!ntdll

FOLLOWUP_NAME:  MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  MEMORY_CORRUPTION_PATCH_AVRF_memory_corruption!ntdll

FAILURE_EXCEPTION_CODE:  80000003

IMAGE_NAME:  memory_corruption

FAILURE_IMAGE_NAME:  memory_corruption

BUCKET_ID_IMAGE_STR:  memory_corruption

MODULE_NAME: memory_corruption

FAILURE_MODULE_NAME:  memory_corruption

BUCKET_ID_MODULE_STR:  memory_corruption

FAILURE_FUNCTION_NAME:  ntdll

BUCKET_ID_FUNCTION_STR:  ntdll

BUCKET_ID_OFFSET:  0

BUCKET_ID_MODTIMEDATESTAMP:  0

BUCKET_ID_MODCHECKSUM:  0

BUCKET_ID_MODVER_STR:  0.0.0.0

BUCKET_ID_PREFIX_STR:  

FAILURE_PROBLEM_CLASS:  MEMORY_CORRUPTION

FAILURE_SYMBOL_NAME:  memory_corruption!ntdll

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_PATCH_AVRF_80000003_memory_corruption!ntdll

TARGET_TIME:  2020-02-05T09:56:54.000Z

OSBUILD:  16299

OSSERVICEPACK:  1146

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

OSPLATFORM_TYPE:  x86

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS

USER_LCID:  0

OSBUILD_TIMESTAMP:  2014-08-09 10:57:59

BUILDDATESTAMP_STR:  180808-1748

BUILDLAB_STR:  rs3_release_svc

BUILDOSVER_STR:  10.0.16299.637.x86fre.rs3_release_svc.180808-1748

ANALYSIS_SESSION_ELAPSED_TIME:  1c133

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:memory_corruption_patch_avrf_80000003_memory_corruption!ntdll

FAILURE_ID_HASH:  {fff25d61-b919-7e8b-df9e-56dec8271fe1}

Followup:     MachineOwner
---------

This doesn't mean a lot to me, if anyone has expertise in how to interpret this, your input would be very much appreciated.

[Edit 18-02-2020 Another dump and windbg output]

    Microsoft (R) Windows Debugger Version 10.0.18362.1 X86
    Copyright (c) Microsoft Corporation. All rights reserved.        

    Loading Dump File [D:\Stuff\ManagementServiceGroup.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Version 14393 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)
    Machine Name:
    Debug session time: Tue Feb 18 10:22:54.000 2020 (UTC + 0:00)
    System Uptime: 0 days 0:41:07.933
    Process Uptime: 0 days 0:40:15.000
    ...............................................................................................
    For analysis of this file, run !analyze -v
    eax=0000000d ebx=00000000 ecx=0014f96c edx=775d53d0 esi=00000001 edi=00000001
    eip=775d53d0 esp=0014f96c ebp=0014fb00 iopl=0         nv up ei pl zr na pe cy
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000247
    ntdll!KiFastSystemCallRet:
    775d53d0 c3              ret
c++
windows
windbg
asked on Stack Overflow Feb 4, 2020 by SPlatten • edited Feb 18, 2020 by SPlatten

1 Answer

2

windbg !handle will provide a summary after displaying individual handles

the summary will show how many handles are there for each type

screenshot below
cmd.exe pid 5124 has 22 handles
the command below attaches windbg to pid non-invasively executes !handle and quits
gnuwin32-awk filters only the relevant data

cdb -pv -c "!handle;q" -p 5124  | awk "/Handles/,/quit/"

result

:\>cdb -pv -c "!handle;q" -p 5124  | awk "/Handles/,/quit/"
23 Handles
Type            Count
Event           2
File            2
Directory       1
WindowStation   2
Key             10
Process         2
Thread          1
Desktop         1
ALPC Port       2
quit:

enter image description here

answered on Stack Overflow Feb 5, 2020 by blabb

User contributions licensed under CC BY-SA 3.0