How can I create memory dumps and analyze memory leaks?

Question

I need to get the following to analyze a memory leak issue. How to do that?

• Orphan Block Addresses Orphan Call
• Stack

Are there any good resources/tools to know about/fix memory leaks.

Thanks

Answer 1

If you're on linux, use valgrind. It's your new best friend. I'm not sure what tools are available for Windows.

Answer 2

valgrind --leak-check=full

Answer 3

The Microsoft Application Verifier performs memory analysis similar to valgrind if you are on a Windows platform.

Answer 4

In Windows, you can use the MiniDumpWriteDump function in dbghelp.dll.

How to create minidump for my process when it crashes?

This can be very helpful in tracking down errors in deployed applications because you can use your debug symbols to inspect a minidump made in the field with no debug info. It's not very useful for tracking memory leaks, however.

For memory leaks under Windows (aside from commercial tools like Purify, BoundsChecker and GlowCode, of course) you can use WinDbg from the free Debugging Tools for Windows package, along with Win32 heap tags to track down the source of memory leaks.

http://www.codeproject.com/KB/cpp/MemoryLeak.aspx

http://blogs.msdn.com/alikl/archive/2009/02/15/identifying-memory-leak-with-process-explorer-and-windbg.aspx

Answer 5

Yes, as J. Paulett commented, at least on the Linux platform Valgrind is an excellent starting point.

Answer 6

On Windows I was able to get the necessary details using UIforETW, which is handling the necessary command line arguments for xperf.

This blog post explains everything in great detail: https://randomascii.wordpress.com/2015/04/27/etw-heap-tracingevery-allocation-recorded/

---

Recording

Step 1: A TracingFlags registry entry is created and set to ‘1’ in the Image File Execution Options for each process name that will be trace to tell the Windows heap to configure itself for tracing when a process with that name is launched. As is always the case with Image File Execution Options the options don’t affect already running processes – only processes launched when the registry key is set are affected.

Step 2: An extra ETW session is created using the “-heap -Pids 0” incantation. This session will record information from processes that had a TracingFlags registry entry of ‘1’ when they started.

The details are a bit messy but now that UIforETW is written I don’t have to bother explaining the details, and you don’t have to pretend to listen. If you want to record a heap trace use UIforETW, and if you want to know how it works then look at the code, or click the Show commands button to see most of the dirty laundry.

Analysis

The recording can be inspected with WPA (Windows Performance Analyzer) which can be conveniently launched from UIforETW.

The recommended columns are: Process, Handle, Type, Stack.

The allocation types are:

• AIFO – Allocated Inside Freed Outside (hint, hint)
• AOFI – Allocated Outside Freed Inside
• AOFO – Allocated Outside Freed Outside
• AIFI – Allocated Inside Freed Inside