A brief introduction to UMDH, a tool for finding memory leaks in Windows applications.

2.  Stands for User Mode Dump Heap
 Can be downloaded for free as part of the
Windows 7 SDK (also works for Windows XP)
 Helps you to find memory leaks in running
processes!

3. 1. Set the _NT_SYMBOL_PATH environment var to:
srv*c:symbols*http://msdl.microsoft.com/download/symbols;
2. Append the path to your executable

4. 1. Flag your process under test as being
monitored:
C:> gflags -i Test.exe +ust
2. Start your process under test:
C:> Test.exe
3. Take an initial “snapshot” of allocated
memory as Test.exe runs:
C:> umdh -pn:Test.exe -f:C:f1.txt

5. 4. Exercise your program in a way that you
think may make it leak memory.
5. Take a second snapshot and save it with a
different file name from the first.
C:> umdh -pn:Test.exe -f:C:f2.txt
6.Use UMDH to “diff” the first and last
snapshots taken to get the best idea of what
has leaked
C:> umdh -d f1.txt f2.txt > f12.txt

6.  The “diff” file shows a stack trace, and the
number/size of allocations that were allocated but not
freed between two snapshots.
+ 483328 ( 487424 - 4096) 119 allocs BackTrace23FF
+ 118 ( 119 - 1) BackTrace23FF allocations
ntdll!RtlDebugAllocateHeap+000000E1
ntdll!RtlAllocateHeapSlowly+00000044
ntdll!RtlAllocateHeap+00000E64
kernel32!FindNextFileW+00000077
kernel32!FindNextFileA+00000028
MSVCR80D!findnext64i32+00000178
Test!readdir+00000075 (c:myprojectutil.cpp, 674)
…

7. Bytes “leaked” between
the two snapshots
+ 483328 ( 487424 - 4096) 119 allocs BackTrace23FF
+ 118 ( 119 - 1) BackTrace23FF allocations
ntdll!RtlDebugAllocateHeap+000000E1
ntdll!RtlAllocateHeapSlowly+00000044
ntdll!RtlAllocateHeap+00000E64
kernel32!FindNextFileW+00000077
kernel32!FindNextFileA+00000028
MSVCR80D!findnext64i32+00000178
Test!readdir+00000075 (c:myprojectutil.cpp, 674)
…
Stacktrace showing
where the “leaked”
memory was allocated.

8.  At the very bottom of the file, there is an
overall summary of how much memory was
allocated but not freed. E.g.:
Total increase == 13919896 requested + 830364 overhead = 14750260
 If used as part of an automated test, it is fairly
easy to extract the “Total increase” number
using a Perl script and graphs of memory
allocations and usage over time.

9.  UMDH is a useful tool for finding
memory leaks in Windows
applications.
 Its output is a file listing outstanding
memory allocations that can be read
directly, or processed by another
program or script.

10.  http://msdn.microsoft.com/en-
us/library/ff558947%28v=vs.85%29.aspx