What to do with !address -filter Windbg

I am currently looking into an issue where an application is using alot of private memory for a C++ app. It looks like alot is in commited and reserve m开发者_运维知识库emory based on the dump analysis.

I use Windbg. Is there any way I can see what excactly is in commited and reserve memory? I have narrowed it down to one specific heap.

My theory is that it's not being released. I cannot live debug, I only have dumps to go on.

I have already used the command !address -filter and get a pretty little out put, but how do i move forward?

Any suggestions would help.

You can use the !heap -s command to get memory usage info in WinDbg. There is a tutorial on Leak Detection with windbg here.

There are few ways how you can diagnoze memory leaks:

• Using heap stack trace, and then examining process dump in WinDbg
• Taking snapshots of process memory state using UMDH tool.

The later option (UMDH tool) is part of WinDbg package and is usually the easiest option to investigate memory leaks. Both options are actually based on the same feature, which is an ability of NT heap to keep call stacks at the allocation along with the allocated entry.

Note that besides leaking memory in heaps, you might have other types of leaks that would result in increase of commited memory space. For example you might have called VirtualAlloc directly and forgot to VirtualFree it.