winapi - 如何查看桌面堆上的内容

Question

我有一个应用程序在这个版本中使用了大约 100k 的桌面堆，然后它在上一个版本中使用了。有没有办法可以查看桌面堆上的内容以及各个对象的大小？使用 Dheapmon我能够看到我正在使用的堆的百分比，但我想要更多详细信息。

Answer 1

从博客文章的评论中窃取 here

Let megive a little background on howdesktop heap allocations are made. Thedesktop heaps are in kernel modevirtual address space, so individualdesktop heap allocations have to bemade by a component running in kernelmode. In particular, win32k.sys is theonly kernel mode component that makesdesktop heap allocations. win32k.sysin the kernel mode side of Win32, andit includes both the window manager(USER) and GDI. It is the windowmanager piece of win32k.sys that usesdesktop heap. The functionality of thewindow manager is exposed to processesrunning in user mode throughuser32.dll. It is user32.dll thatexports user mode callable functionsthat are implemented in win32k.sys. Soif a process does not load user32.dll,it will not use desktop heap.

Regarding your question about settinga breakpoint that will catch desktopheap allocations... yes, there is sucha function - win32k!DesktopAlloc.However, this is a kernel modefunction, and to set a breakpoint onit will require that you use a kerneldebugger.

对于从未在 Windows 中脱离用户模式的我来说，这听起来很复杂。
当我遇到类似的问题时，我只是在应用程序的启动部分放置断点。每次休息时，我都会查看分配的句柄级别以及 dhelpmon 告诉我的内容。进行一种二进制搜索，我开始缩小分配发生的范围。