How to drill down to code who created the handle

Question

I know if we provide the absolute path to Handle.exe it will list all processes that locked the file.

F:\Softwares\Handle>Handle.exe  D:\Source\sample.dll

Handle v4.0
Copyright (C) 1997-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

test1.exe           pid: 9928   type: File           408: D:\Source\sample.dll
test2.exe           pid: 10840  type: File           6A8: D:\Source\sample.dll
test3.exe           pid: 15788  type: File           374: D:\Source\sample.dll
test4.exe           pid: 10940  type: File           308: D:\Source\sample.dll
test5.exe           pid: 15424  type: File           3FC: D:\Source\sample.dll
test6.exe           pid: 10076  type: File           8AC: D:\Source\sample.dll

Windows 7 64bit

As stated by Handle.exe my sample.dll is locked by 6 different process. I want to know which is the line of code which actually holds the sample.dll from each process. My task is to fix the handle leaks in my mammoth application. So my problem is not fixed to a specific part of program. The task is i have to generate report contains handle leaks diagnose who created it. The leaks are not specific to file , it expands to all system resource like file, registry key, event,Semaphore,Thread ...etc .

I have taken a dump using windbg but I couldn't find how to diagnose the dump file especially for handle leaks. In my search around half a day a couldn't find good tutorial or solution which suites my problem.

Is there any command line tool or any other tool which answers my question.

Answer 1

You are using the wrong debugging tool. You want to read this article, it goes into great detail how to get a stack-trace for leaked handles with the !htrace debugger command. Also covered by this existing SO question.

You'll see "Debugging Tools for Windows" mentioned often. It is no longer a separate download but included in the Windows SDK install.