monitoring desktop heap memory

Question

Is there any way to figure out which application is using up all the desktop heap memory?

For an explanation of 'desktop heap' see this MSDN blog.

EDIT: If you don't know what "desktop heap memory" is please don't answer.

EDIT2: if you don't know what "desktop heap memory" is don't vote to close the question.

Answer 1

Disclaimer: I work for Microsoft, and these are my personal thoughts and experiences which may or may not reflect current or future Microsoft policies/procedures/etc.

I know this is old, but since I stumbled across it I wanted to provide some feedback/answers.

Desktop Heap Monitor does not work on Vista+. DHeapMon depended on the ability to patch kernel binaries to track desktop heap- this behavior is blocked, which is why it doesn't work.

To monitor desktop heap yourself, all you can do is look at user objects (unfortunately).

To get a complete answer, you can open a support ticket with Microsoft and with a kernel or complete dump (NOT a process dump!) and they can inspect the heap and provide you some information. It is extracted from the dump file via a debugger extension, which I wrote.

Limitations:

1. Only works from kernel mode. Even though a desktop heap mapping exists in user mode, the extension does not support it. Even if I added support for user mode debugging of desktop heap, it would be limited as some of the related data is only in kernel mode. Changes on recent builds of Windows 10 might restrict it further, so I have not invested time to add user mode support.

2. It can't measure what isn't in the dump. In other words, if the desktop heap is missing pages it will do its best but it will obviously lose accuracy.

3. Does not support Windows 10 build 1809 or Server 2019, yet, due to changes to the heap manager.

Happy coding!

Answer 2

According to this blog post you should look for the user objects. To find the bad application you can configure the USER Objects column within Process Explorer. Then sort descending by user objects. User Objects are all GUI objects like Windows, Toolbars, Icons, Cursors ... The process with the highest values is very likely the bad one.

Direct link to download: DHeapMon from microsoft.