How to check Memory & Handle leaks and CPU usage in a Driver?

NTDEV
1

Hi

I have a driver that also uses dispatch table hooking.
I want to monitor it’s performance and memory usage.

I know that numega’s bounds checker should handle part of these things
but it sometimes crashes (maybe because of the hooking?) and i can’t
see the place in the diver’s source of the error or memory leak.

Any other recommended tool / way ? (also want to check handle leaks…)

Also, is there a way to monitor CPU usage of a driver ?

Thanks!

2

What version of Numega software you are talking about ?

Yes there are problems if the driver itself has hooking as you explained.

You can try kernrate ( and the krview ? ) from MS. It is not as nice as
Numega’s software.

-pro

----- Original Message -----
From: “Omer B”
To: “Windows System Software Devs Interest List”
Sent: Wednesday, June 01, 2005 2:15 AM
Subject: [ntdev] How to check Memory & Handle leaks and CPU usage in a
Driver?

Hi

I have a driver that also uses dispatch table hooking.
I want to monitor it’s performance and memory usage.

I know that numega’s bounds checker should handle part of these things
but it sometimes crashes (maybe because of the hooking?) and i can’t
see the place in the diver’s source of the error or memory leak.

Any other recommended tool / way ? (also want to check handle leaks…)

Also, is there a way to monitor CPU usage of a driver ?

Thanks!

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

For memory utilization:
(1) Use pooltag and use the ExAllocate…() routines that have the
…withTag suffix. This will track your memory utilization. Now if you see
memory utilization increasing you will have to debug where this is
happening. Now since ExAllocate and ExFree… occur in pairs you can wrap
your calls for memory allocation and frees with your own tracking. This is
like parenthesis matching in an expression. I linked in some source code
from John Robbins Jan 99 Microsoft System Journal that was indispensible in
finding a memory line with a huge kernal driver for a T1 / E1 driver where
they used bought source from a third party for the actual communications. I
inherited the bugs. This tool I retrofited and with it I was able to find a
recreation scenario, find and fix the bug. I know there are easy ways but
this worked for me 2 years ago. You can look at the Windbg extensions for
memory tracking also that use tags.

Sincerely;
William Michael Jones “Mike”

“Omer B” wrote in message news:xxxxx@ntdev…
Hi

I have a driver that also uses dispatch table hooking.
I want to monitor it’s performance and memory usage.

I know that numega’s bounds checker should handle part of these things
but it sometimes crashes (maybe because of the hooking?) and i can’t
see the place in the diver’s source of the error or memory leak.

Any other recommended tool / way ? (also want to check handle leaks…)

Also, is there a way to monitor CPU usage of a driver ?

Thanks!

4

Verifier will also find leaks, but only on unload. If you are a hooking
driver, I doubt you can unload yourself. If you localize all
allocations to one function (ie MyDriverAllocatePool()), verifier cannot
track the true allocator of memory, each allocation will come from the
one function.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michael Jones
Sent: Wednesday, June 01, 2005 6:32 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] How to check Memory & Handle leaks and CPU usage in
a Driver?

For memory utilization:
(1) Use pooltag and use the ExAllocate…() routines that have the
…withTag suffix. This will track your memory utilization. Now if you
see
memory utilization increasing you will have to debug where this is
happening. Now since ExAllocate and ExFree… occur in pairs you can
wrap
your calls for memory allocation and frees with your own tracking. This
is
like parenthesis matching in an expression. I linked in some source code
from John Robbins Jan 99 Microsoft System Journal that was indispensible
in
finding a memory line with a huge kernal driver for a T1 / E1 driver
where
they used bought source from a third party for the actual
communications. I
inherited the bugs. This tool I retrofited and with it I was able to
find a
recreation scenario, find and fix the bug. I know there are easy ways
but
this worked for me 2 years ago. You can look at the Windbg extensions
for
memory tracking also that use tags.

Sincerely;
William Michael Jones “Mike”

“Omer B” wrote in message news:xxxxx@ntdev…
Hi

I have a driver that also uses dispatch table hooking.
I want to monitor it’s performance and memory usage.

I know that numega’s bounds checker should handle part of these things
but it sometimes crashes (maybe because of the hooking?) and i can’t
see the place in the diver’s source of the error or memory leak.

Any other recommended tool / way ? (also want to check handle leaks…)

Also, is there a way to monitor CPU usage of a driver ?

Thanks!

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Which version of BoundsChecker are you using ? You know,
bchkd.sys does the equivalent of invasive surgery, and it usage
requires expertise and a strong dose of common sense. It
sometimes crashes, but AFAIK it only happens in pretty obscure
circumstances. If you use anything else concurrent with
BoundsChecker that hooks anything in the system, brace yourself
for trouble because it will happen: you don’t do multiple
concurrent invasive surgery without trouble.

If you have a reproducible crash - emphasis in reproducible -
call Numega’s support pronto and presto. If you want to handle
the issue yourself, the first thing is probably to make sure
you’re using the version that comes with DriverStudio 3.2. The
next thing to do is, make sure you have an up to date set of OSI
files (if you don’t know what OSI is, you probably should
refrain from using bchkd to begin with!) - contact your friendly
Compuware support engineer if you have a problem. The third
thing is, of course, turn all hooking off except your own driver
(you can do that in the BoundsChecker pane of the DriverStudio
settings application). Last but not least, if you’re crashing in
the Workbench, switch to .NET and see if the crash is still
there. Or you can also drive bchkd.sys remote from a host
machine onto a target machine and see if the crash stays at the
host or if it moves to the target.

My experience is, sometimes bchkd crashes because the user
driver has a serious problem, sometimes it crashes because
you’re using an OS that’s not supported by your OSI data files,
sometimes crashes because you turn multiple hooking software on
and they compete for the resource, or sometimes it crashes
because you’re trying to monitor a critical driver that does
something that makes it “hard to hook”. If you weed those out,
you should have a pretty stable experience.

Hope this helps,

Alberto.

----- Original Message -----
From: “Prokash Sinha”
To: “Windows System Software Devs Interest List”

Sent: Wednesday, June 01, 2005 9:26 AM
Subject: Re: [ntdev] How to check Memory & Handle leaks and CPU
usage in a Driver?

> What version of Numega software you are talking about ?
>
> Yes there are problems if the driver itself has hooking as you
> explained.
>
> You can try kernrate ( and the krview ? ) from MS. It is not
> as nice as Numega’s software.
>
> -pro
>
> ----- Original Message -----
> From: “Omer B”
> To: “Windows System Software Devs Interest List”
>
> Sent: Wednesday, June 01, 2005 2:15 AM
> Subject: [ntdev] How to check Memory & Handle leaks and CPU
> usage in a Driver?
>
>
> Hi
>
> I have a driver that also uses dispatch table hooking.
> I want to monitor it’s performance and memory usage.
>
> I know that numega’s bounds checker should handle part of
> these things
> but it sometimes crashes (maybe because of the hooking?) and i
> can’t
> see the place in the diver’s source of the error or memory
> leak.
>
> Any other recommended tool / way ? (also want to check handle
> leaks…)
>
>
> Also, is there a way to monitor CPU usage of a driver ?
>
> Thanks!
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag
> argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@ieee.org
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com

6

For performance monitoring, you can use TrueTime. Comes in your
DriverStudio CD.

Alberto.

----- Original Message -----
From: “Omer B”
To: “Windows System Software Devs Interest List”

Sent: Wednesday, June 01, 2005 5:15 AM
Subject: [ntdev] How to check Memory & Handle leaks and CPU
usage in a Driver?

Hi

I have a driver that also uses dispatch table hooking.
I want to monitor it’s performance and memory usage.

I know that numega’s bounds checker should handle part of these
things
but it sometimes crashes (maybe because of the hooking?) and i
can’t
see the place in the diver’s source of the error or memory leak.

Any other recommended tool / way ? (also want to check handle
leaks…)

Also, is there a way to monitor CPU usage of a driver ?

Thanks!

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com