[Bug 50369] New: Multiple tools for viewing GDI handles/resources list and GDI leak detection require support for PEB->GdiSharedHandleTable (GDIView, GDILeaks)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50369

Bug ID: 50369
           Summary: Multiple tools for viewing GDI handles/resources list
                    and GDI leak detection require support for
                    PEB->GdiSharedHandleTable (GDIView, GDILeaks)
           Product: Wine
           Version: 6.0-rc3
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ntdll
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hello folks,

as it says. I know this information can be retrieved tracing processes with
Wine 'gdi' debug channel.

https://source.winehq.org/git/wine.git/blob/56e7cd12ce0ce3bb331a8595b25aedb8...

Currently investigating bug 23221 where the application massively leaks GDI
handles. App bug, most likely unrelated to the actual problem of the ticket.

I wanted to see the leakage in a realtime-view with absolute values, leak rate
per second, changes when doing certain UI actions. It's possible to extract
that from Wine trace logs as well using timestamps and filtering for specific
messages but it takes way more effort to associate the leak rate with certain
UI actions (controls).

Multiple tools provide that information in a convenient way. Unfortunately they
rely on the shared handle table being exposed.

---

* https://www.nirsoft.net/utils/gdi_handles.html ("GDIView - View GDI
handles/resources list and detect GDI leaks")

Stable download link via Internet Archive:

https://web.archive.org/web/20201127182337/http://www.nirsoft.net/utils/gdiv...

*
https://docs.microsoft.com/en-us/archive/msdn-magazine/2003/january/detect-a...
("Detect and Plug GDI Leaks in Your Code with Two Powerful Tools for Windows
XP")

Stable download link via Internet Archive:

https://web.archive.org/web/20170911002438/http://download.microsoft.com/dow...

The MSDN article provides the struct layout for entry:

--- quote ---
In his book Windows Graphics Programming: Win32 GDI and DirectDraw (Prentice
Hall, 2002), Feng Huan provides another way to access this table, but he also
describes the structure of each of the 0x4000 entries of this table, as you can
see here:

...
typedef struct { 
    DWORD pKernelInfo;
    WORD ProcessID;
    WORD _nCount;
    WORD nUpper;
    WORD nType;
    DWORD pUserInfo;
} GDITableEntry;
--- quote ---

'GDILeaks' self-extractor contains multiple example applications as binaries
and with sources.

https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index....

--- quote ---
Offset (x86) Offset (x64) Definition                    Versions

0x94          0xF8         PVOID GdiSharedHandleTable;  3.51 and higher 
--- quote ---

The app crashes because the 'PEB->GdiSharedHandleTable' pointer is NULL:

--- snip ---
$ WINEDEBUG=+seh,+relay wine ./GDIView.exe >>log.txt 2>&1
...
0104:Call KERNEL32.GetModuleHandleW(140011eb0 L"ntdll.dll") ret=140004c52
...
0104:Ret  KERNEL32.GetModuleHandleW() retval=7bc00000 ret=140004c52
0104:Call KERNEL32.GetProcAddress(7bc00000,140011ec8 "RtlGetCurrentPeb")
ret=140004c67
0104:Ret  KERNEL32.GetProcAddress() retval=7bc068e4 ret=140004c67
0104:Call ntdll.RtlGetCurrentPeb() ret=140004c6e
0104:Ret  ntdll.RtlGetCurrentPeb() retval=7fffffdaf000 ret=140004c6e
0104:trace:seh:dispatch_exception code=c0000005 flags=0 addr=0000000140004CA6
ip=0000000140004CA6 tid=0104
0104:trace:seh:dispatch_exception  info[0]=0000000000000000
0104:trace:seh:dispatch_exception  info[1]=0000000000000008
0104:trace:seh:dispatch_exception  rax=0000000000000000 rbx=0000000000f314c0
rcx=000000000021ee48 rdx=0000000000000000
0104:trace:seh:dispatch_exception  rsi=0000000000000000 rdi=0000000000000000
rbp=0000000000000000 rsp=000000000021edf8
0104:trace:seh:dispatch_exception   r8=000000000021ee30  r9=0000000000000000
r10=0000000000000000 r11=0000000000000246
0104:trace:seh:dispatch_exception  r12=0000000000000415 r13=0000000000000001
r14=0000000000000000 r15=000000000021f168
0104:trace:seh:call_vectored_handlers calling handler at 000000007B011BA0
code=c0000005 flags=0
0104:trace:seh:call_vectored_handlers handler at 000000007B011BA0 returned 0
0104:warn:seh:virtual_unwind exception data not found in L"GDIView.exe" 
--- snip ---

Wine source:

--- snip ---
$ grep -Hrni GdiSharedHandleTable

include/winternl.h:339:    PVOID                        GdiSharedHandleTable;  
           /* 094/0f8 */
include/winternl.h:584:    ULONG64                      GdiSharedHandleTable;  
           /* 00f8 */
--- snip ---

https://source.winehq.org/git/wine.git/blob/56e7cd12ce0ce3bb331a8595b25aedb8...
(x86)

https://source.winehq.org/git/wine.git/blob/56e7cd12ce0ce3bb331a8595b25aedb8...
(x86_64)

$ sha1sum gdiview*.zip
4bacc3fed9a41678c72eba41937ff73b7e98ee90  gdiview-x64.zip
1115a41a1784127380ac2df0d3960f4bf09955db  gdiview.zip

$ du -sh gdiview*.zip
68K    gdiview-x64.zip
52K    gdiview.zip

$ wine --version
wine-6.0-rc3

Regards

[Bug 50369] Multiple tools for viewing GDI handles/resources list and GDI leak detection require support for PEB->GdiSharedHandleTable (GDIView, GDILeaks)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50369

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://web.archive.org/web
                   |                            |/20201127182337/http://www.
                   |                            |nirsoft.net/utils/gdiview-x
                   |                            |64.zip
           Keywords|                            |download

[Bug 50369] Multiple tools for viewing GDI handles/resources list and GDI leak detection require support for PEB->GdiSharedHandleTable (GDIView, GDILeaks)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50369

--- Comment #1 from Nikolay Sivov  ---
These tools do not crash anymore for me, but don't display anything useful
either. I suspect it's because of handle entry data format that we are using.
It's always using 64bit fields in wine.

[Bug 50369] Multiple tools for viewing GDI handles/resources list and GDI leak detection require support for PEB->GdiSharedHandleTable (GDIView, GDILeaks)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50369

Jacek Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Jacek Caban  ---
The layout we use matches modern Windows and we have tests for that
(test_shared_handle_table). Note that it depends on kernel architecture, not
process, so using 64-bit layout is fine for win64 prefixes. I recall reading
that it changed at some point in earlier Windows versions, but if it works on
recent Windows, we could probably support it.

We're not yet fully compatible with native. For example we don't support
ProcessId and Flags, but it shouldn't be hard to add.

[Bug 50369] Multiple tools for viewing GDI handles/resources list and GDI leak detection require support for PEB->GdiSharedHandleTable (GDIView, GDILeaks)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50369

--- Comment #3 from Nikolay Sivov  ---
It's not that bad then, linked gdiview-x64.zip works on modern Windows system.
If it has to match system architecture, we could do that too, but having just
64-bit case work is good already. I never used these tools myself, but I can
see how it could be useful to see which process creates a ton of handles for
example.

If it's a matter of filling out some fields, I could probably take a look.