Handle Leak finden

[nahpets]

Hallo,

vermutlich weiche ich jetzt vom Thema ab.
Mit dem Process Monitor habe ich mal die Zugriffe auf die Registrierung von meinem "Problemprogramm" aufzeichnen lassen. Hier ein Auszug:

Code:

"16:24:11,4810803","x.exe","1","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName","REPARSE",""
"16:24:11,4810915","x.exe","1","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS",""
"16:24:11,4811071","x.exe","1","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS",""
"16:24:11,4811236","x.exe","1","RegQueryValue","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName",
"SUCCESS","Type: REG_SZ, Length: 24, Data: SERVER02"
"16:24:11,4811345","x.exe","1","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS",""
"16:24:11,4811427","x.exe","1","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS",""
"16:24:11,4813242","x.exe","1","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"16:24:11,4813368","x.exe","1","RegOpenKey","HKCU\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}","NAME NOT FOUND",""
"16:24:11,4813475","x.exe","1","RegOpenKey","HKCR\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}","SUCCESS",""
"16:24:11,4813757","x.exe","1","RegCloseKey","HKCR\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}","SUCCESS",""
"16:24:11,5036595","x.exe","1","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName","REPARSE",""
"16:24:11,5036776","x.exe","1","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS",""
"16:24:11,5036976","x.exe","1","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS",""
"16:24:11,5037137","x.exe","1","RegQueryValue","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName",
"SUCCESS","Type: REG_SZ, Length: 24, Data: SERVER02"
"16:24:11,5037253","x.exe","1","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS",""

Zuerst wird ein Schlüssel ComputerName geöffnet, gelesen und geschlossen. Dann wird eine Abfrage HKCU\Software\Classes gestartet und anschließend wird eine CLSID geöffnet und nicht gefunden. Zu beidem gibt es kein CloseKey.

An anderer Stelle im Protokoll sieht es bei einem RegQueryKey etwas anders aus:

Code:

"12:44:17,6022323","x.exe","1","RegQueryKey","HKCR\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}","SUCCESS","Query: Name"
"12:44:17,6022471","x.exe","1","RegOpenKey","HKCU\Software\Classes\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\TreatAs",
"NAME NOT FOUND",""
"12:44:17,6022594","x.exe","1","RegOpenKey","HKCR\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\TreatAs","NAME NOT FOUND",""
"12:44:17,6022691","x.exe","1","RegCloseKey","HKCR\CLSID\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}","SUCCESS",""

Hier wird abgefragt, erfolglos gelesen und wieder geschlossen.

Wenn ich das Programm nun Stunden laufen lasse, dann nimmt die Zahl der Handles stetig zu. Der Process Explorer zeigt mir zu einem Teil der Handles an, dass sie zum Lesen der Registrierung dienen und zwar zu dem Schlüssel HKCU\Software\Classes, bei dem oben in dem Auszug zu sehen ist, dass das entsprechende RegCloseKey fehlt. Ich habe das ganze Protokoll durchgeschaut und keine Stelle gefunden, an der entsprechende RegCloseKey zu HKCU\Software\Classes auftauchen, so dass ich momentan davon ausgehe, dass mein Problem mit der Zunahme der Handles hier zu suchen ist.

Hat jemand eine Idee, wie ich herausfinden kann, welcher Teil der Software in der Registrierung Schlüssel aus dem Zweig HKCU\Software\Classes liest. Ich selbst lese mit Sicherheit keine Werte aus diesem Bereich.