任何人都知道使用!obtrace时找到丢失的取消引用的更简单方法?
Windbg中的示例输出是:
kd> !obtrace 0xfa96f700
Object: fa96f700 Image: cmd.exe
Sequence (+/-) Stack
-------- ----- ---------------------------------------------------
2421d +1 nt!ObCreateObject+180
nt!NtCreateEvent+92
nt!KiFastCallEntry+104
nt!ZwCreateEvent+11
win32k!UserThreadCallout+6f
win32k!W32pThreadCallout+38
nt!PsConvertToGuiThread+174
nt!KiBBTUnexpectedRange+c
2421e -1 nt!ObfDereferenceObject+19
nt!NtCreateEvent+d4
nt!KiFastCallEntry+104
nt!ZwCreateEvent+11
win32k!UserThreadCallout+6f
win32k!W32pThreadCallout+38
nt!PsConvertToGuiThread+174
nt!KiBBTUnexpectedRange+c
2421f +1 nt!ObReferenceObjectByHandle+1c3
win32k!xxxCreateThreadInfo+37d
win32k!UserThreadCallout+6f
win32k!W32pThreadCallout+38
nt!PsConvertToGuiThread+174
nt!KiBBTUnexpectedRange+c
24220 +1 nt!ObReferenceObjectByHandle+1c3
win32k!ProtectHandle+22
win32k!xxxCreateThreadInfo+3a0
win32k!UserThreadCallout+6f
win32k!W32pThreadCallout+38
nt!PsConvertToGuiThread+174
nt!KiBBTUnexpectedRange+c
24221 -1 nt!ObfDereferenceObject+19
win32k!xxxCreateThreadInfo+3a0
win32k!UserThreadCallout+6f
win32k!W32pThreadCallout+38
nt!PsConvertToGuiThread+174
nt!KiBBTUnexpectedRange+c
---- ----------------------------------------------------------
References: 3, Dereferences 2
如果有数以千计的引用,则几乎不可能找到缺少的解引用。