Do I need a WOW64 dump for GDI Handle analysis?
<p>I'm debugging a potential GDI Handle Leak. Thanks to <a href="https://stackoverflow.com/users/235660/alois-kraus">@Alois Kraus</a>, there is a <a href="https://stackoverflow.com/a/38049572/480982">WinDbg script</a> which performs a handle count.</p>

<p>From my debugging sessions, <a href="https://stackoverflow.com/questions/24874027/how-do-i-take-a-good-crash-dump-for-net">especially for .NET</a>, I find that usually, it's better to have 32-bit dumps of 32-bit processes and 64-bit dumps of 64-bit processes.</p>

<p>Unfortunately, with 2 crash dumps I received, the script does not work. Looking deeper into it, I found out that the GdiSharedHandleTable is <code>null</code> in those dumps:</p>

<pre><code>0:000&gt; dt ntdll!_PEB GdiSharedHandleTable @$peb
   +0x094 GdiSharedHandleTable : (null) 
</code></pre>

<p>Now, on <a href="https://aloiskraus.wordpress.com/2016/06/25/show-gdi-handles-by-type-in-windbg/" rel="nofollow noreferrer">his website</a>, Alois mentions</p>

<blockquote>
  <p>Important: If you are running on a 64 bit OS you need to attach the 64-bit Windbg even if you debug a 32-bit application!</p>
</blockquote>

<p>Unfortunately, using 64-bit WinDbg on the 32-bit crash dump does not help. The result is still the same.</p>

<p>Now here's a theory:</p>

<ul>
<li>some DLLs in a 32-bit process are 64 bit DLLs (see Windows Internals 5, Chapter 3, "System mechanisms," page 211)</li>
<li><code>ntdll</code> is one of them (it is loaded twice, in the 64-bit version and the 32-bit version)</li>
<li>While GDI objects are user objects (and not kernel objects), they still need to be painted, etc. by the OS. Therefore it could be required that they are managed in the WOW64 layer</li>
<li>This would mean that I have to have a WOW64 crash dump to make it work</li>
</ul>

<p>So my question is: <strong>do I have the seldom case here that I need a WOW64 crash dump?</strong> A more detailed explanation of my theory would be great. If there's a good explanation in some book already, a reference to the chapter is enough. I'll buy it if I don't have it yet.</p>