Comments on: What is KiFastSystemCallRet? https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Wed, 06 May 2026 02:22:06 +0000 http://wordpress.org/?v=2.3.3 By: Andrew Murray https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-172587 Andrew Murray Mon, 02 Aug 2010 14:52:52 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-172587 I have a stack trace that I took from a dump file which looks very much like the first stack trace in this article: ntdll!KiFastSystemCallRet ntdll!NtReplyWaitReceivePortEx+c rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+198 rpcrt4!RecvLotsaCallsWrapper+d rpcrt4!BaseCachedThreadRoutine+9d rpcrt4!ThreadStartRoutine+1b kernel32!BaseThreadStart+34 This thread is apparently causing a "blocking or leaked critical section" with a thread executing our code waiting on it: ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject+c ntdll!RtlpWaitOnCriticalSection+1a3 ntdll!RtlEnterCriticalSection+a8 odbc32!CCriticalSection::Enter+f odbc32!ODBCEnterCriticalSection+f odbc32!EnterDbcCS+2b odbc32!SQLDisconnect+2d LibRdac!rdacCConnection::Close+21 LibRdac!rdacCConnection::~rdacCConnection+41 RmsSrvc!busiCPooledObject::OnOutputXMLSent+1ac RmsSrvc!busiCPooledObject::~busiCPooledObject+71 RmsAcci!acciCAccessControlInterface::Run+5eea The result is that the process hangs. Can anyone shed any light? I have a stack trace that I took from a dump file which looks very much like the first stack trace in this article:

ntdll!KiFastSystemCallRet
ntdll!NtReplyWaitReceivePortEx+c
rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+198
rpcrt4!RecvLotsaCallsWrapper+d
rpcrt4!BaseCachedThreadRoutine+9d
rpcrt4!ThreadStartRoutine+1b
kernel32!BaseThreadStart+34

This thread is apparently causing a “blocking or leaked critical section” with a thread executing our code waiting on it:

ntdll!KiFastSystemCallRet
ntdll!ZwWaitForSingleObject+c
ntdll!RtlpWaitOnCriticalSection+1a3
ntdll!RtlEnterCriticalSection+a8
odbc32!CCriticalSection::Enter+f
odbc32!ODBCEnterCriticalSection+f
odbc32!EnterDbcCS+2b
odbc32!SQLDisconnect+2d
LibRdac!rdacCConnection::Close+21
LibRdac!rdacCConnection::~rdacCConnection+41
RmsSrvc!busiCPooledObject::OnOutputXMLSent+1ac
RmsSrvc!busiCPooledObject::~busiCPooledObject+71
RmsAcci!acciCAccessControlInterface::Run+5eea

The result is that the process hangs. Can anyone shed any light?

]]> By: Crash Dump Analysis » Blog Archive » Reflecting on 2008 (Part 1) https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-119530 Crash Dump Analysis » Blog Archive » Reflecting on 2008 (Part 1) Wed, 27 Jan 2010 00:46:51 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-119530 [...] provide answers or point to other resources): kifastsystemcallret crash dump analysis crash dump ntdll!kifastsystemcallret vista crash dump time travel debugging dump analysis crash dumps windbg commands memory dump [...] […] provide answers or point to other resources): kifastsystemcallret crash dump analysis crash dump ntdll!kifastsystemcallret vista crash dump time travel debugging dump analysis crash dumps windbg commands memory dump […]

]]> By: Unintended Results » Blog Archive » Malware Tricks I https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-107448 Unintended Results » Blog Archive » Malware Tricks I Wed, 02 Dec 2009 21:57:47 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-107448 [...] basically, we’re jumping to a return only function (see a detailed description of KiFastSystemCallRet) efectively returning into the “some_func” function. The emulators I tested, as in [...] […] basically, we’re jumping to a return only function (see a detailed description of KiFastSystemCallRet) efectively returning into the “some_func” function. The emulators I tested, as in […]

]]> By: Crash Dump Analysis » Blog Archive » The mystery of top hit kifastsystemcallret https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-49429 Crash Dump Analysis » Blog Archive » The mystery of top hit kifastsystemcallret Mon, 03 Nov 2008 13:25:11 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-49429 [...] What is KiFastSystemCallRet? [...] […] What is KiFastSystemCallRet? […]

]]> By: Doug H. https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-34836 Doug H. Sat, 19 Jul 2008 12:07:01 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-34836 Hi, I have an application, "RSLogix5000", that won't shut down (same problem on three different computers running two different builds of the app). The thread that keeps it from shutting down is in a Wait state: WrLpcReply and the thread's stack always shows ntdll.dll!KiFastSystemCallRet . I haven't been able to find out why that hangs the thread and keeps the exe alive yet but was interested in your info and links. Thanks. Bye, dh Hi,

I have an application, “RSLogix5000″, that won’t shut down (same problem on three different computers running two different builds of the app). The thread that keeps it from shutting down is in a Wait state: WrLpcReply and the thread’s stack always shows ntdll.dll!KiFastSystemCallRet . I haven’t been able to find out why that hangs the thread and keeps the exe alive yet but was interested in your info and links. Thanks.

Bye,
dh

]]> By: If broken it is, fix it you should : ntdll!kifastSystemcallret, SharedUserData!SystemCallStub and search engines... https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-26196 If broken it is, fix it you should : ntdll!kifastSystemcallret, SharedUserData!SystemCallStub and search engines... Wed, 07 May 2008 09:31:35 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-26196 [...] paint dry:)  but if you're interested in the details you can read more about it here.  What is interesting though is where you see it, and that is probably what gets people [...] […] paint dry:)  but if you’re interested in the details you can read more about it here.  What is interesting though is where you see it, and that is probably what gets people […]

]]> By: Crash Dump Analysis » Blog Archive » Bugchecks: SYSTEM_SERVICE_EXCEPTION https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-24145 Crash Dump Analysis » Blog Archive » Bugchecks: SYSTEM_SERVICE_EXCEPTION Tue, 22 Apr 2008 12:31:22 +0000 https://www.dumpanalysis.org/blog/index.php/2008/01/10/what-is-kifastsystemcallret/#comment-24145 [...] x64 Windows platforms KiSystemServiceCopyEnd has the similar purpose as KiFastSystemCallRet on x86 [...] […] x64 Windows platforms KiSystemServiceCopyEnd has the similar purpose as KiFastSystemCallRet on x86 […]

]]>