Crash Dump Analysis Patterns (Part 47)
Most of the time threads are not suspended explicitly. If you look at active and waiting threads in kernel and complete memory dumps their SuspendCount member is 0:
THREAD 88951bc8 Cid 03a4.0d24 Teb: 7ffaa000 Win32Thread: 00000000 WAIT: (Unknown) UserMode Non-Alertable
889d6a78 Semaphore Limit 0x7fffffff
88951c40 NotificationTimer
Not impersonating
DeviceMap e1b80b98
Owning Process 888a9d88 Image: svchost.exe
Wait Start TickCount 12669 Ticks: 5442 (0:00:01:25.031)
Context Switch Count 3
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address RPCRT4!ThreadStartRoutine (0x77c4b0f5)
Start Address kernel32!BaseThreadStartThunk (0x7c8217ec)
Stack Init f482f000 Current f482ec0c Base f482f000 Limit f482c000 Call 0
Priority 10 BasePriority 10 PriorityDecrement 0
ChildEBP RetAddr
f482ec24 80833465 nt!KiSwapContext+0x26
f482ec50 80829a62 nt!KiSwapThread+0x2e5
f482ec98 809226bd nt!KeWaitForSingleObject+0x346
f482ed48 8088978c nt!NtReplyWaitReceivePortEx+0x521
f482ed48 7c9485ec nt!KiFastCallEntry+0xfc (TrapFrame @ f482ed64)
00efff84 77c58792 ntdll!KiFastSystemCallRet
00efff8c 77c5872d RPCRT4!RecvLotsaCallsWrapper+0xd
00efffac 77c4b110 RPCRT4!BaseCachedThreadRoutine+0x9d
00efffb8 7c824829 RPCRT4!ThreadStartRoutine+0x1b
00efffec 00000000 kernel32!BaseThreadStart+0x34
5: kd> dt _KTHREAD 88951bc8
ntdll!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListHead : _LIST_ENTRY [ 0x88951bd8 - 0x88951bd8 ]
+0x018 InitialStack : 0xf482f000
+0x01c StackLimit : 0xf482c000
+0x020 KernelStack : 0xf482ec0c
+0x024 ThreadLock : 0
+0x028 ApcState : _KAPC_STATE
...
...
...
+0x14f FreezeCount : 0 ''
+0×150 SuspendCount : 0 ”
…
…
…
You won’t find SuspendCount in reference stack traces. Only when some other thread explicitly suspends another thread the latter has non-zero suspend count. Suspended threads are excluded from thread scheduling and therefore can be considered as blocked. This might be the sign of a debugger present, for example, all threads in a process are suspended when a user debugger is processing a debugger event like a breakpoint or access violation exception. In this case !process 0 ff command output shows SuspendCount value:
THREAD 888b8668 Cid 0ca8.1448 Teb: 00000000 Win32Thread: 00000000 WAIT: (Unknown) KernelMode Non-Alertable
SuspendCount 2
888b87f8 Semaphore Limit 0×2
Not impersonating
DeviceMap e10028e8
Owning Process 898285b0 Image: processA.exe
Wait Start TickCount 13456 Ticks: 4655 (0:00:01:12.734)
Context Switch Count 408
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address driver!DriverThread (0xf6fb8218)
Stack Init f455b000 Current f455a3ac Base f455b000 Limit f4558000 Call 0
Priority 6 BasePriority 6 PriorityDecrement 0
ChildEBP RetAddr
f455a3c4 80833465 nt!KiSwapContext+0×26
f455a3f0 80829a62 nt!KiSwapThread+0×2e5
f455a438 80833178 nt!KeWaitForSingleObject+0×346
f455a450 8082e01f nt!KiSuspendThread+0×18
f455a498 80833480 nt!KiDeliverApc+0×117
f455a4d0 80829a62 nt!KiSwapThread+0×300
f455a518 f6fb7f13 nt!KeWaitForSingleObject+0×346
f455a548 f4edd457 driver!WaitForSingleObject+0×75
f455a55c f4edcdd8 driver!DeviceWaitForRead+0×19
f455ad90 f6fb8265 driver!InputThread+0×17e
f455adac 80949b7c driver!DriverThread+0×4d
f455addc 8088e062 nt!PspSystemThreadStartup+0×2e
00000000 00000000 nt!KiThreadStartup+0×16
5: kd> dt _KTHREAD 888b8668
ntdll!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListHead : _LIST_ENTRY [ 0x888b8678 - 0x888b8678 ]
+0x018 InitialStack : 0xf455b000
+0x01c StackLimit : 0xf4558000
+0x020 KernelStack : 0xf455a3ac
+0x024 ThreadLock : 0
...
...
...
+0x14f FreezeCount : 0 ''
+0×150 SuspendCount : 2 ”
…
…
…
I call this pattern Suspended Thread. It should rise suspicion bar and in some cases coupled with Special Process pattern can lead to immediate problem identification.
- Dmitry Vostokov @ DumpAnalysis.org -
August 11th, 2009 at 3:09 pm
[…] reported that one server was hanging during automated reboot. Stack trace collection shows a few suspended and frozen threads. They all belong to the same […]
November 24th, 2009 at 12:35 am
[…] but references to it exist or there are any missing threads or components inside it, any suspended threads and special processes like a postmortem debugger. We shouldn’t also forget about service […]
October 11th, 2010 at 8:04 pm
[…] Experts Magazine Online Today we introduce an icon for Suspended Thread […]
August 22nd, 2020 at 2:58 pm
Suspended Threads in user crash dumps with Exception Stack Traces may point to the previously Active Threads suspended during exception processing (if Blocked Threads are not suspended).