Comments on: Crash Dump Analysis Patterns (Part 51) https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Thu, 07 May 2026 11:01:35 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-731348 Dmitry Vostokov Thu, 21 Mar 2013 11:49:03 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-731348 Another example from terminal services: 0: kd> kc *** Stack trace for last set context - .thread/.cxr resets it Call Site nt!KiSwapContext nt!KiCommitThreadWait nt!KeWaitForMultipleObjects nt!ObpWaitForMultipleObjects nt!NtWaitForMultipleObjects nt!KiSystemServiceCopyEnd ntdll!ZwWaitForMultipleObjects KERNELBASE!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects lsm!CTSSession::ShowMessageBox lsm!RpcShowMessageBox RPCRT4!Invoke RPCRT4!Ndr64StubWorker RPCRT4!NdrServerCallAll RPCRT4!DispatchToStubInCNoAvrf RPCRT4!RPC_INTERFACE::DispatchToStubWorker RPCRT4!LRPC_SCALL::DispatchRequest RPCRT4!LRPC_SCALL::HandleRequest RPCRT4!LRPC_ADDRESS::ProcessIO RPCRT4!LrpcIoComplete ntdll!TppAlpcpExecuteCallback ntdll!TppWorkerThread kernel32!BaseThreadInitThunk ntdll!RtlUserThreadStart Another example from terminal services:

0: kd> kc
*** Stack trace for last set context - .thread/.cxr resets it
Call Site
nt!KiSwapContext
nt!KiCommitThreadWait
nt!KeWaitForMultipleObjects
nt!ObpWaitForMultipleObjects
nt!NtWaitForMultipleObjects
nt!KiSystemServiceCopyEnd
ntdll!ZwWaitForMultipleObjects
KERNELBASE!WaitForMultipleObjectsEx
kernel32!WaitForMultipleObjects
lsm!CTSSession::ShowMessageBox
lsm!RpcShowMessageBox
RPCRT4!Invoke
RPCRT4!Ndr64StubWorker
RPCRT4!NdrServerCallAll
RPCRT4!DispatchToStubInCNoAvrf
RPCRT4!RPC_INTERFACE::DispatchToStubWorker
RPCRT4!LRPC_SCALL::DispatchRequest
RPCRT4!LRPC_SCALL::HandleRequest
RPCRT4!LRPC_ADDRESS::ProcessIO
RPCRT4!LrpcIoComplete
ntdll!TppAlpcpExecuteCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 84) https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-205699 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 84) Mon, 22 Nov 2010 15:57:37 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-205699 [...] Debugging Experts Magazine Online Today we introduce an icon for Message Box pattern: [...] […] Debugging Experts Magazine Online Today we introduce an icon for Message Box pattern: […]

]]> By: Crash Dump Analysis » Blog Archive » Coupled processes, wait chains, message box, waiting thread time, paged out data, incorrect stack trace, hidden exception, unknown component and execution residue: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-175795 Crash Dump Analysis » Blog Archive » Coupled processes, wait chains, message box, waiting thread time, paged out data, incorrect stack trace, hidden exception, unknown component and execution residue: pattern cooperation Fri, 13 Aug 2010 19:09:04 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-175795 [...] We follow an LPC wait chain and see a thread blocked by a message box: [...] […] We follow an LPC wait chain and see a thread blocked by a message box: […]

]]> By: Crash Dump Analysis » Blog Archive » Strong process coupling, stack trace collection, critical section coruption and wait chains, message box, self-diagnosis and hidden exception and dynamic memory corruption: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-147472 Crash Dump Analysis » Blog Archive » Strong process coupling, stack trace collection, critical section coruption and wait chains, message box, self-diagnosis and hidden exception and dynamic memory corruption: pattern cooperation Mon, 26 Apr 2010 19:59:41 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-147472 [...] thread #22 is blocked waiting for the message box but it also owns the critical section 00080608 we have seen above and the thread blocks 4 other [...] […] thread #22 is blocked waiting for the message box but it also owns the critical section 00080608 we have seen above and the thread blocks 4 other […]

]]> By: Crash Dump Analysis » Blog Archive » Native Script Debugging https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-120938 Crash Dump Analysis » Blog Archive » Native Script Debugging Mon, 01 Feb 2010 21:52:45 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-120938 [...] navigation. In the failed WinDbg instance that had just started we see only one thread showing Message Box [...] […] navigation. In the failed WinDbg instance that had just started we see only one thread showing Message Box […]

]]> By: Software Generalist » Blog Archive » Reading Notebook: 16-November-09 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-104810 Software Generalist » Blog Archive » Reading Notebook: 16-November-09 Mon, 16 Nov 2009 16:03:09 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-104810 [...] Hung non-interactive services waiting for user input (p. 298) - this partially inspired Message Box crash dump analysis pattern: http://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/ [...] […] Hung non-interactive services waiting for user input (p. 298) - this partially inspired Message Box crash dump analysis pattern: http://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/ […]

]]> By: Crash Dump Analysis » Blog Archive » ALPC wait chain, missing threads, message box, zombie and special processes: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-94802 Crash Dump Analysis » Blog Archive » ALPC wait chain, missing threads, message box, zombie and special processes: pattern cooperation Fri, 18 Sep 2009 14:27:33 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-94802 [...] to be non-interactive have threads that wait for UI messages and therefore could be potential message or dialog box threads waiting for a dismissal and blocking other [...] […] to be non-interactive have threads that wait for UI messages and therefore could be potential message or dialog box threads waiting for a dismissal and blocking other […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-82898 Dmitry Vostokov Sat, 04 Jul 2009 19:32:31 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-82898 Another similar example is a service thread that opens a dialog but the service is not allowed to interact with the desktop. This effectively blocks the thread and potentially other threads if the blocked thread owns synchronization objects. Another similar example is a service thread that opens a dialog but the service is not allowed to interact with the desktop. This effectively blocks the thread and potentially other threads if the blocked thread owns synchronization objects.

]]> By: Crash Dump Analysis » Blog Archive » Stack trace collection, message box, hidden exception, nested offender, insufficient memory, C++ exception, heap leak and ubiquitous component: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-81080 Crash Dump Analysis » Blog Archive » Stack trace collection, message box, hidden exception, nested offender, insufficient memory, C++ exception, heap leak and ubiquitous component: pattern cooperation Thu, 25 Jun 2009 00:20:46 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-81080 [...] when browsing through stack trace collection I could spot a thread blocked by a message box, find another hidden exception and from it see the real nested offender that experienced [...] […] when browsing through stack trace collection I could spot a thread blocked by a message box, find another hidden exception and from it see the real nested offender that experienced […]

]]> By: Crash Dump Analysis » Blog Archive » Message box and self-diagnosis: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-70303 Crash Dump Analysis » Blog Archive » Message box and self-diagnosis: pattern cooperation Fri, 03 Apr 2009 16:55:17 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/19/crash-dump-analysis-patterns-part-51/#comment-70303 [...] critical sections reveals the one thread blocking 32 other threads. The owner stack trace points to Message Box [...] […] critical sections reveals the one thread blocking 32 other threads. The owner stack trace points to Message Box […]

]]>