Comments on: Crash Dump Analysis Patterns (Part 53) https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Sun, 17 May 2026 22:46:03 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-481065 Dmitry Vostokov Mon, 28 May 2012 22:12:52 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-481065 Another example of the blocked thread on a uniprocessor VM: kd> !running System Processors: (00000001) Idle Processors: (00000000) Prcbs Current Next 0 82944d20 85a575c0 ................ <p align="left">kd> !thread THREAD 85a575c0 Cid 0004.00e0 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0 Not impersonating DeviceMap 8a209d68 Owning Process 8523e660 Image: System Attached Process N/A Image: N/A Wait Start TickCount 4392621 Ticks: 0 Context Switch Count 414195 UserTime 00:00:00.000 KernelTime 17:59:14.739 Win32 Start Address DriverA (0x8900ab4e) Stack Init 8d1c0fd0 Current 8d1c0950 Base 8d1c1000 Limit 8d1be000 Call 0 Priority 16 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 ChildEBP RetAddr Args to Child 8d1c0c48 82c34117 ffd090f0 85a32008 85a5a000 nt!READ_REGISTER_ULONG+0x6 (FPO: [1,0,0]) 8d1c0c68 82c347a1 8d1c0c84 82c38b53 8d1c0c7c hal!HalpHpetQueryCount+0x4b (FPO: [Non-Fpo]) 8d1c0c70 82c38b53 8d1c0c7c 00da7a64 00000000 hal!HalpHpetQueryPerformanceCounter+0x1d (FPO: [Non-Fpo]) 8d1c0c84 89007e52 8d1c0cbc 85a5a0d0 85a5a000 hal!KeQueryPerformanceCounter+0x3d (FPO: [Non-Fpo]) WARNING: Stack unwind information not available. Following frames may be wrong. 8d1c0ce4 89007938 85a5a000 00000000 85a5a000 DriverA+0x7e52 8d1c0cf8 8900ae9a 85a5a000 00000000 00000000 DriverA+0x7938 8d1c0d50 82a23056 85a32008 a9492f18 00000000 DriverA+0xae9a 8d1c0d90 828cb1a9 8900ab4e 85a5a000 00000000 nt!PspSystemThreadStartup+0x9e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19 <p align="left">kd> !ready Processor 0: Ready Threads at priority 15 THREAD 861a2590 Cid 0460.0464 Teb: 7ffdf000 Win32Thread: fe9dbb18 ???? THREAD 853cac98 Cid 0460.0670 Teb: 7ffd6000 Win32Thread: 00000000 ???? THREAD 852fda88 Cid 0004.0084 Teb: 00000000 Win32Thread: 00000000 ???? THREAD 8534ad48 Cid 0004.0090 Teb: 00000000 Win32Thread: 00000000 ???? THREAD 852f1d48 Cid 0004.0080 Teb: 00000000 Win32Thread: 00000000 ???? THREAD 852fd4f0 Cid 0004.0088 Teb: 00000000 Win32Thread: 00000000 ???? THREAD 85340020 Cid 0004.008c Teb: 00000000 Win32Thread: 00000000 ???? THREAD 852e67c8 Cid 0004.0078 Teb: 00000000 Win32Thread: 00000000 ???? THREAD 85de77a8 Cid 01e4.026c Teb: 7ffda000 Win32Thread: ffb2c008 ???? THREAD 85da7d48 Cid 01e4.0234 Teb: 7ffdf000 Win32Thread: ffad0d38 ???? THREAD 85a7c678 Cid 0004.00f0 Teb: 00000000 Win32Thread: 00000000 ???? [...] Another example of the blocked thread on a uniprocessor VM:

kd> !running

System Processors: (00000001)
Idle Processors: (00000000)

Prcbs Current Next
0 82944d20 85a575c0 …………….

kd> !thread
THREAD 85a575c0 Cid 0004.00e0 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap 8a209d68
Owning Process 8523e660 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 4392621 Ticks: 0
Context Switch Count 414195
UserTime 00:00:00.000
KernelTime 17:59:14.739
Win32 Start Address DriverA (0×8900ab4e)
Stack Init 8d1c0fd0 Current 8d1c0950 Base 8d1c1000 Limit 8d1be000 Call 0
Priority 16 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child
8d1c0c48 82c34117 ffd090f0 85a32008 85a5a000 nt!READ_REGISTER_ULONG+0×6 (FPO: [1,0,0])
8d1c0c68 82c347a1 8d1c0c84 82c38b53 8d1c0c7c hal!HalpHpetQueryCount+0×4b (FPO: [Non-Fpo])
8d1c0c70 82c38b53 8d1c0c7c 00da7a64 00000000 hal!HalpHpetQueryPerformanceCounter+0×1d (FPO: [Non-Fpo])
8d1c0c84 89007e52 8d1c0cbc 85a5a0d0 85a5a000 hal!KeQueryPerformanceCounter+0×3d (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
8d1c0ce4 89007938 85a5a000 00000000 85a5a000 DriverA+0×7e52
8d1c0cf8 8900ae9a 85a5a000 00000000 00000000 DriverA+0×7938
8d1c0d50 82a23056 85a32008 a9492f18 00000000 DriverA+0xae9a
8d1c0d90 828cb1a9 8900ab4e 85a5a000 00000000 nt!PspSystemThreadStartup+0×9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0×19

kd> !ready
Processor 0: Ready Threads at priority 15
THREAD 861a2590 Cid 0460.0464 Teb: 7ffdf000 Win32Thread: fe9dbb18 ????
THREAD 853cac98 Cid 0460.0670 Teb: 7ffd6000 Win32Thread: 00000000 ????
THREAD 852fda88 Cid 0004.0084 Teb: 00000000 Win32Thread: 00000000 ????
THREAD 8534ad48 Cid 0004.0090 Teb: 00000000 Win32Thread: 00000000 ????
THREAD 852f1d48 Cid 0004.0080 Teb: 00000000 Win32Thread: 00000000 ????
THREAD 852fd4f0 Cid 0004.0088 Teb: 00000000 Win32Thread: 00000000 ????
THREAD 85340020 Cid 0004.008c Teb: 00000000 Win32Thread: 00000000 ????
THREAD 852e67c8 Cid 0004.0078 Teb: 00000000 Win32Thread: 00000000 ????
THREAD 85de77a8 Cid 01e4.026c Teb: 7ffda000 Win32Thread: ffb2c008 ????
THREAD 85da7d48 Cid 01e4.0234 Teb: 7ffdf000 Win32Thread: ffad0d38 ????
THREAD 85a7c678 Cid 0004.00f0 Teb: 00000000 Win32Thread: 00000000 ????
[…]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 53b) https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-166757 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 53b) Wed, 14 Jul 2010 15:31:01 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-166757 [...] is a specialization of Blocked Thread pattern where a thread is waiting for a hardware I/O response. For example, a frozen system [...] […] is a specialization of Blocked Thread pattern where a thread is waiting for a hardware I/O response. For example, a frozen system […]

]]> By: Crash Dump Analysis » Blog Archive » WOW64, blocked threads and coupled processes: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-99936 Crash Dump Analysis » Blog Archive » WOW64, blocked threads and coupled processes: pattern cooperation Tue, 20 Oct 2009 20:13:03 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-99936 [...] see that the main threads is blocked by sending a synchronous message via SendMessage Win32 API function call. The first argument to it [...] […] see that the main threads is blocked by sending a synchronous message via SendMessage Win32 API function call. The first argument to it […]

]]> By: Crash Dump Analysis » Blog Archive » Critical section high contention and wait chains, blocked threads, and periodic error: memory dump and trace analysis pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-98234 Crash Dump Analysis » Blog Archive » Critical section high contention and wait chains, blocked threads, and periodic error: memory dump and trace analysis pattern cooperation Fri, 09 Oct 2009 14:32:24 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-98234 [...] thread 86396db0 (TID 1c64) that blocked more than 50 threads (0×34) was blocked itself sleeping for more than 6 [...] […] thread 86396db0 (TID 1c64) that blocked more than 50 threads (0×34) was blocked itself sleeping for more than 6 […]

]]> By: Crash Dump Analysis » Blog Archive » Stack trace collection, suspended threads, not my version, special process, main thread and blocked LPC chain threads: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-97393 Crash Dump Analysis » Blog Archive » Stack trace collection, suspended threads, not my version, special process, main thread and blocked LPC chain threads: pattern cooperation Sat, 03 Oct 2009 22:05:22 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-97393 [...] follow LPC chain to csrss.exe to find out another blocked thread [...] […] follow LPC chain to csrss.exe to find out another blocked thread […]

]]> By: Crash Dump Analysis » Blog Archive » Inconsistent dump, blocked threads, wait chains, incorrect stack trace and process factory: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-78525 Crash Dump Analysis » Blog Archive » Inconsistent dump, blocked threads, wait chains, incorrect stack trace and process factory: pattern cooperation Tue, 09 Jun 2009 22:11:38 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-78525 [...] cases I often dump all processes and threads to look for anomalies and indeed we find plenty of blocked threads in several services. For example, ServiceA.exe has blocked threads waiting for critical sections [...] […] cases I often dump all processes and threads to look for anomalies and indeed we find plenty of blocked threads in several services. For example, ServiceA.exe has blocked threads waiting for critical sections […]

]]> By: Crash Dump Analysis » Blog Archive » Main blocked thread, missing component, execution residue and data contents locality: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-78298 Crash Dump Analysis » Blog Archive » Main blocked thread, missing component, execution residue and data contents locality: pattern cooperation Mon, 08 Jun 2009 16:35:34 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-78298 [...] monitor saved the process memory dump with the following stack trace of the main thread that was blocked by raising a [...] […] monitor saved the process memory dump with the following stack trace of the main thread that was blocked by raising a […]

]]> By: Crash Dump Analysis » Blog Archive » Stack trace collection, blocked threads, pass through functions and main thread: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-73784 Crash Dump Analysis » Blog Archive » Stack trace collection, blocked threads, pass through functions and main thread: pattern cooperation Fri, 08 May 2009 14:07:20 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-73784 [...] command detailed output of thread stacks showed that all these suspicious threads were in fact blocked when loading a [...] […] command detailed output of thread stacks showed that all these suspicious threads were in fact blocked when loading a […]

]]> By: Crash Dump Analysis » Blog Archive » Blocked thread, historical information, execution residue, hidden exception, dynamic memory corruption, incorrect stack trace and not my version: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-71973 Crash Dump Analysis » Blog Archive » Blocked thread, historical information, execution residue, hidden exception, dynamic memory corruption, incorrect stack trace and not my version: pattern cooperation Thu, 23 Apr 2009 20:59:53 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-71973 [...] One application was hanging after printing and its user dump was taken. Inspection of threads reveals only one blocked thread: [...] […] One application was hanging after printing and its user dump was taken. Inspection of threads reveals only one blocked thread: […]

]]> By: Crash Dump Analysis » Blog Archive » Manual dump, wait chain, blocked thread, dynamic memory corruption and historical information: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-68190 Crash Dump Analysis » Blog Archive » Manual dump, wait chain, blocked thread, dynamic memory corruption and historical information: pattern cooperation Sat, 14 Mar 2009 07:37:58 +0000 https://www.dumpanalysis.org/blog/index.php/2008/02/27/crash-dump-analysis-patterns-part-53/#comment-68190 [...] #20 is waiting for the critical section 00370608 owned by the thread #17. The latter thread is blockedin an unhandled exception filter raising a hard error message box. Applying the new exception [...] […] #20 is waiting for the critical section 00370608 owned by the thread #17. The latter thread is blockedin an unhandled exception filter raising a hard error message box. Applying the new exception […]

]]>