Archive for March 31st, 2009

!cs vs. !ntsdexts.locks

Tuesday, March 31st, 2009

The latest WinDbg 6.11.0001.404 has broken !ntsdexts.locks command (simply !locks in user dumps). I noticed that some time ago and switched to !cs command which works in user and complete memory dumps. I now like it more than !locks because the following command parameters give stack traces for critical section owners:

!cs -l -o -s

The following recent cases studies use !cs command:

Blocked threads, message box and self-diagnosis

Manual dump, wait chain, blocked thread, dynamic memory corruption and historical information: pattern cooperation

Coupled processes, wait chains, message box, waiting thread time, paged out data, incorrect stack trace, hidden exception, unknown component and execution residue: pattern cooperation

Easy to remember mnemonic is cslos: critical sections locked with stacks

This command is also featured on the back cover of March Debugged! magazine issue.

- Dmitry Vostokov @ DumpAnalysis.org -

Posted in Crash Dump Analysis, Debugging, WinDbg Tips and Tricks | 1 Comment »