Software Diagnostics Library

Archive for June 23rd, 2009

Crash Dump Analysis Patterns (Part 85)

Tuesday, June 23rd, 2009

Sometimes we look at a stack trace collection and we see dozens of threads running through some 3rd-party component. We do not normally expect this component to appear or expect only one or two threads running through it. Here is an example from my IE after installing a 3rd-party toolbar that becomes Ubiquitous Component (the component has been renamed not “to awaken a sleeping giant and fill him with a terrible resolve”):

0:087> ~*kc

# 0 Id: 136c.fa0 Suspend: 0 Teb: 7ffdf000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::WaitMessage ieui!WaitMessageEx ieframe!CBrowserFrame::FrameMessagePump ieframe!BrowserThreadProc ieframe!BrowserNewThreadProc ieframe!SHOpenFolderWindow ieframe!IEWinMain iexplore!wWinMain iexplore!_initterm_e kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

1 Id: 136c.12c0 Suspend: 0 Teb: 7ffdc000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects ntdll!TppWaiterpThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

2 Id: 136c.1120 Suspend: 0 Teb: 7ffda000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::xwProcessNL ieui!GetMessageExA ieui!ResourceManager::SharedThreadProc msvcrt!_endthreadex msvcrt!_endthreadex kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

3 Id: 136c.1588 Suspend: 0 Teb: 7ffd9000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

4 Id: 136c.15a4 Suspend: 0 Teb: 7ffd8000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllGetClassObject ToolbarA!ToolBarMain ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

5 Id: 136c.111c Suspend: 0 Teb: 7ffd6000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForWorkViaWorkerFactory ntdll!TppWorkerThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

6 Id: 136c.10a8 Suspend: 0 Teb: 7ffd5000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllGetClassObject ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

7 Id: 136c.fb0 Suspend: 0 Teb: 7ffd3000 Unfrozen

8 Id: 136c.1728 Suspend: 0 Teb: 7ffae000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

9 Id: 136c.918 Suspend: 0 Teb: 7ffad000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

10 Id: 136c.11c4 Suspend: 0 Teb: 7ffd4000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject mswsock!SockWaitForSingleObject mswsock!WSPSelect ws2_32!select wininet!ICAsyncThread::SelectThread wininet!ICAsyncThread::SelectThreadWrapper kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

11 Id: 136c.13bc Suspend: 0 Teb: 7ffa8000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllGetClassObject ToolbarA!ToolBarMain ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

12 Id: 136c.178 Suspend: 0 Teb: 7ffab000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserGetMessage user32!GetMessageA winmm!mciwindow kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

13 Id: 136c.1594 Suspend: 0 Teb: 7ffa9000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx wdmaud!CWorker::_ThreadProc wdmaud!CWorker::_StaticThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

14 Id: 136c.b50 Suspend: 0 Teb: 7ffa0000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

15 Id: 136c.eec Suspend: 0 Teb: 7ff9e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

16 Id: 136c.664 Suspend: 0 Teb: 7ff9d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

17 Id: 136c.2cc Suspend: 0 Teb: 7ff9b000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

18 Id: 136c.e00 Suspend: 0 Teb: 7ff9c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject mshtml!CTimerMan::ThreadExec mshtml!CExecFT::ThreadProc mshtml!CExecFT::StaticThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

19 Id: 136c.620 Suspend: 0 Teb: 7ff95000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

20 Id: 136c.1158 Suspend: 0 Teb: 7ff91000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

21 Id: 136c.10cc Suspend: 0 Teb: 7ff90000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

22 Id: 136c.1264 Suspend: 0 Teb: 7ff8f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

23 Id: 136c.13fc Suspend: 0 Teb: 7ffde000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

24 Id: 136c.914 Suspend: 0 Teb: 7ffdb000 Unfrozen

25 Id: 136c.1194 Suspend: 0 Teb: 7ffac000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

26 Id: 136c.1548 Suspend: 0 Teb: 7ffa6000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

27 Id: 136c.a00 Suspend: 0 Teb: 7ff99000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

28 Id: 136c.1360 Suspend: 0 Teb: 7ff97000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

29 Id: 136c.dc0 Suspend: 0 Teb: 7ff96000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

30 Id: 136c.a80 Suspend: 0 Teb: 7ff94000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

31 Id: 136c.1390 Suspend: 0 Teb: 7ffa1000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. Flash10b!DllUnregisterServer ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

32 Id: 136c.123c Suspend: 0 Teb: 7ff9f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. Flash10b!DllUnregisterServer ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

33 Id: 136c.1398 Suspend: 0 Teb: 7ff82000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects winmm!timeThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

34 Id: 136c.ca0 Suspend: 0 Teb: 7ff7d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::WaitMessage ieui!WaitMessageEx ieframe!CBrowserFrame::FrameMessagePump ieframe!BrowserThreadProc ieframe!BrowserNewThreadProc ieframe!SHOpenFolderWindow kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

35 Id: 136c.135c Suspend: 0 Teb: 7ff7c000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

36 Id: 136c.c34 Suspend: 0 Teb: 7ff7b000 Unfrozen

37 Id: 136c.a08 Suspend: 0 Teb: 7ff7a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

38 Id: 136c.1108 Suspend: 0 Teb: 7ff79000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

39 Id: 136c.c20 Suspend: 0 Teb: 7ff77000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

40 Id: 136c.e48 Suspend: 0 Teb: 7ff74000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

41 Id: 136c.298 Suspend: 0 Teb: 7ff73000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

42 Id: 136c.11c8 Suspend: 0 Teb: 7ff72000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

43 Id: 136c.1180 Suspend: 0 Teb: 7ff68000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

44 Id: 136c.1750 Suspend: 0 Teb: 7ff66000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

45 Id: 136c.16d8 Suspend: 0 Teb: 7ff65000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

46 Id: 136c.15b8 Suspend: 0 Teb: 7ff64000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

47 Id: 136c.b88 Suspend: 0 Teb: 7ff6f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

48 Id: 136c.434 Suspend: 0 Teb: 7ff6e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

49 Id: 136c.16e8 Suspend: 0 Teb: 7ff6d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

50 Id: 136c.f04 Suspend: 0 Teb: 7ff6c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

51 Id: 136c.128c Suspend: 0 Teb: 7ff67000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

52 Id: 136c.1074 Suspend: 0 Teb: 7ff63000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

53 Id: 136c.2dc Suspend: 0 Teb: 7ff62000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

54 Id: 136c.172c Suspend: 0 Teb: 7ff60000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

55 Id: 136c.1240 Suspend: 0 Teb: 7ff69000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

56 Id: 136c.1604 Suspend: 0 Teb: 7ff61000 Unfrozen

57 Id: 136c.6a4 Suspend: 0 Teb: 7ff5f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

58 Id: 136c.1258 Suspend: 0 Teb: 7ff5e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

59 Id: 136c.8c0 Suspend: 0 Teb: 7ff5b000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

60 Id: 136c.868 Suspend: 0 Teb: 7ff58000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

61 Id: 136c.a54 Suspend: 0 Teb: 7ff57000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

62 Id: 136c.77c Suspend: 0 Teb: 7ff56000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

63 Id: 136c.1290 Suspend: 0 Teb: 7ff59000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

64 Id: 136c.1480 Suspend: 0 Teb: 7ff55000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

65 Id: 136c.1270 Suspend: 0 Teb: 7ff54000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

66 Id: 136c.b8c Suspend: 0 Teb: 7ff53000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

67 Id: 136c.167c Suspend: 0 Teb: 7ff92000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

68 Id: 136c.176c Suspend: 0 Teb: 7ff8e000 Unfrozen

69 Id: 136c.80c Suspend: 0 Teb: 7ff8b000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

70 Id: 136c.1570 Suspend: 0 Teb: 7ff8a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

71 Id: 136c.e74 Suspend: 0 Teb: 7ff78000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

72 Id: 136c.1490 Suspend: 0 Teb: 7ff76000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

73 Id: 136c.d28 Suspend: 0 Teb: 7ff6a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

74 Id: 136c.8d8 Suspend: 0 Teb: 7ff5c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

75 Id: 136c.1064 Suspend: 0 Teb: 7ff4a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

76 Id: 136c.1478 Suspend: 0 Teb: 7ff47000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

77 Id: 136c.1470 Suspend: 0 Teb: 7ff44000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

78 Id: 136c.aa0 Suspend: 0 Teb: 7ff43000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

79 Id: 136c.1210 Suspend: 0 Teb: 7ff48000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

80 Id: 136c.954 Suspend: 0 Teb: 7ff46000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

81 Id: 136c.9d4 Suspend: 0 Teb: 7ff45000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

82 Id: 136c.f30 Suspend: 0 Teb: 7ff42000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

83 Id: 136c.cc4 Suspend: 0 Teb: 7ff34000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

84 Id: 136c.1018 Suspend: 0 Teb: 7ff33000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

85 Id: 136c.940 Suspend: 0 Teb: 7ff32000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

86 Id: 136c.bd8 Suspend: 0 Teb: 7ff31000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

87 Id: 136c.1714 Suspend: 0 Teb: 7ff84000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage user32!DialogBox2 user32!InternalDialogBox user32!SoftModalMessageBox user32!MessageBoxWorker user32!MessageBoxTimeoutW user32!MessageBoxTimeoutA user32!MessageBoxExA ieframe!Detour_MessageBoxExA user32!MessageBoxA WARNING: Stack unwind information not available. Following frames may be wrong. MathMLMimer!DllUnregisterServer MathMLMimer!DllUnregisterServer MathMLMimer!DllUnregisterServer

88 Id: 136c.1744 Suspend: 0 Teb: 7ff83000 Unfrozen

89 Id: 136c.9cc Suspend: 0 Teb: 7ff81000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

90 Id: 136c.f68 Suspend: 0 Teb: 7ff5a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

91 Id: 136c.17f4 Suspend: 0 Teb: 7ff49000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

92 Id: 136c.13c Suspend: 0 Teb: 7ff41000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

93 Id: 136c.110 Suspend: 0 Teb: 7ff3f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

94 Id: 136c.8e4 Suspend: 0 Teb: 7ff3e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

95 Id: 136c.fcc Suspend: 0 Teb: 7ff4c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::WaitMessage ieui!WaitMessageEx ieframe!CBrowserFrame::FrameMessagePump ieframe!BrowserThreadProc ieframe!BrowserNewThreadProc ieframe!SHOpenFolderWindow kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

96 Id: 136c.1378 Suspend: 0 Teb: 7ff4b000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

97 Id: 136c.8ec Suspend: 0 Teb: 7ff40000 Unfrozen

98 Id: 136c.ac Suspend: 0 Teb: 7ff3d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

99 Id: 136c.79c Suspend: 0 Teb: 7ff3c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

100 Id: 136c.bd0 Suspend: 0 Teb: 7ff3a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects msiltcfg!WorkerThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

101 Id: 136c.1504 Suspend: 0 Teb: 7ff36000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

102 Id: 136c.5c0 Suspend: 0 Teb: 7ff35000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

103 Id: 136c.17a0 Suspend: 0 Teb: 7ff2d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

104 Id: 136c.17c4 Suspend: 0 Teb: 7ff2c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

105 Id: 136c.f08 Suspend: 0 Teb: 7ffaa000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

106 Id: 136c.1268 Suspend: 0 Teb: 7ff28000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

107 Id: 136c.12c8 Suspend: 0 Teb: 7ff27000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

108 Id: 136c.1634 Suspend: 0 Teb: 7ff26000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

109 Id: 136c.120c Suspend: 0 Teb: 7ff21000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

110 Id: 136c.13f4 Suspend: 0 Teb: 7ff20000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

111 Id: 136c.1494 Suspend: 0 Teb: 7ff1f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

112 Id: 136c.16ec Suspend: 0 Teb: 7ff1e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

113 Id: 136c.d68 Suspend: 0 Teb: 7ffa4000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus rpcrt4!COMMON_ProcessCalls rpcrt4!LOADABLE_TRANSPORT::ProcessIOEvents rpcrt4!ProcessIOEventsWrapper rpcrt4!BaseCachedThreadRoutine rpcrt4!ThreadStartRoutine kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

114 Id: 136c.5fc Suspend: 0 Teb: 7ffdd000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForWorkViaWorkerFactory ntdll!TppWorkerThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

In contrast, Flash10b module (shown in magenta above) is not ubiquitous, it is present on just 2 threads.

- Dmitry Vostokov @ DumpAnalysis.org -

Posted in Crash Dump Analysis, Crash Dump Patterns | 2 Comments »

Dictionary of Debugging: Hang

Tuesday, June 23rd, 2009

This is the first draft entry for the forthcoming Dictionary of Debugging (ISBN: 978-1906717353). The entry format is not final and more information will be added to individual entries in the future.

Hang

The perceived absence of response from a present program, service or system, either visual or functional.

References: Hangs explained, The difference between crashes and hangs explained

Synonyms: freeze, stop, halt.

Antonyms: live.

Similar: sluggish.

Also: crash.

- Dmitry Vostokov @ DumpAnalysis.org -

Posted in Crash Dump Analysis, Debugging, Dictionary of Debugging, H | 2 Comments »

Archive for June 23rd, 2009

Crash Dump Analysis Patterns (Part 85)

Dictionary of Debugging: Hang

Pages

Recent Comments

Categories

Archives

ARM64

Automated Analysis

Blogroll

Debugging Channels

Forensics

Hardware

Linux

Mac OS X

Magazines and Newspapers

Malware Analysis

Medical Diagnostics

Narratology

Related Links

Reversing

Scripting Languages

Source Code

Tracing Tools

Meta

June 2009
M	T	W	T	F	S	S
« May				Jul »
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30