Blocked LPC thread, coupled processes, stack trace collection and blocked GUI thread: pattern cooperation

This small case study continues where Not using checklists common mistake case study left, after identifying the blocked LPC thread in ServiceA process. We know that ServiceA always asks (coupled with) ServiceB and, indeed, when looking at the latter stack trace collection we see a GUI thread showing a dialog box:

0:000> ~13kc

ntdll!KiFastSystemCallRet
USER32!NtUserWaitMessage
USER32!InternalDialogBox
USER32!DialogBoxIndirectParamAorW
USER32!DialogBoxIndirectParamW
comdlg32!NewGetFileName
comdlg32!NewGetSaveFileName
comdlg32!GetFileName
comdlg32!GetSaveFileNameW
WARNING: Stack unwind information not available. Following frames may be wrong.
DllA!DllEntryPoint
ServiceB!Initialize
[…]
ServiceB!ServiceThread
kernel32!BaseThreadStart

From function names we can infer that the thread was displaying a “Save File As” common dialog box but the service was not allowed to interact with a desktop. This made the service blocked and, in return, made ServiceA blocked too. The suggestion was to enable ServiceB to interact with the desktop and keep an eye on DllA.

- Dmitry Vostokov @ DumpAnalysis.org -

Leave a Reply

You must be logged in to post a comment.