Crash Dump Analysis Patterns (Part 154a)
When analyzing memory dumps from specific application platforms we see threads having definite purpose as part of that specific platform architecture, design and implementation. For example, in applications and services involving .NET CLR we see the following Special Threads:
0:000> !Threads -special
ThreadCount: 9
UnstartedThread: 0
BackgroundThread: 7
PendingThread: 0
DeadThread: 1
Hosted Runtime: no
PreEmptive GC Alloc Lock
ID OSID ThreadOBJ State GC Context Domain Count APT Exception
0 1 b10 002fbe88 6020 Enabled 0acbdebc:0acbf5a4 002f17d0 0 STA
2 2 bf0 00306b18 b220 Enabled 00000000:00000000 002f17d0 0 MTA (Finalizer)
3 3 b34 0034c188 b220 Enabled 00000000:00000000 002f17d0 0 MTA
XXXX 5 0037e3e0 19820 Enabled 00000000:00000000 002f17d0 0 Ukn
5 7 700 04b606c8 200b220 Enabled 00000000:00000000 002f17d0 0 MTA
6 4 ec4 04baffa0 200b220 Enabled 00000000:00000000 002f17d0 0 MTA
8 8 10c 04bf19b8 8009220 Enabled 00000000:00000000 002f17d0 0 MTA (Threadpool Completion Port)
9 11 464 0be106d8 1220 Enabled 00000000:00000000 002f17d0 0 Ukn
10 10 da0 003c7958 7220 Disabled 00000000:00000000 0be1dd00 0 STA
OSID Special thread type
1 c08 DbgHelper
2 bf0 Finalizer
7 f54 Gate
8 10c IOCompletion
9 464 ADUnloadHelper
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -