Crash Dump Analysis Patterns (Part 27c)

Sometimes we need to narrow general stack trace collection to a few threads that satisfy some predicate, for example, all threads with kernel time spent greater than some value or all suspended threads or all threads that wait for a specific synchronization object type. We call this pattern variant Stack Trace Collection (predicate). This can be implemented using WinDbg scripts and / or debugger extensions.

- Dmitry Vostokov @ + -

3 Responses to “Crash Dump Analysis Patterns (Part 27c)”

  1. Dmitry Vostokov Says:

    An example here can be service tags in TEB.SubProcessTag to identify threads from specific service in svchost.exe.

  2. Dmitry Vostokov Says:

    To list 32-bit stack traces from the specific WOW64 process:

    !for_each_thread “.thread @#Thread; r $t0 = @#Thread; .if (@@c++(((nt!_KTHREAD *)@$t0)->Process) == ProcessAddress) {.thread /w @#Thread; .reload; kv 256; .effmach AMD64 }”

  3. Dmitry Vostokov Says:

    Windows 10: !findthreads

Leave a Reply

You must be logged in to post a comment.