Crash Dump Analysis Patterns (Part 27c)
Sometimes we need to narrow general stack trace collection to a few threads that satisfy some predicate, for example, all threads with kernel time spent greater than some value or all suspended threads or all threads that wait for a specific synchronization object type. We call this pattern variant Stack Trace Collection (predicate). This can be implemented using WinDbg scripts and / or debugger extensions.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
May 10th, 2016 at 1:11 pm
An example here can be service tags in TEB.SubProcessTag to identify threads from specific service in svchost.exe.
December 22nd, 2016 at 12:30 pm
To list 32-bit stack traces from the specific WOW64 process:
!for_each_thread “.thread @#Thread; r $t0 = @#Thread; .if (@@c++(((nt!_KTHREAD *)@$t0)->Process) == ProcessAddress) {.thread /w @#Thread; .reload; kv 256; .effmach AMD64 }”
November 24th, 2019 at 6:27 pm
Windows 10: !findthreads