Software Diagnostics Library

In addition to hooking functions via code patching there is another function pre- and post-processing done via windows message hooking mechanism that I call Message Hooks pattern to differentiate it from Hooked Functions pattern. In some cases message hooking become sources of aberrant software behaviour including spikes, hangs and crashes. We can identify such residue looking at the problem thread raw stack:

0:000> !teb
TEB at 7ffde000
    ExceptionList:        0012fcdc
    StackBase:            00130000
    StackLimit:           0011b000
    SubSystemTib:         00000000
    FiberData:            00001e00
    ArbitraryUserPointer: 00000000
    Self:                 7ffde000
    EnvironmentPointer:   00000000
    ClientId:             0000050c . 000004b8
    RpcHandle:            00000000
    Tls Storage:          00000000
    PEB Address:          7ffdf000
    LastErrorValue:       0
    LastStatusValue:      c0000034
    Count Owned Locks:    0
    HardErrorMode:        0

0:000> dps 0011b000 00130000
[...]
0012fc78  7e4318d1 user32!DispatchHookA
0012fc7c  0012fcb8
0012fc80  7472467f
0012fc84  7e43e1ad user32!NtUserCallNextHookEx+0xc
0012fc88  7e43e18a user32!CallNextHookEx+0×6f
0012fc8c  00000003
0012fc90  00000011
0012fc94  001d0001
0012fc98  00000001
0012fc9c  00000003
0012fca0  00000000
0012fca4  001d0001
0012fca8  0012fcec
0012fcac  74730844DllA!ThreadKeyboardProc+0×77
0012fcb0  001e04f7
0012fcb4  00000003
0012fcb8  00000011
0012fcbc  001d0001
0012fcc0  00000003
0012fcc4  00020003
0012fcc8  001d0001
0012fccc  00000000
0012fcd0  001e04f7
0012fcd4  0012fcc0
0012fcd8  00000000
0012fcdc  0012fd4c
0012fce0  7475f1a6
0012fce4  74730850
0012fce8  ffffffff
0012fcec  0012fd20
0012fcf0  7e431923 user32!DispatchHookA+0×101
0012fcf4  00000003
0012fcf8  00000011
0012fcfc  001d0001
0012fd00  00000000
0012fd04  0012fe94
0012fd08  00000102
0012fd0c  7ffde000
0012fd10  00000000
0012fd14  00000001
0012fd18  00000003
0012fd1c  7e42b326 user32!CallHookWithSEH+0×44
0012fd20  0012fd5c
0012fd24  7e42b317 user32!CallHookWithSEH+0×21
0012fd28  00020003
0012fd2c  00000011
0012fd30  001d0001
0012fd34  747307c3
0012fd38  00000000
0012fd3c  0012fe94
0012fd40  00000102
[…]

0:000> ub 74730844
DllA!ThreadKeyboardProc+0×5e:
7473082b jne     DllA!ThreadKeyboardProc+0×77 (74730844)
7473082d cmp     dword ptr [ebp-1Ch],esi
74730830 je      DllA!ThreadKeyboardProc+0×77 (74730844)
74730832 push    dword ptr [ebp+10h]
74730835 push    dword ptr [ebp+0Ch]
74730838 push    dword ptr [ebp+8]
7473083b push    dword ptr [ebp-1Ch]
7473083e call    dword ptr [DllA!_imp__CallNextHookEx (74721248)]

Sometimes we can even reconstruct stack trace fragments that show message hooking call stack. When threads are spiking or blocked in a message hook procedure we can see a hooking module too:

0:000> kL
ChildEBP RetAddr 
0012fc80 7e43e1ad ntdll!KiFastSystemCallRet
0012fca8 74730844 user32!NtUserCallNextHookEx+0xc
0012fcec 7e431923 DllA!ThreadKeyboardProc+0×77
0012fd20 7e42b317 user32!DispatchHookA+0×101
0012fd5c 7e430238 user32!CallHookWithSEH+0×21
0012fd80 7c90e473 user32!__fnHkINDWORD+0×24
0012fda4 7e4193e9 ntdll!KiUserCallbackDispatcher+0×13
0012fdd0 7e419402 user32!NtUserPeekMessage+0xc
0012fdfc 747528ee user32!PeekMessageW+0xbc
[…]
0012fff0 00000000 kernel32!BaseProcessStart+0×23

The next 2 posts will feature a case study and a modeling example.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Today we introduce an icon for Main Thread pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

The title of this blog post is a bugtated Sherlock Holmes phrase “… the curious incident of the dog in the night-time.” from Silver Blaze short story. To see why please watch a video at the end of this post.

Last week I was in St. Petersburg where I visited a bookshop Singer House 

and bought “A Grammar of the Coptic Language” book (in Russian) to practice with ancient memory dumps:

Before that I was circling on an 18th-century coach (seems to be a model if we look at its door handle):

After the riding I was looking around and spotted the Tsar (click on a picture to watch the movie):

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

It’s time to introduce a conceptual software narratological framework for viewing software traces (using rich ETW / CDF tracing as our main focus). Here we consider a software story (fabula) as a full trace when every component was selected for tracing and emits debug messages during code execution paths. However, during viewing we can filter on and off certain modules, threads, processes, messages, etc. (adjoint threading) and see a different sub-story or plot (sujet). Every software plot (please do not confuse with PLOT acronym) can be presented differently (using appropriate discourse). Some presentational examples include temporal rearrangement, collapse of repetitive regions, source code hypertext (lexia) and allegorical devices such as message tool-tip comments. Here is a diagram that depicts story (fable, fabula) - plot (sujet) - presentation (discourse):

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Today we introduce an icon for Passive System Thread (kernel space) pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Finally found music appropriate for ETW / CDF trace analysis. It’s Andre Gagnon’s album Escape:

Here’s my version of track titles (some of them are also appropriate for crash dump analysis) with my comments in italics:

1. Non Fatal Error
2. Trace Dance (Samba)
3. En Hive
4. Char, The
5. L”Debug”
6. “Memoria”L
7. Process Hearts (cores)
8. Holidays (, but always looking back)
9. WOW (64)
10. DA+TA Master
11. Concert for 4 Threads (“Concertino” doesn’t sound good here)
12. Toc-Cat-ta of Strings
13. Bugville Promenade (along bug clusters?)
14. MOVS
15. The Sea Named Trace (after Solaris movie)
16. Catching The Bottle (it is often difficult to find a relevant problem message in a billion-line trace)
17. Debug Me Tender (DebugLove?)

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

2009:

• Crash Dump Analysis Patterns (Part 86) - Nested Offender pattern. Appears also in the following case study: Stack trace collection, message box, hidden exception, nested offender, insufficient memory, C++ exception, heap leak and ubiquitous component

• Dictionary of Debugging: Crash - posts that explain the difference between crashes and hangs: Crash Dumps for Dummies (Part 4) and Crash Dumps for Dummies (Part 6)

2008:

• Crash Dump Analysis Patterns (Part 67) - Nested Exception pattern. Appears also in the following case study: WOW64 process, NULL data pointer, stack overflow, main thread, incorrect stack trace, nested exceptions, hidden exception, manual dump, multiple exceptions and virtualized system

2007:

No dumps on that day

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Looks like reading Darwin biography influenced me in the direction of founding a museum. So I did and here’s its draft logo:

This multi-dimensional museum will show exhibitions dedicated to the history of debugging, memory dump artifacts and art. Stay tuned. The first exhibition opens very soon.

If you would like to donate an exhibit (for example, an old memory dump or a picture related to debugging) please use this page: http://www.dumpanalysis.org/contact. Any donations are greatly appreciated!

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Today we introduce an icon for Passive Thread (user space) pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

2009:

• Dictionary of Debugging: Hang - plan to resume DoD in July. Have lots of ideas about it.

• Crash Dump Analysis Patterns (Part 85) - Ubiquitous Component pattern. Appears also in the following case study: Stack trace collection, message box, hidden exception, nested offender, insufficient memory, C++ exception, heap leak and ubiquitous component

2008:

• Reflecting on 2008 (Part 1) - It is so interesting to look at what people search.

2007:

• Detecting loops in code - a good exercise in disassembling

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Don’t give your modules and build folders funny names. When your application or system crashes people will laugh. Recently had seen a driver build path (PDB paths, !dh command) involving words “dust”, “devil” and “missile”. A missile driver may sound like a winner against competitors but looks funny in a crash dump WinDbg output. Another case was a module having words “screw” and “driver” in lmv command output.

Another piece of advice is not to name your modules “fault tolerant”. This looks funny on crash stacks:

STACK_TEXT: 
0016f0ac 776d1faf ntdll!RtlpLowFragHeapFree+0x31
0016f0c4 655b9ed9 ntdll!RtlFreeHeap+0x105
0016f0dc 7650f1cc ModuleA!FaultTolerantHeap::FreeHeap+0x61
[...]

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Today we introduce an icon for Accidental Lock pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

2009:

There were several posts on that prolific day but only 2 are worth to repeat here

• Succession of Patterns (Part 1) - More work needs to be done here. I recently revived this theme by writing the next post: Succession of Patterns (Part 2)

• Bugtation No.97

2008:

No dumps on that day

2007:

No dumps on that day

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Mad about debugging? Join the annual competition by telling your Windows debugging story (*) after 7/7/2010 and before 8/8/2010 (**). The first prize is 3 volumes of Memory Dump Analysis Anthology + Color Supplement all signed by the author. There are also 2nd, 3rd, 4th and 5th level prizes.

Please send your story using this page: http://www.dumpanalysis.org/contact or dmitry dot vostokov at dumpanalysis dot org (if your story is formatted with pictures)

(*) DumpAnalysis.org reserves the right to publish your story (in a modified form if necessary) in OpenTask magazines and books with full credit.

(**) 7/7 and 8/8 are originally proposed Memory Analysts and Debuggers Days. Other proposed days are 7/8 and 8/7.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Today we introduce an icon for High Contention (critical sections) pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

I was looking for Wordpress plugins to display past year (two-, three-, etc.) old posts and after a few tries decided to create such posts manually to add fresh perspective and new comments on them (in italics). Today we start with June 21st.

2009:

• Debugalov has been burnt! - The book still sells every month and I’m now thinking about a hardcover gift edition. The cover fascinates many people, see for example this review: Book Review - The Adventures of Dr Debugalov. Now we also have Dr. DebugLove. Who is a good and who is a bad guy? Or is it a personality split?

2008:

No dumps on that day

2007:

Looks like the very prolific day. There were 3 blog posts:

• Crash Dump Analysis Patterns (Part 16a) - Stack overflow in kernel. Generated some comments and can also be seen in the following pattern case study: Lateral damage, stack overflow and execution residue

• Repair Clipboard Chain 2.0.1 - One of the most popular Citrix tool in the past

• Guessing stack trace - This old command still works for x86 WinDbg and x86 memory dumps

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Today we introduce an icon for High Contention (executive resources) pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Comments in italics are mine and express my own views, thoughts and opinions

Windows Internals by M. Russinovich, D. Solomon and A. Ionescu:

Local security policy audit (pp. 511 - 512) - I used in the past to recommend process audit to track process launch sequences for debugging purposes

Access tokens have separate ACL (pp. 512 - 513)

MSV1_0 - local authentication package (p. 513)

Default credential providers authui.dll amd SmartcardCredentialProvider.dll (p. 514) - Here are stack traces from x64 LogonUI.exe:

THREAD fffffa8013dde9d0  Cid 0238.04f8  Teb: 000007fffffd7000 Win32Thread: fffff900c0679d50 WAIT: (UserRequest) UserMode Non-Alertable
fffffa8013ddee60  SynchronizationEvent
fffffa8013dde810  SynchronizationEvent
Not impersonating
DeviceMap                 fffff88000008e00
Owning Process            fffffa80296ecae0       Image:         LogonUI.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      26019          Ticks: 402642 (0:01:44:41.255)
Context Switch Count      170                 LargeStack
UserTime                  00:00:00.015
KernelTime                00:00:00.046
Win32 Start Address authui!CCredentialProviderThread::_sThreadProc (0x000007fefc6d151c)
Stack Init fffffa6008efadb0 Current fffffa6008efa230
Base fffffa6008efb000 Limit fffffa6008ef5000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 2 IoPriority 2 PagePriority 5
Kernel stack not resident.
Child-SP          RetAddr           Call Site
fffffa60`08efa270 fffff800`01a6b9fa nt!KiSwapContext+0x7f
fffffa60`08efa3b0 fffff800`01a712db nt!KiSwapThread+0x13a
fffffa60`08efa420 fffff800`01cd160e nt!KeWaitForMultipleObjects+0x2eb
fffffa60`08efa4a0 fffff800`01cd1c53 nt!ObpWaitForMultipleObjects+0x26e
fffffa60`08efa960 fffff800`01a69233 nt!NtWaitForMultipleObjects+0xe2
fffffa60`08efabb0 00000000`778c72ca nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`08efac20)
00000000`0211f978 00000000`7769bc03 ntdll!ZwWaitForMultipleObjects+0xa
00000000`0211f980 00000000`777ce2b5 kernel32!WaitForMultipleObjectsEx+0x10b
00000000`0211fa90 00000000`777ce32e USER32!RealMsgWaitForMultipleObjectsEx+0x129
00000000`0211fb30 000007fe`fe4fb196 USER32!MsgWaitForMultipleObjectsEx+0x46
00000000`0211fb70 000007fe`fe608d42 ole32!CCliModalLoop::BlockFn+0xb6
00000000`0211fbb0 000007fe`fc6d07ad ole32!CoWaitForMultipleHandles+0x102
00000000`0211fcb0 000007fe`fc6d15d4 authui!InternalCoWaitForSingleHandle+0x31
00000000`0211fcf0 000007fe`fc6d1525 authui!CCredentialProviderThread::_vThreadProc+0xa0
00000000`0211fd30 00000000`7769be3d authui!CCredentialProviderThread::_sThreadProc+0x9
00000000`0211fd60 00000000`778a6a51 kernel32!BaseThreadInitThunk+0xd
00000000`0211fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

THREAD fffffa8013e48060  Cid 0238.0610  Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable
fffffa8013e4ab50  NotificationEvent
fffffa8013e425b0  SynchronizationEvent
Not impersonating
DeviceMap                 fffff88000008e00
Owning Process            fffffa80296ecae0       Image:         LogonUI.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      13245          Ticks: 415416 (0:01:48:00.531)
Context Switch Count      29
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address SmartcardCredentialProvider!I_ReaderMonitorThreadProc (0x000007fefc481db0)
Stack Init fffffa6009181db0 Current fffffa6009181230
Base fffffa6009182000 Limit fffffa600917c000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 2 IoPriority 2 PagePriority 5
Kernel stack not resident.
Child-SP          RetAddr           Call Site
fffffa60`09181270 fffff800`01a6b9fa nt!KiSwapContext+0x7f
fffffa60`091813b0 fffff800`01a712db nt!KiSwapThread+0x13a
fffffa60`09181420 fffff800`01cd160e nt!KeWaitForMultipleObjects+0x2eb
fffffa60`091814a0 fffff800`01cd1c53 nt!ObpWaitForMultipleObjects+0x26e
fffffa60`09181960 fffff800`01a69233 nt!NtWaitForMultipleObjects+0xe2
fffffa60`09181bb0 00000000`778c72ca nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`09181c20)
00000000`045efa48 00000000`7769bc03 ntdll!ZwWaitForMultipleObjects+0xa
00000000`045efa50 00000000`77691aa1 kernel32!WaitForMultipleObjectsEx+0x10b
00000000`045efb60 000007fe`fc4819bb kernel32!WaitForMultipleObjects+0x11
00000000`045efba0 000007fe`fc481de1 SmartcardCredentialProvider!I_ReaderMonitorWorker+0x8f
00000000`045efc30 00000000`7769be3d SmartcardCredentialProvider!I_ReaderMonitorThreadProc+0x31
00000000`045efc70 00000000`778a6a51 kernel32!BaseThreadInitThunk+0xd
00000000`045efca0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

Win32k.sys sends keyboard messages to LogonUI.exe via RPC (p. 514)

Secondary authentication providers in LogonUI.exe, SSON (p. 515)

wininit.exe is for session 0 legacy GUI processes (p. 516)

Raw input thread (p. 516) - here’re 3 kinds of csrss.exe (different IRPs):

session 0 (no IRP)

THREAD fffffa8013a7d980  Cid 02ec.0338  Teb: 000007fffffae000 Win32Thread: fffff900c00da010 WAIT: (WrUserRequest) KernelMode Alertable
fffffa8013665d00  SynchronizationEvent
fffffa8013037df0  NotificationTimer
fffffa8013665c80  SynchronizationTimer
fffff80001bb9f60  NotificationEvent
Not impersonating
DeviceMap                 fffff88000008e00
Owning Process            fffffa8029668710       Image:         csrss.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      428616         Ticks: 45 (0:00:00:00.702)
Context Switch Count      317                 LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefde7c3b0)
Stack Init fffffa6002c33db0 Current fffffa6002c33890
Base fffffa6002c34000 Limit fffffa6002c2e000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           Call Site
fffffa60`02c338d0 fffff800`01a6b9fa nt!KiSwapContext+0x7f
fffffa60`02c33a10 fffff800`01a712db nt!KiSwapThread+0x13a
fffffa60`02c33a80 fffff960`000ed088 nt!KeWaitForMultipleObjects+0x2eb
fffffa60`02c33b00 fffff960`00068317 win32k!RawInputThread+0x79c
fffffa60`02c33bc0 fffff960`000eddc6 win32k!xxxCreateSystemThreads+0x67
fffffa60`02c33bf0 fffff800`01a69233 win32k!NtUserCallNoParam+0x36
fffffa60`02c33c20 000007fe`fde7c3da nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`02c33c20)
00000000`002afd98 000007fe`fde7c3c9 winsrv!ZwUserCallNoParam+0xa
00000000`002afda0 00000000`778e2f6c winsrv!StartCreateSystemThreads+0x19
00000000`002afdd0 00000000`00000000 ntdll!RtlUserThreadStart+0x29

session 1 (console, keyboard IRP)

THREAD fffffa80296821d0  Cid 0324.0370  Teb: 000007fffffd3000 Win32Thread: fffff900c00e33b0 WAIT: (WrUserRequest) KernelMode Alertable
fffffa80137c6430  SynchronizationEvent
fffffa802967fc30  NotificationTimer
fffffa8029680360  SynchronizationTimer
fffffa802967f970  SynchronizationEvent
IRP List:
fffffa802968b2e0: (0006,03a0) Flags: 00060970  Mdl: 00000000
fffffa802960d4c0: (0006,03a0) Flags: 00060970  Mdl: 00000000
fffffa8012ec7470: (0006,03a0) Flags: 00060970  Mdl: 00000000
Not impersonating
DeviceMap                 fffff88000008e00
Owning Process            fffffa8029672c10       Image:         csrss.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      428605         Ticks: 56 (0:00:00:00.873)
Context Switch Count      24934                 LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address winsrv!StartCreateSystemThreads (0×000007fefde7c3b0)
Stack Init fffffa6008bd0db0 Current fffffa6008bd0890
Base fffffa6008bd1000 Limit fffffa6008bcb000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           Call Site
fffffa60`08bd08d0 fffff800`01a6b9fa nt!KiSwapContext+0×7f
fffffa60`08bd0a10 fffff800`01a712db nt!KiSwapThread+0×13a
fffffa60`08bd0a80 fffff960`000ed088 nt!KeWaitForMultipleObjects+0×2eb
fffffa60`08bd0b00 fffff960`00068317 win32k!RawInputThread+0×79c
fffffa60`08bd0bc0 fffff960`000eddc6 win32k!xxxCreateSystemThreads+0×67
fffffa60`08bd0bf0 fffff800`01a69233 win32k!NtUserCallNoParam+0×36
fffffa60`08bd0c20 000007fe`fde7c3da nt!KiSystemServiceCopyEnd+0×13 (TrapFrame @ fffffa60`08bd0c20)
00000000`014afab8 000007fe`fde7c3c9 winsrv!ZwUserCallNoParam+0xa
00000000`014afac0 00000000`778e2f6c winsrv!StartCreateSystemThreads+0×19
00000000`014afaf0 00000000`00000000 ntdll!RtlUserThreadStart+0×29

15: kd> !irp fffffa802968b2e0
Irp is active with 7 stacks 7 is current (= 0xfffffa802968b560)
No Mdl: System buffer=fffffa8029688790: Thread fffffa80296821d0:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
>[  3, 0]   0  1 fffffa8013703ce0 fffffa8029687670 00000000-00000000    pending
        \Driver\kbdclass
Args: 00000078 00000000 00000000 00000000

15: kd> !irp fffffa802960d4c0
Irp is active with 10 stacks 10 is current (= 0xfffffa802960d818)
No Mdl: System buffer=fffffa8029681010: Thread fffffa80296821d0:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
>[  3, 0]   0  1 fffffa801392ace0 fffffa8029686880 00000000-00000000    pending
        \Driver\kbdclass
Args: 00000078 00000000 00000000 00000000

15: kd> !irp fffffa8012ec7470
Irp is active with 3 stacks 3 is current (= 0xfffffa8012ec75d0)
No Mdl: System buffer=fffffa8029687010: Thread fffffa80296821d0:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
[  0, 0]   0  0 00000000 00000000 00000000-00000000   

   Args: 00000000 00000000 00000000 00000000
>[  3, 0]   0  1 fffffa8013722060 fffffa8029680200 00000000-00000000    pending
        \Driver\kbdclass
Args: 00000078 00000000 00000000 00000000

session N (terminal services, termdd IRP)

THREAD fffffa80168fbac0  Cid 175c.533c  Teb: 000007fffffae000 Win32Thread: fffff900c018d010 WAIT: (WrUserRequest) KernelMode Alertable
fffffa8015355e70  SynchronizationEvent
fffffa8016442950  NotificationTimer
fffffa80156f9f70  SynchronizationTimer
fffffa8016967a50  SynchronizationEvent
IRP List:
fffffa801501ba30: (0006,0118) Flags: 00060900  Mdl: 00000000
Not impersonating
DeviceMap                 fffff88000008e00
Owning Process            fffffa802b33ac10       Image:         csrss.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      428641         Ticks: 20 (0:00:00:00.312)
Context Switch Count      32238                 LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.218
Win32 Start Address winsrv!StartCreateSystemThreads (0×000007fefde7c3b0)
Stack Init fffffa601ccdbdb0 Current fffffa601ccdb890
Base fffffa601ccdc000 Limit fffffa601ccd6000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           Call Site
fffffa60`1ccdb8d0 fffff800`01a6b9fa nt!KiSwapContext+0×7f
fffffa60`1ccdba10 fffff800`01a712db nt!KiSwapThread+0×13a
fffffa60`1ccdba80 fffff960`000ed088 nt!KeWaitForMultipleObjects+0×2eb
fffffa60`1ccdbb00 fffff960`00068317 win32k!RawInputThread+0×79c
fffffa60`1ccdbbc0 fffff960`000eddc6 win32k!xxxCreateSystemThreads+0×67
fffffa60`1ccdbbf0 fffff800`01a69233 win32k!NtUserCallNoParam+0×36
fffffa60`1ccdbc20 000007fe`fde7c3da nt!KiSystemServiceCopyEnd+0×13 (TrapFrame @ fffffa60`1ccdbc20)
00000000`0137f878 000007fe`fde7c3c9 winsrv!ZwUserCallNoParam+0xa
00000000`0137f880 00000000`778e2f6c winsrv!StartCreateSystemThreads+0×19
00000000`0137f8b0 00000000`00000000 ntdll!RtlUserThreadStart+0×29

15: kd> !irp fffffa801501ba30
Irp is active with 1 stacks 1 is current (= 0xfffffa801501bb00)
No Mdl: No System Buffer: Thread fffffa80168fbac0:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
>[  3, 0]   0  1 fffffa801370adb0 fffffa801705ef20 00000000-00000000    pending
        \Driver\TermDD
Args: 00000078 00000000 00000000 00000000

Half-hash caching of passwords (p. 517)

logonsessions tool (pp. 519 - 520)

Today we introduce an icon for Coupled Processes (weak) pattern:

B/W

Color

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -