Wait Chain (Executive Resources)
Reprinted from Memory Dump Analysis Anthology, Volume 2, pages 147 – 150
The most common and easily detectable example of Wait Chain pattern (Volume 1, page 481) in the kernel and complete memory dumps is when objects are executive resources (Volume 1, page 323). In some complex cases, we can even have multiple wait chains. For example, in the output of !locks WinDbg command below we can find at least three wait chains marked in bold, italics and bold italics:
883db310 -> 8967d020 -> 889fa23089a74228 -> 883ad4e0 -> 88d7a3e088e13990 -> 899da538 -> 8805fac8
The manual procedure to figure chains is simple. Pick ...