O'Reilly logo

Memory Dump Analysis Anthology, Volume 5 by Dmitry Vostokov

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 4. Pattern Interaction

Inconsistent Dump, Stack Trace Collection, LPC, Tthread, Process, Executive Resource Wait Chains, Missing Threads and Waiting Thread Time

Here is a synthetic case study to show various wait chain patterns. The complete memory dump from a frozen system is inconsistent (Volume 1, page 269), saved by LiveKd. Stack trace collection shows many threads waiting for LPC (Volume 3, page 97) replies:

THREAD 87432520  Cid 0b10.0dd8  Teb: 7ff83000 Win32Thread: 00000000 WAIT:
(Unknown) UserMode Non-Alertable
    8743270c  Semaphore Limit 0x1
Waiting for reply to LPC MessageId 007ade85: Current LPC port d676e560 Not impersonating DeviceMap d6f05be8 Owning Process 87581c78 Image: ProcessA.exe Attached Process N/A Image: N/A Wait Start ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required