O'Reilly logo

Memory Dump Analysis Anthology, Volume 7 by Dmitry Vostokov

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Blocked DPC

In this pattern we have blocked per-processor Deferred Procedure Call17 queues because of threads running on processors with IRQL > DISPATCH_LEVEL. For example, on the processor 11 (0×0b):

11: kd> !dpcs
CPU Type KDPC Function
3: Normal : 0x8accacec 0xf710567a DriverA


5: Normal : 0x89f449e4 0xf595b83a DriverB


7: Normal : 0x8a63664c 0xf59e3f04 USBPORT!USBPORT_IsrDpc


11: Normal : 0x8acb2cec 0xf710567a DriverA
11: Normal : 0x8b5e955c 0xf73484e6 ACPI!ACPIInterruptServiceRoutineDPC


11: kd> !thread
THREAD 89806428  Cid 0934.0944  Teb: 7ffdb000 Win32Thread: bc17dda0
RUNNING on processor b Not impersonating DeviceMap e1002258 Owning Process 89972290 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 2863772 Ticks: ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required