手把青秧插满田, 低头便见水中天; 心地清净方为道, 退步原来是向前.http://feed.cnblogs.com/blog/u/34733/rss2010-09-01T06:17:39ZDa Vincihttp://www.cnblogs.com/Sonic2007/CNBlogs BlogServerhttp://www.cnblogs.com/Sonic2007/archive/2010/09/01/1541988.html

windbg调试实战

2010-09-01T06:08:00Z2010-09-01T06:08:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/<!--[if gte mso 9]><xml> <w:WordDocument> <w:View>Normal</w:View> <w:Zoom>0</w:Zoom> <w:PunctuationKerning/> <w:DrawingGridVerticalSpacing>7.8 磅</w:DrawingGridVerticalSpacing> <w:DisplayHorizontalDrawingGridEvery>0</w:DisplayHorizontalDrawingGridEvery> <w:DisplayVerticalDrawingGridEvery>2</w:DisplayVerticalDrawingGridEvery> <w:ValidateAgainstSchemas/> <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid> <w:IgnoreMixedContent>false</w:IgnoreMixedContent> <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText> <w:Compatibility> <w:SpaceForUL/> <w:BalanceSingleByteDoubleByteWidth/> <w:DoNotLeaveBackslashAlone/> <w:ULTrailSpace/> <w:DoNotExpandShiftReturn/> <w:AdjustLineHeightInTable/> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> <w:DontGrowAutofit/> <w:UseFELayout/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--><!--[if gte mso 9]><xml> <w:LatentStyles DefLockedState="false" LatentStyleCount="156"> </w:LatentStyles> </xml><![endif]--><style> <!-- /* Font Definitions */ @font-face {font-family:宋体; panose-1:2 1 6 0 3 1 1 1 1 1; mso-font-alt:SimSun; mso-font-charset:134; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:3 135135232 16 0 262145 0;} @font-face {font-family:"\@宋体"; panose-1:2 1 6 0 3 1 1 1 1 1; mso-font-charset:134; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:3 135135232 16 0 262145 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-parent:""; margin:0cm; margin-bottom:.0001pt; text-align:justify; text-justify:inter-ideograph; mso-pagination:none; font-size:10.5pt; mso-bidi-font-size:12.0pt; font-family:"Times New Roman"; mso-fareast-font-family:宋体; mso-font-kerning:1.0pt;} /* Page Definitions */ @page {mso-page-border-surround-header:no; mso-page-border-surround-footer:no;} @page Section1 {size:612.0pt 792.0pt; margin:72.0pt 90.0pt 72.0pt 90.0pt; mso-header-margin:36.0pt; mso-footer-margin:36.0pt; mso-paper-source:0;} div.Section1 {page:Section1;} --> </style><!--[if gte mso 10]> <style> /* Style Definitions */ table.MsoNormalTable {mso-style-name:普通表格; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} </style> <![endif]-->最近遇到项目的一个bug，安装产品之后系统hang住。大致的现象是系统logon之后，Taskbar显示，然后hang住，Ctrl+Alt+Del不能调出TaskManager，Mouse不能移动，硬盘LED不闪烁。由于机器不在手边，远程调试又极其慢(实际上是国外的机器)，所以只好请求对方手动触发一个蓝屏(有关手动触发蓝屏的方式，请参考：<a href="http://msdn.microsoft.com/en-us/library/cc266483.aspx">http://msdn.microsoft.com/en-us/library/cc266483.aspx</a>)，得到一个完全dump文件(有关完全dump文件的设置，请参考：<a href="http://www.cnblogs.com/Sonic2007/archive/2009/05/29/1491809.html" title="Windbg内核调试之四: Dump文件分析">Windbg内核调试之四: Dump文件分析</a>)，利用该dump文件分析系统hang住时刻的状态。<br />注：这个事例中，利用Ctrl+Scroll Lock+Scroll Lock手动触发蓝屏，此键盘消息可以响应。<br /><br />祭起windbg，Open Crash Dump：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">Symbol&nbsp;search&nbsp;path&nbsp;</span><span style="color: #000000;">is</span><span style="color: #000000;">:&nbsp;srv</span><span style="color: #000000;">*</span><span style="color: #000000;">c:\symbols</span><span style="color: #000000;">*</span><span style="color: #000000;">http:</span><span style="color: #000000;">//</span><span style="color: #000000;">msdl.microsoft.com/download/symbols;E:\Win7.Symbols</span><span style="color: #008000;"><br /></span><span style="color: #000000;">Executable&nbsp;search&nbsp;path&nbsp;</span><span style="color: #000000;">is</span><span style="color: #000000;">:&nbsp;<br /></span><span style="color: #000000;">Windows&nbsp;</span><span style="color: #000000;">7</span><span style="color: #000000;">&nbsp;Kernel&nbsp;Version&nbsp;</span><span style="color: #000000;">7201</span><span style="color: #000000;">&nbsp;MP&nbsp;(</span><span style="color: #000000;">2</span><span style="color: #000000;">&nbsp;procs)&nbsp;Free&nbsp;x86&nbsp;compatible<br /></span><span style="color: #000000;">Product:&nbsp;WinNt,&nbsp;suite:&nbsp;TerminalServer&nbsp;SingleUserTS&nbsp;Personal<br /></span><span style="color: #000000;">Built&nbsp;by:&nbsp;</span><span style="color: #000000;">7201.0</span><span style="color: #000000;">.x86fre.winmain_win7ids.</span><span style="color: #000000;">090601</span><span style="color: #000000;">-</span><span style="color: #000000;">1516</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Kernel&nbsp;</span><span style="color: #000000;">base</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">=</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">0x8363e000</span><span style="color: #000000;">&nbsp;PsLoadedModuleList&nbsp;</span><span style="color: #000000;">=</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">0x83786810</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Debug&nbsp;session&nbsp;time:&nbsp;Thu&nbsp;Aug&nbsp;&nbsp;</span><span style="color: #000000;">6</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">17</span><span style="color: #000000;">:</span><span style="color: #000000;">04</span><span style="color: #000000;">:</span><span style="color: #000000;">40.745</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">2009</span><span style="color: #000000;">&nbsp;(GMT</span><span style="color: #000000;">+</span><span style="color: #000000;">8</span><span style="color: #000000;">)<br /></span><span style="color: #000000;">System&nbsp;Uptime:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;">&nbsp;days&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;">:</span><span style="color: #000000;">09</span><span style="color: #000000;">:</span><span style="color: #000000;">38.352</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Loading&nbsp;Kernel&nbsp;Symbols............................................................................................................<br /></span><span style="color: #000000;">Loading&nbsp;User&nbsp;Symbols<br /></span><span style="color: #000000;">Loading&nbsp;unloaded&nbsp;module&nbsp;list.....................................................................................................</span><span style="color: red;"><br /></span></div><span style="color: #000000;"><br />系统是Window 7的RC版本7201，运行在x86系统上。</span>先analyze &#8211;v一下，看看调试器给定的信息是否可用：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">!</span><span style="color: #000000;">analyze&nbsp;</span><span style="color: #000000;">-</span><span style="color: #000000;">v<br /></span><span style="color: #000000;">******************************************************************************</span><span style="color: #000000;"><br /></span><span style="color: #000000;">*</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="color: #000000;"></span><span style="color: #000000;"><br /></span><span style="color: #000000;">*</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Bugcheck&nbsp;Analysis&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="color: #000000;"></span><span style="color: #000000;"><br /></span><span style="color: #000000;">*</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="color: #000000;"></span><span style="color: #000000;"><br /></span><span style="color: #000000;">******************************************************************************</span><span style="color: #000000;"><br /></span><span style="color: #000000;">MANUALLY_INITIATED_CRASH&nbsp;(e2)<br /></span><span style="color: #000000;">The&nbsp;user&nbsp;manually&nbsp;initiated&nbsp;</span><span style="color: #000000;">this</span><span style="color: #000000;">&nbsp;crash&nbsp;dump.<br /></span><span style="color: #000000;">Arguments:<br /></span><span style="color: #000000;">Arg1:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Arg2:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Arg3:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Arg4:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /><br /></span><span style="color: #000000;">Debugging&nbsp;Details:<br /></span><span style="color: #000000;">------------------</span><span style="color: #000000;"><br /></span><span style="color: #000000;">DEFAULT_BUCKET_ID:&nbsp;&nbsp;VISTA_DRIVER_FAULT<br /></span><span style="color: #000000;">BUGCHECK_STR:&nbsp;&nbsp;</span><span style="color: #000000;">0xE2</span><span style="color: #000000;"><br /></span><span style="color: #000000;">PROCESS_NAME:&nbsp;&nbsp;System<br /></span><span style="color: #000000;">CURRENT_IRQL:&nbsp;&nbsp;</span><span style="color: #000000;">2</span><span style="color: #000000;"><br /></span><span style="color: #000000;">LAST_CONTROL_TRANSFER:&nbsp;&nbsp;from&nbsp;9066a1aa&nbsp;to&nbsp;8371ac88<br /><br /></span><span style="color: #000000;">STACK_TEXT:&nbsp;&nbsp;<br /></span><span style="color: #000000;">837649e4&nbsp;9066a1aa&nbsp;000000e2&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KeBugCheckEx</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1e</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764a0c&nbsp;9066a2ba&nbsp;88a60b48&nbsp;000000c6&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHidProcessCrashDump</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1e2</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764a30&nbsp;8de20d50&nbsp;</span><span style="color: #000000;">00000001</span><span style="color: #000000;">&nbsp;83764a4c&nbsp;000000c6&nbsp;kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHid_InsertCodesIntoQueue</span><span style="color: #000000;">+</span><span style="color: #000000;">0x88</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764a44&nbsp;8de20edd&nbsp;000000c6&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;9066a232&nbsp;HIDPARSE</span><span style="color: #000000;">!</span><span style="color: #000000;">HidP_KbdPutKey</span><span style="color: #000000;">+</span><span style="color: #000000;">0x30</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764a68&nbsp;8de20dbd&nbsp;8de216a8&nbsp;</span><span style="color: #000000;">00000009</span><span style="color: #000000;">&nbsp;9066a232&nbsp;HIDPARSE</span><span style="color: #000000;">!</span><span style="color: #000000;">HidP_ModifierCode</span><span style="color: #000000;">+</span><span style="color: #000000;">0x81</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764a8c&nbsp;8de210c0&nbsp;</span><span style="color: #000000;">00000047</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;88a56890&nbsp;HIDPARSE</span><span style="color: #000000;">!</span><span style="color: #000000;">HidP_TranslateUsage</span><span style="color: #000000;">+</span><span style="color: #000000;">0x61</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764abc&nbsp;9066a50f&nbsp;88a5692d&nbsp;0000000e&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;HIDPARSE</span><span style="color: #000000;">!</span><span style="color: #000000;">HidP_TranslateUsageAndPagesToI8042ScanCodes+0x66</span><span style="color: #000000;"></span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764aec&nbsp;836a6ab3&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;014b49d0&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHid_ReadComplete</span><span style="color: #000000;">+</span><span style="color: #000000;">0x18d</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764b34&nbsp;8de0e424&nbsp;83764b3c&nbsp;83764b3c&nbsp;</span><span style="color: #000000;">88883020</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopfCompleteRequest</span><span style="color: #000000;">+</span><span style="color: #000000;">0x128</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764b50&nbsp;8de0e5df&nbsp;</span><span style="color: #000000;">02883008</span><span style="color: #000000;">&nbsp;88a28508&nbsp;</span><span style="color: #000000;">00000009</span><span style="color: #000000;">&nbsp;HIDCLASS</span><span style="color: #000000;">!</span><span style="color: #000000;">HidpDistributeInterruptReport</span><span style="color: #000000;">+</span><span style="color: #000000;">0xce</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764b8c&nbsp;836a6ab3&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;8838c060&nbsp;88a56de4&nbsp;HIDCLASS</span><span style="color: #000000;">!</span><span style="color: #000000;">HidpInterruptReadComplete</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1a7</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764bd0&nbsp;</span><span style="color: #000000;">92753868</span><span style="color: #000000;">&nbsp;8367e474&nbsp;8902a6e0&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopfCompleteRequest</span><span style="color: #000000;">+</span><span style="color: #000000;">0x128</span><span style="color: Black;"><br /></span><span style="color: #000000;">83764c00&nbsp;</span><span style="color: #000000;">92754178</span><span style="color: #000000;">&nbsp;89147d70&nbsp;8838c060&nbsp;88c82b28&nbsp;USBPORT</span><span style="color: #000000;">!</span><span style="color: #000000;">USBPORT_Core_iCompleteDoneTransfer</span><span style="color: #000000;">+</span><span style="color: #000000;">0x6e0</span><span style="color: #000000;"></span><span style="color: #000000;"></span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764c2c&nbsp;927579af&nbsp;8683c028&nbsp;8683c0f0&nbsp;8683ca98&nbsp;USBPORT</span><span style="color: #000000;">!</span><span style="color: #000000;">USBPORT_Core_iIrpCsqCompleteDoneTransfer</span><span style="color: #000000;">+</span><span style="color: #000000;">0x33b</span><span style="color: #000000;"></span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764c54&nbsp;92751d18&nbsp;8683c028&nbsp;8683ca98&nbsp;8683c002&nbsp;USBPORT</span><span style="color: #000000;">!</span><span style="color: #000000;">USBPORT_Core_UsbIocDpc_Worker</span><span style="color: #000000;">+</span><span style="color: #000000;">0xbc</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764c78&nbsp;836a6335&nbsp;8683caa4&nbsp;8683c002&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;USBPORT</span><span style="color: #000000;">!</span><span style="color: #000000;">USBPORT_Xdpc_Worker</span><span style="color: #000000;">+</span><span style="color: #000000;">0x173</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764cd4&nbsp;836a6198&nbsp;83767d20&nbsp;</span><span style="color: #000000;">83771280</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiExecuteAllDpcs</span><span style="color: #000000;">+</span><span style="color: #000000;">0xf9</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764d20&nbsp;836a5fb8&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;0000000e&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiRetireDpcList</span><span style="color: #000000;">+</span><span style="color: #000000;">0xd5</span><span style="color: #000000;"><br /></span><span style="color: #000000;">83764d24&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;0000000e&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiIdleLoop</span><span style="color: #000000;">+</span><span style="color: #000000;">0x38</span><span style="color: #000000;"><br /><br /></span><span style="color: #000000;">STACK_COMMAND:&nbsp;&nbsp;kb<br /><br /></span><span style="color: #000000;">FOLLOWUP_IP:&nbsp;<br /></span><span style="color: #000000;">kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHidProcessCrashDump</span><span style="color: #000000;">+</span><span style="color: #000000;">1e2<br /></span><span style="color: #000000;">9066a1aa&nbsp;837d1000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dword&nbsp;ptr&nbsp;[ebp</span><span style="color: #000000;">+</span><span style="color: #000000;">10h],</span><span style="color: #000000;">0</span><span style="color: #000000;"><br /><br /></span><span style="color: #000000;">SYMBOL_STACK_INDEX:&nbsp;&nbsp;</span><span style="color: #000000;">1</span><span style="color: #000000;"><br /></span><span style="color: #000000;">SYMBOL_NAME:&nbsp;&nbsp;kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHidProcessCrashDump</span><span style="color: #000000;">+</span><span style="color: #000000;">1e2<br /></span><span style="color: #000000;">FOLLOWUP_NAME:&nbsp;&nbsp;MachineOwner<br /></span><span style="color: #000000;">MODULE_NAME:&nbsp;kbdhid<br /></span><span style="color: #000000;">IMAGE_NAME:&nbsp;&nbsp;kbdhid.sys<br /></span><span style="color: #000000;">DEBUG_FLR_IMAGE_TIMESTAMP:&nbsp;&nbsp;4a2487af<br /></span><span style="color: #000000;">FAILURE_BUCKET_ID:&nbsp;&nbsp;0xE2_kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHidProcessCrashDump</span><span style="color: #000000;">+</span><span style="color: #000000;">1e2<br /></span><span style="color: #000000;">BUCKET_ID:&nbsp;&nbsp;0xE2_kbdhid</span><span style="color: #000000;">!</span><span style="color: #000000;">KbdHidProcessCrashDump</span><span style="color: #000000;">+</span><span style="color: #000000;">1e2<br /></span><span style="color: #000000;">Followup:&nbsp;MachineOwner<br /></span><span style="color: #000000;">---------</span></div><br />给出的信息似乎并不充分，只是针对目标系统蓝屏的一些信息，并不是想要的系统如果hang住的分析。看看进程列表：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">!</span><span style="color: #000000;">process&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br /></span><span style="color: #000000;">****</span><span style="color: #000000;">&nbsp;NT&nbsp;ACTIVE&nbsp;PROCESS&nbsp;DUMP&nbsp;</span><span style="color: #000000;">****</span><span style="color: #000000;"><br /></span><span style="color: #000000;">PROCESS&nbsp;85f22920&nbsp;&nbsp;SessionId:&nbsp;none&nbsp;&nbsp;Cid:&nbsp;</span><span style="color: #000000;">0004</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Peb:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;&nbsp;ParentCid:&nbsp;</span><span style="color: #000000;">0000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;DirBase:&nbsp;</span><span style="color: #000000;">00185000</span><span style="color: #000000;">&nbsp;&nbsp;ObjectTable:&nbsp;8cc01c58&nbsp;&nbsp;HandleCount:&nbsp;</span><span style="color: #000000;">2369</span><span style="color: #000000;">.<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Image:&nbsp;System<br /></span><span style="color: #000000;">PROCESS&nbsp;86c568a0&nbsp;&nbsp;SessionId:&nbsp;none&nbsp;&nbsp;Cid:&nbsp;</span><span style="color: #000000;">0178</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Peb:&nbsp;7ffdf000&nbsp;&nbsp;ParentCid:&nbsp;</span><span style="color: #000000;">0004</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;DirBase:&nbsp;b9c6d020&nbsp;&nbsp;ObjectTable:&nbsp;8cd97f30&nbsp;&nbsp;HandleCount:&nbsp;&nbsp;</span><span style="color: #000000;">31</span><span style="color: #000000;">.<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Image:&nbsp;smss.exe<br /></span><span style="color: #000000;">PROCESS&nbsp;884de8f0&nbsp;&nbsp;SessionId:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;">&nbsp;&nbsp;Cid:&nbsp;</span><span style="color: #000000;">0210</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Peb:&nbsp;7ffdd000&nbsp;&nbsp;ParentCid:&nbsp;01c4<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;DirBase:&nbsp;b9c6d060&nbsp;&nbsp;ObjectTable:&nbsp;8cc0ab68&nbsp;&nbsp;HandleCount:&nbsp;</span><span style="color: #000000;">721</span><span style="color: #000000;">.<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Image:&nbsp;csrss.exe<br /></span><span style="color: #000000;">............</span><span style="color: #000000;"></span></div><br />进程太多就没全列出来。死锁有两种情况，一种是系统死锁，像本例一样，系统没有任何响应，这种死锁多由内核驱动引起，调试相对困难，也不易找到到底是哪个进程中的线程引发死锁，哪个进程中的线程持有资源；另一种是应用程序引发的死锁，这种情况系统多数是可以响应的，鼠标或桌面，只是某个应用程序hang住，也许是TaskManager，也许是其它应用程序。这种问题相对系统级死锁要简单的多，只要attach到hang住的应用程序上，一般都可排查出问题所在，多数情况下都是应用程序进程中的某个线程持有Critical Section，引起其它线程等待资源；另一种情况是并不是多个线程的相互等待，而是线程自旋无法继续执行。所以，判断应用程序的挂死，最有效的方法就是观察CPU的使用率(Ctrl+Alt+Del)，看是否达到峰值或为0。<br />系统级死锁不容易找到引起问题的进程，需要关注的System、<span style="color: #000000;">Csrss.exe</span>、Service.exe这样比较重要的进程；应用程序死锁则重点关注applicaton本身就可以了。<br />本例明显是系统级的死锁，基本可以肯定是第三方驱动程序导致。进程列表是看不出什么可疑的原因的。既然怀疑是死锁的问题，运行一下!locks(!kdext*.locks，Kernal级)看看当前系统持有的锁：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">!</span><span style="color: #000000;">locks<br /></span><span style="color: #000000;">****</span><span style="color: #000000;">&nbsp;DUMP&nbsp;OF&nbsp;ALL&nbsp;RESOURCE&nbsp;OBJECTS&nbsp;</span><span style="color: #000000;">****</span><span style="color: #000000;"><br /></span><span style="color: #000000;">KD:&nbsp;Scanning&nbsp;</span><span style="color: #000000;">for</span><span style="color: #000000;">&nbsp;held&nbsp;locks.<br /></span><span style="color: #ff0000;">Resource&nbsp;@&nbsp;nt</span><span style="color: #ff0000;">!</span><span style="color: #ff0000;">PnpRegistryDeviceResource</span><span style="color: #000000;"> (</span><span style="color: #ff0000;">0x</span><span style="color: #ff0000;">837a3e80</span><span style="color: #ff0000;">)&nbsp;&nbsp;&nbsp;&nbsp;Exclusively&nbsp;owned</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;Contention&nbsp;Count&nbsp;</span><span style="color: #000000;">=</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">48</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;NumberOfExclusiveWaiters&nbsp;</span><span style="color: #000000;">=</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">3</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Threads:&nbsp;85f55688</span><span style="color: #000000;">-</span><span style="color: #000000;">01</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Threads&nbsp;Waiting&nbsp;On&nbsp;Exclusive&nbsp;Access:<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;85f59798&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;85f59a70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8893cd48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /><br /></span><span style="color: #000000;">KD:&nbsp;Scanning&nbsp;</span><span style="color: #000000;">for</span><span style="color: #000000;">&nbsp;held&nbsp;locks..................</span><span style="color: #000000;"><br /></span><span style="color: #ff0000;">Resource&nbsp;@&nbsp;</span><span style="color: #ff0000;">0x87b286dc</span><span style="color: #ff0000;">&nbsp;</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;Shared&nbsp;</span><span style="color: #000000;">12</span><span style="color: #000000;">&nbsp;owning&nbsp;threads<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Threads:&nbsp;</span><span style="color: #000000;">89484568</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88c5d030</span><span style="color: #000000;">-</span><span style="color: #000000;">03</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88c5a7e0</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88c5b030</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;88c5cd48</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88c5c2f8</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88f858f8</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88df7030</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8932ab08</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;889e4d48</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;88afa3e8</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;8936bd48</span><span style="color: #000000;">-</span><span style="color: #000000;">02</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;">&nbsp;<br /></span><span style="color: #000000;">KD:&nbsp;Scanning&nbsp;</span><span style="color: #000000;">for</span><span style="color: #000000;">&nbsp;held&nbsp;locks........................................................................................................<br /></span><span style="color: #000000;">17099</span><span style="color: #000000;">&nbsp;total&nbsp;locks,&nbsp;</span><span style="color: #000000;">2</span><span style="color: #000000;">&nbsp;locks&nbsp;currently&nbsp;held</span><span style="color: #000000;"><br /></span></div><br /><span style="color: #000000;">当前两个锁被持有，其中一个为</span><span style="color: #000000;">Exclusively&nbsp;owned</span><span style="color: #000000;">，另一个是共享锁。第一个锁为</span><span style="color: #000000;">Exclusively&nbsp;owned</span><span style="color: #000000;">访问，即专有访问，这种锁往往是引起死锁问题的原因。死锁的一种情况是由于</span>系统正在执行的一个线程需要一个锁，而这个锁被当前系统未执行的某个线程所持有。系统中大部分是共享锁。<br />注意到第一个锁当前持有的线程为<span style="color: #000000;">85f55688</span><span style="color: #000000;">-</span><span style="color: #000000;">01</span><span style="color: #000000;">&lt;*&gt;</span><span style="color: #000000;"> </span>(-01&lt;*&gt;代表当前持有的进程)，等待队列中有三个线程在等待这个锁；第二个锁为共享锁，所有线程列表中的thread都持有它。<br />这两个锁实际上是两个resource的形式给出，通过命令看一下这两个resouce的结构：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;dt&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">_ERESOURCE </span><span style="color: #000000;">-b</span><span style="color: red;"> </span><span style="color: red;">0x837a</span><span style="color: red;">3e80</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x000</span><span style="color: #000000;">&nbsp;SystemResourcesList&nbsp;:&nbsp;_LIST_ENTRY&nbsp;[&nbsp;</span><span style="color: #000000;">0x8377f3c0</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">-</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">0x8377eac0</span><span style="color: #000000;">&nbsp;]<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x000</span><span style="color: #000000;">&nbsp;Flink&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x8377f3c0</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;Blink&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x8377eac0</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x008</span><span style="color: #000000;">&nbsp;OwnerTable&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x87bfb068</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x00c</span><span style="color: #000000;">&nbsp;ActiveCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">1</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x00e</span><span style="color: #000000;">&nbsp;Flag&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x84</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x010</span><span style="color: #000000;">&nbsp;SharedWaiters&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x87db2088</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x014</span><span style="color: #000000;">&nbsp;ExclusiveWaiters&nbsp;:&nbsp;</span><span style="color: #000000;">0x87db20c0</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x018</span><span style="color: #000000;">&nbsp;OwnerEntry&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;_OWNER_ENTRY<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x000</span><span style="color: #000000;">&nbsp;OwnerThread&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: red;">0x85f55688</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;IoPriorityBoosted&nbsp;:&nbsp;0y0<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;OwnerReferenced&nbsp;&nbsp;:&nbsp;0y0<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;OwnerCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;0y000000000000000000000000000001&nbsp;(</span><span style="color: #000000;">0x1</span><span style="color: #000000;">)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;TableSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">4</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x020</span><span style="color: #000000;">&nbsp;ActiveEntries&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">1</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x024</span><span style="color: #000000;">&nbsp;ContentionCount&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x30</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x028</span><span style="color: #000000;">&nbsp;NumberOfSharedWaiters&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x02c</span><span style="color: #000000;">&nbsp;NumberOfExclusiveWaiters&nbsp;:&nbsp;</span><span style="color: #000000;">3</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x030</span><span style="color: #000000;">&nbsp;Address&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;(</span><span style="color: #000000;">null</span><span style="color: #000000;">)&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x030</span><span style="color: #000000;">&nbsp;CreatorBackTraceIndex&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x034</span><span style="color: #000000;">&nbsp;SpinLock&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br /><br /></span><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;dt&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">_ERESOURCE&nbsp;</span><span style="color: #000000;">-</span><span style="color: #000000;">b&nbsp;</span><span style="color: red;">0x87b2</span><span style="color: red;">86</span><span style="color: red;">dc</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x000</span><span style="color: #000000;">&nbsp;SystemResourcesList&nbsp;:&nbsp;_LIST_ENTRY&nbsp;[&nbsp;</span><span style="color: #000000;">0x87b286a4</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">-</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">0x87b11234</span><span style="color: #000000;">&nbsp;]<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x000</span><span style="color: #000000;">&nbsp;Flink&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x87b286a4</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;Blink&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x87b11234</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x008</span><span style="color: #000000;">&nbsp;OwnerTable&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0x892d0130</span><span style="color: #000000;">&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x00c</span><span style="color: #000000;">&nbsp;ActiveCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">1</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x00e</span><span style="color: #000000;">&nbsp;Flag&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x010</span><span style="color: #000000;">&nbsp;SharedWaiters&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;(</span><span style="color: #000000;">null</span><span style="color: #000000;">)&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x014</span><span style="color: #000000;">&nbsp;ExclusiveWaiters&nbsp;:&nbsp;(</span><span style="color: #000000;">null</span><span style="color: #000000;">)&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x018</span><span style="color: #000000;">&nbsp;OwnerEntry&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;_OWNER_ENTRY<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x000</span><span style="color: #000000;">&nbsp;OwnerThread&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: </span><span style="color: #000000;"></span><span style="color: red;">0x8948</span><span style="color: red;">4</span><span style="color: red;">568</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;IoPriorityBoosted&nbsp;:&nbsp;0y0<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;OwnerReferenced&nbsp;&nbsp;:&nbsp;0y0<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;OwnerCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;0y000000000000000000000000000010&nbsp;(</span><span style="color: #000000;">0x2</span><span style="color: #000000;">)<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x004</span><span style="color: #000000;">&nbsp;TableSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">8</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x020</span><span style="color: #000000;">&nbsp;ActiveEntries&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0xc</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x024</span><span style="color: #000000;">&nbsp;ContentionCount&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x028</span><span style="color: #000000;">&nbsp;NumberOfSharedWaiters&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x02c</span><span style="color: #000000;">&nbsp;NumberOfExclusiveWaiters&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x030</span><span style="color: #000000;">&nbsp;Address&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;(</span><span style="color: #000000;">null</span><span style="color: #000000;">)&nbsp;<br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x030</span><span style="color: #000000;">&nbsp;CreatorBackTraceIndex&nbsp;:&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br />&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">+</span><span style="color: #000000;">0x034</span><span style="color: #000000;">&nbsp;SpinLock&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;</span><span style="color: #000000;">0</span></div><br />能看到ERESOURCE结构的<span style="color: #000000;">OwnerThread</span>域正是上述分析的持有锁的线程。ERESOURCE结构定义大致如下：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">typedef&nbsp;</span><span style="color: #0000ff;">struct</span><span style="color: #000000;">&nbsp;_ERESOURCE {<br />&nbsp;&nbsp;&nbsp;&nbsp; LIST_ENTRY&nbsp;SystemResourcesList;<br />&nbsp;&nbsp;&nbsp;&nbsp; POWNER_ENTRY&nbsp;OwnerTable;<br />&nbsp;&nbsp;&nbsp;&nbsp; SHORT&nbsp;ActiveCount;<br />&nbsp;&nbsp;&nbsp;&nbsp; USHORT&nbsp;Flag;<br />&nbsp;&nbsp;&nbsp;&nbsp; PKSEMAPHORE&nbsp;SharedWaiters;<br />&nbsp;&nbsp;&nbsp;&nbsp; PKEVENT&nbsp;ExclusiveWaiters;<br />&nbsp;&nbsp;&nbsp;&nbsp; OWNER_ENTRY&nbsp;OwnerThreads[</span><span style="color: #800080;">2</span><span style="color: #000000;">];<br />&nbsp;&nbsp;&nbsp;&nbsp; ULONG&nbsp;ContentionCount;<br />&nbsp;&nbsp;&nbsp;&nbsp; USHORT&nbsp;NumberOfSharedWaiters;<br />&nbsp;&nbsp;&nbsp;&nbsp; USHORT&nbsp;NumberOfExclusiveWaiters;<br />&nbsp;&nbsp;&nbsp;&nbsp; union{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PVOID&nbsp;Address;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ULONG_PTR&nbsp;CreatorBackTraceIndex;<br />&nbsp;&nbsp;&nbsp;&nbsp; };<br />&nbsp;&nbsp;&nbsp;&nbsp; KSPIN_LOCK&nbsp;SpinLock;<br />}&nbsp;ERESOURCE,&nbsp;</span><span style="color: #000000;">*</span><span style="color: #000000;">PERESOURCE; <br /></span></div><br />现在比较可疑的是线程<span style="color: #000000;"></span><span style="color: red;">0x85f55688</span><span style="color: #000000;">所持有的资源锁，列出这个线程的stack trace看看有没有hot spot：<br /></span><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">!</span><span style="color: #000000;">thread&nbsp;</span><span style="color: red;">0x85f55</span><span style="color: red;">688</span><span style="color: #000000;"><br /></span><span style="color: #000000;">THREAD&nbsp;85f55688&nbsp;&nbsp;Cid&nbsp;</span><span style="color: #000000;">0004.0024</span><span style="color: #000000;">&nbsp;&nbsp;Teb:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;Win32Thread:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;WAIT:&nbsp;(WrLpcReply)&nbsp;KernelMode&nbsp;Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Alertable<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;85f558bc&nbsp;&nbsp;Semaphore&nbsp;Limit&nbsp;</span><span style="color: #000000;">0x1</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Waiting&nbsp;</span><span style="color: #000000;">for</span><span style="color: #000000;">&nbsp;reply&nbsp;to&nbsp;ALPC&nbsp;Message&nbsp;8e4a46b0&nbsp;:&nbsp;queued&nbsp;at&nbsp;port&nbsp;88c5cc18&nbsp;:&nbsp;owned&nbsp;by&nbsp;process&nbsp;88c09400<br /></span><span style="color: #000000;">Not&nbsp;impersonating<br /></span><span style="color: #000000;">DeviceMap&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8cc08a00<br /></span><span style="color: #000000;">Owning&nbsp;Process&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Image:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">&lt;</span><span style="color: #000000;">Unknown</span><span style="color: #000000;">&gt;</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Attached&nbsp;Process&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;85f22920&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Image:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;System<br /></span><span style="color: #000000;">Wait&nbsp;Start&nbsp;TickCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">6525</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ticks:&nbsp;</span><span style="color: #000000;">30548</span><span style="color: #000000;">&nbsp;(</span><span style="color: #000000;">0</span><span style="color: #000000;">:</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">07</span><span style="color: #000000;">:</span><span style="color: #000000;">56.551</span><span style="color: #000000;">)<br /></span><span style="color: #000000;">Context&nbsp;Switch&nbsp;Count&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">9141</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /></span><span style="color: #000000;">UserTime&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00.000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">KernelTime&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00.546</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Win32&nbsp;Start&nbsp;Address&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ExpWorkerThread&nbsp;(</span><span style="color: #000000;">0x836abb1a</span><span style="color: #000000;">)<br /></span><span style="color: #000000;">Stack&nbsp;Init&nbsp;8e907fd0&nbsp;Current&nbsp;8e907220&nbsp;Base&nbsp;8e908000&nbsp;Limit&nbsp;8e905000&nbsp;Call&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Priority&nbsp;</span><span style="color: #000000;">13</span><span style="color: #000000;">&nbsp;BasePriority&nbsp;</span><span style="color: #000000;">13</span><span style="color: #000000;">&nbsp;PriorityDecrement&nbsp;</span><span style="color: #000000;">0</span><span style="color: #000000;">&nbsp;IoPriority&nbsp;</span><span style="color: #000000;">2</span><span style="color: #000000;">&nbsp;PagePriority&nbsp;</span><span style="color: #000000;">5</span><span style="color: #000000;"><br /></span><span style="color: #000000;">ChildEBP&nbsp;RetAddr&nbsp;&nbsp;Args&nbsp;to&nbsp;Child&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /></span><span style="color: #000000;">8e907238&nbsp;836aca58&nbsp;85f55688&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;83767d20&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiSwapContext</span><span style="color: #000000;">+</span><span style="color: #000000;">0x26</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Uses&nbsp;EBP]&nbsp;[</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">4</span><span style="color: #000000;">])<br /></span><span style="color: #000000;">8e907270&nbsp;836ab113&nbsp;85f55748&nbsp;85f55688&nbsp;85f558bc&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiSwapThread</span><span style="color: #000000;">+</span><span style="color: #000000;">0x266</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907298&nbsp;836a524f&nbsp;85f55688&nbsp;85f55748&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiCommitThreadWait</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1df</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907310&nbsp;836f4ad7&nbsp;85f558bc&nbsp;</span><span style="color: #000000;">00000011</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KeWaitForSingleObject</span><span style="color: #000000;">+</span><span style="color: #000000;">0x393</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907338&nbsp;838b3bae&nbsp;85f558bc&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">AlpcpSignalAndWait</span><span style="color: #000000;">+</span><span style="color: #000000;">0x7b</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e90735c&nbsp;838a9c2f&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;8e9073c8&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">AlpcpReceiveSynchronousReply</span><span style="color: #000000;">+</span><span style="color: #000000;">0x27</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9073ec&nbsp;8389d28f&nbsp;88c5a6b0&nbsp;</span><span style="color: #000000;">00020000</span><span style="color: #000000;">&nbsp;8e907628&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">AlpcpProcessSynchronousRequest</span><span style="color: #000000;">+</span><span style="color: #000000;">0x276</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907448&nbsp;838b4ad7&nbsp;88c5a6b0&nbsp;8e907628&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">LpcpRequestWaitReplyPort</span><span style="color: #000000;">+</span><span style="color: #000000;">0x6a</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907470&nbsp;8368157a&nbsp;80000c54&nbsp;8e907628&nbsp;8e907528&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">NtRequestWaitReplyPort</span><span style="color: #000000;">+</span><span style="color: #000000;">0x4c</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907470&nbsp;8368024d&nbsp;80000c54&nbsp;8e907628&nbsp;8e907528&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiFastCallEntry</span><span style="color: #000000;">+</span><span style="color: #000000;">0x12a</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">3</span><span style="color: #000000;">]&nbsp;TrapFrame&nbsp;@&nbsp;8e907484)<br /></span><span style="color: #000000;">8e9074f4&nbsp;98b63434&nbsp;80000c54&nbsp;8e907628&nbsp;8e907528&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ZwRequestWaitReplyPort</span><span style="color: #000000;">+</span><span style="color: #000000;">0x11</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[</span><span style="color: #000000;">3</span><span style="color: #000000;">,</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">0</span><span style="color: #000000;">])<br /></span><span style="color: #000000;">WARNING:&nbsp;Stack&nbsp;unwind&nbsp;information&nbsp;not&nbsp;available.&nbsp;Following&nbsp;frames&nbsp;may&nbsp;be&nbsp;wrong.<br /></span><span style="color: #000000;">8e90772c&nbsp;98b638a1&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;98b7d6ec&nbsp;tmcomm</span><span style="color: #000000;">!</span><span style="color: #000000;">CWorkerThreadPool::CWorkerThreadPool</span><span style="color: #000000;">+</span><span style="color: #000000;">0xa54</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907744&nbsp;98b9d97e&nbsp;8e90775c&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;98ba6238&nbsp;tmcomm</span><span style="color: #000000;">!</span><span style="color: #000000;">KmCallUm</span><span style="color: #000000;">+</span><span style="color: #000000;">0x75</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907784&nbsp;98b9ee09&nbsp;9530af7c&nbsp;162a554d&nbsp;98ba6238&nbsp;tmactmon</span><span style="color: #000000;">+</span><span style="color: #000000;">0x397e</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9077c0&nbsp;98b9ef4d&nbsp;0000000a&nbsp;</span><span style="color: #000000;">80000002</span><span style="color: #000000;">&nbsp;99ccc490&nbsp;tmactmon</span><span style="color: #000000;">+</span><span style="color: #000000;">0x4e09</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9077ec&nbsp;98b9efbc&nbsp;8e907844&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;0000000a&nbsp;tmactmon</span><span style="color: #000000;">+</span><span style="color: #000000;">0x4f4d</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907800&nbsp;98b8c450&nbsp;8e907844&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;8e907950&nbsp;tmactmon</span><span style="color: #000000;">+</span><span style="color: #000000;">0x4fbc</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907828&nbsp;98b91f97&nbsp;8e907802&nbsp;8e9078a4&nbsp;8e907950&nbsp;tmevtmgr</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1450</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e90789c&nbsp;98b921d7&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;88be10a4&nbsp;8e907950&nbsp;tmevtmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">TMEvtCommunicateRoutine</span><span style="color: #000000;">+</span><span style="color: #000000;">0x2569</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9078b4&nbsp;98b8c450&nbsp;8e907900&nbsp;88be0edc&nbsp;8e9079c8&nbsp;tmevtmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">TMEvtCommunicateRoutine</span><span style="color: #000000;">+</span><span style="color: #000000;">0x27a9</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9078dc&nbsp;98b90d0d&nbsp;8e907903&nbsp;8e9079a0&nbsp;8e907a0c&nbsp;tmevtmgr</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1450</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9079ac&nbsp;98b8e7b0&nbsp;8e9079c8&nbsp;8e9079e4&nbsp;98b8e944&nbsp;tmevtmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">TMEvtCommunicateRoutine</span><span style="color: #000000;">+</span><span style="color: #000000;">0x12df</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9079b8&nbsp;98b8e944&nbsp;88be0f5c&nbsp;8e9079c8&nbsp;8e907acc&nbsp;tmevtmgr</span><span style="color: #000000;">+</span><span style="color: #000000;">0x37b0</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9079e4&nbsp;8368157a&nbsp;88be0f5c&nbsp;8e907acc&nbsp;</span><span style="color: #000000;">82000000</span><span style="color: #000000;">&nbsp;tmevtmgr</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3944</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e9079e4&nbsp;8367f069&nbsp;88be0f5c&nbsp;8e907acc&nbsp;</span><span style="color: #000000;">82000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiFastCallEntry</span><span style="color: #000000;">+</span><span style="color: #000000;">0x12a</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">3</span><span style="color: #000000;">]&nbsp;TrapFrame&nbsp;@&nbsp;8e907a0c)<br /></span><span style="color: #000000;">8e907a7c&nbsp;838266b5&nbsp;8e907acc&nbsp;</span><span style="color: #000000;">82000000</span><span style="color: #000000;">&nbsp;8e907ad8&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ZwCreateKey</span><span style="color: #000000;">+</span><span style="color: #000000;">0x11</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[</span><span style="color: #000000;">7</span><span style="color: #000000;">,</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">0</span><span style="color: #000000;">])<br /></span><span style="color: #000000;">8e907af0&nbsp;8380e477&nbsp;8e907cb8&nbsp;</span><span style="color: #000000;">82000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopCreateRegistryKeyEx</span><span style="color: #000000;">+</span><span style="color: #000000;">0x61</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907c18&nbsp;8380e0bd&nbsp;85f4d530&nbsp;</span><span style="color: #000000;">00000002</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">82000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopOpenOrCreateDeviceRegistryKey</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3b1</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907c30&nbsp;8c07e594&nbsp;85f4d530&nbsp;</span><span style="color: #000000;">00000002</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">82000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IoOpenDeviceRegistryKey</span><span style="color: #000000;">+</span><span style="color: #000000;">0x18</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907cc8&nbsp;8c016489&nbsp;87dbb0e0&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;ndis</span><span style="color: #000000;">!</span><span style="color: #000000;">ndisCheckAdapterBindings</span><span style="color: #000000;">+</span><span style="color: #000000;">0xa7</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">8e907cf0&nbsp;8c07d013&nbsp;87dbbc70&nbsp;87dbb0e0&nbsp;8e907d50&nbsp;ndis</span><span style="color: #000000;">!</span><span style="color: #000000;">ndisQueuedRestoreMiniportstack</span><span style="color: #000000;">+</span><span style="color: #000000;">0x36</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">8e907d00&nbsp;836abc27&nbsp;87dbbc70&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;85f55688&nbsp;ndis</span><span style="color: #000000;">!</span><span style="color: #000000;">ndisWorkItemHandler</span><span style="color: #000000;">+</span><span style="color: #000000;">0xe</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">8e907d50&nbsp;8384c643&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;a63db72a&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ExpWorkerThread</span><span style="color: #000000;">+</span><span style="color: #000000;">0x10d</span><span style="color: #000000;"><br /></span><span style="color: #000000;">8e907d90&nbsp;836fe059&nbsp;836abb1a&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">PspSystemThreadStartup</span><span style="color: #000000;">+</span><span style="color: #000000;">0x9e</span><span style="color: #000000;"><br /></span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiThreadStartup</span><span style="color: #000000;">+</span><span style="color: #000000;">0x19</span></div><br />上述stack trace没有看出什么可疑的状态。再看看另外一个线程<span style="color: red;">0x8948</span><span style="color: red;">4</span><span style="color: red;">568</span>(持有共享锁)：<br /><div style="background-color: #F5F5F5;border: 1px solid #CCCCCC;padding-left:5px;padding-right:5px;"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #000000;">0</span><span style="color: #000000;">:&nbsp;kd</span><span style="color: #000000;">&gt;</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">!</span><span style="color: #000000;">thread&nbsp;</span><span style="color: red;">0x894845</span><span style="color: red;">68</span><span style="color: #000000;"><br /></span><span style="color: #000000;">THREAD&nbsp;</span><span style="color: #000000;">89484568</span><span style="color: #000000;">&nbsp;&nbsp;Cid&nbsp;0cd0.0f50&nbsp;&nbsp;Teb:&nbsp;7ffa6000&nbsp;Win32Thread:&nbsp;ffb39180&nbsp;WAIT:&nbsp;(Executive)&nbsp;KernelMode&nbsp;Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Alertable<br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;b44c6680&nbsp;&nbsp;NotificationEvent<br /></span><span style="color: #000000;">IRP&nbsp;List:<br />&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">:&nbsp;(</span><span style="color: #000000;">0006</span><span style="color: #000000;">,</span><span style="color: #000000;">0244</span><span style="color: #000000;">)&nbsp;Flags:&nbsp;</span><span style="color: #000000;">00000884</span><span style="color: #000000;">&nbsp;&nbsp;Mdl:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;894d6db8:&nbsp;(</span><span style="color: #000000;">0006</span><span style="color: #000000;">,</span><span style="color: #000000;">0244</span><span style="color: #000000;">)&nbsp;Flags:&nbsp;</span><span style="color: #000000;">00000884</span><span style="color: #000000;">&nbsp;&nbsp;Mdl:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;88c4e9a0:&nbsp;(</span><span style="color: #000000;">0006</span><span style="color: #000000;">,</span><span style="color: #000000;">0244</span><span style="color: #000000;">)&nbsp;Flags:&nbsp;</span><span style="color: #000000;">00000884</span><span style="color: #000000;">&nbsp;&nbsp;Mdl:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;894d39a0:&nbsp;(</span><span style="color: #000000;">0006</span><span style="color: #000000;">,</span><span style="color: #000000;">0244</span><span style="color: #000000;">)&nbsp;Flags:&nbsp;</span><span style="color: #000000;">00000884</span><span style="color: #000000;">&nbsp;&nbsp;Mdl:&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Not&nbsp;impersonating<br /></span><span style="color: #000000;">DeviceMap&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8e12ea70<br /></span><span style="color: #000000;">Owning&nbsp;Process&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">89020508</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Image:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #3366ff;">IMJPCMNT.E</span><span style="color: #3366ff;">XE</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Wait&nbsp;Start&nbsp;TickCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">4518</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ticks:&nbsp;</span><span style="color: #000000;">32555</span><span style="color: #000000;">&nbsp;(</span><span style="color: #000000;">0</span><span style="color: #000000;">:</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">08</span><span style="color: #000000;">:</span><span style="color: #000000;">27.861</span><span style="color: #000000;">)<br /></span><span style="color: #000000;">Context&nbsp;Switch&nbsp;Count&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">330</span><span style="color: #000000;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /></span><span style="color: #000000;">UserTime&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00.000</span><span style="color: #000000;"><br /></span><span style="color: #000000;">KernelTime&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00</span><span style="color: #000000;">:</span><span style="color: #000000;">00.031</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Win32&nbsp;Start&nbsp;Address&nbsp;</span><span style="color: #000000;">0x697ee751</span><span style="color: #000000;"><br /></span><span style="color: #000000;">Stack&nbsp;Init&nbsp;b44c7fd0&nbsp;Current&nbsp;b44c6550&nbsp;Base&nbsp;b44c8000&nbsp;Limit&nbsp;b44c5000&nbsp;Call&nbsp;6a0<br /></span><span style="color: #000000;">Priority&nbsp;</span><span style="color: #000000;">10</span><span style="color: #000000;">&nbsp;BasePriority&nbsp;</span><span style="color: #000000;">8</span><span style="color: #000000;">&nbsp;PriorityDecrement&nbsp;</span><span style="color: #000000;">16</span><span style="color: #000000;">&nbsp;IoPriority&nbsp;</span><span style="color: #000000;">2</span><span style="color: #000000;">&nbsp;PagePriority&nbsp;</span><span style="color: #000000;">5</span><span style="color: #000000;"><br /></span><span style="color: #000000;">***</span><span style="color: #000000;">&nbsp;ERROR:&nbsp;Module&nbsp;load&nbsp;completed&nbsp;but&nbsp;symbols&nbsp;could&nbsp;not&nbsp;be&nbsp;loaded&nbsp;</span><span style="color: #000000;">for</span><span style="color: #000000;">&nbsp;flyfs.sys<br /></span><span style="color: #000000;">ChildEBP&nbsp;RetAddr&nbsp;&nbsp;Args&nbsp;to&nbsp;Child&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br /></span><span style="color: #000000;">b44c6568&nbsp;836aca58&nbsp;</span><span style="color: #000000;">89484568</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;807c2120&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiSwapContext</span><span style="color: #000000;">+</span><span style="color: #000000;">0x26</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Uses&nbsp;EBP]&nbsp;[</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">0</span><span style="color: #000000;">,</span><span style="color: #000000;">4</span><span style="color: #000000;">])<br /></span><span style="color: #000000;">b44c65a0&nbsp;836ab113&nbsp;</span><span style="color: #000000;">89484628</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">89484568</span><span style="color: #000000;">&nbsp;b44c6680&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiSwapThread</span><span style="color: #000000;">+</span><span style="color: #000000;">0x266</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c65c8&nbsp;836a524f&nbsp;</span><span style="color: #000000;">89484568</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">89484628</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KiCommitThreadWait</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1df</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6640&nbsp;8bd6054f&nbsp;b44c6680&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">KeWaitForSingleObject</span><span style="color: #000000;">+</span><span style="color: #000000;">0x393</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c66a8&nbsp;8bd5c54a&nbsp;8bd5c4aa&nbsp;894d5c90&nbsp;</span><span style="color: #000000;">00000003</span><span style="color: #000000;">&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpPostSyncOperation</span><span style="color: #000000;">+</span><span style="color: #000000;">0x8d</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c66cc&nbsp;8bd59765&nbsp;894d5c90&nbsp;</span><span style="color: #000000;">89435060</span><span style="color: #000000;">&nbsp;894d5c90&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpGetNormalizedFileName</span><span style="color: #000000;">+</span><span style="color: #000000;">0x5e</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c66e4&nbsp;8bd43773&nbsp;894d5c90&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;894d5c90&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpCreateFileNameInformation</span><span style="color: #000000;">+</span><span style="color: #000000;">0x81</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c6704&nbsp;8bd438c7&nbsp;877273c0&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">HandleStreamListNotSupported</span><span style="color: #000000;">+</span><span style="color: #000000;">0x125</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c6734&nbsp;8bd43fa3&nbsp;c00000bb&nbsp;</span><span style="color: #000000;">89435068</span><span style="color: #000000;">&nbsp;87b287d8&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpGetFileNameInformation</span><span style="color: #000000;">+</span><span style="color: #000000;">0xc7</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c675c&nbsp;8bd97a1d&nbsp;</span><span style="color: #000000;">00435068</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000101</span><span style="color: #000000;">&nbsp;b3187e2c&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltGetFileNameInformation</span><span style="color: #000000;">+</span><span style="color: #000000;">0x12b</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c67d4&nbsp;8bd892be&nbsp;</span><span style="color: #000000;">89435068</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000101</span><span style="color: #000000;">&nbsp;b3187e2c&nbsp;syscow32v</span><span style="color: #000000;">!</span><span style="color: #000000;">SysCowGetFileNameInformation</span><span style="color: #000000;">+</span><span style="color: #000000;">0xcd</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])&nbsp;(CONV:&nbsp;stdcall)&nbsp;[d:\code\engineering\products\systemok\restore\driver\support.cpp&nbsp;@&nbsp;</span><span style="color: #000000;">2397</span><span style="color: #000000;">]<br /></span><span style="color: #000000;">b44c6868&nbsp;8bd3daeb&nbsp;</span><span style="color: #000000;">89435068</span><span style="color: #000000;">&nbsp;b44c6888&nbsp;b44c68b4&nbsp;syscow32v</span><span style="color: #000000;">!</span><span style="color: #000000;">SysCowPreCreate</span><span style="color: #000000;">+</span><span style="color: #000000;">0x31e</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])&nbsp;(CONV:&nbsp;stdcall)&nbsp;[d:\code\engineering\products\systemok\restore\driver\create.cpp&nbsp;@&nbsp;</span><span style="color: #000000;">299</span><span style="color: #000000;">]<br /></span><span style="color: #000000;">b44c68d4&nbsp;8bd409f0&nbsp;b44c6918&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpPerformPreCallbacks</span><span style="color: #000000;">+</span><span style="color: #000000;">0x34d</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c68ec&nbsp;8bd541fe&nbsp;b44c6918&nbsp;8bd57f3c&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpPassThroughInternal</span><span style="color: #000000;">+</span><span style="color: #000000;">0x40</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c6900&nbsp;8bd548b7&nbsp;b44c6918&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;89493b98&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpCreateInternal</span><span style="color: #000000;">+</span><span style="color: #000000;">0x24</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c6944&nbsp;8367a567&nbsp;87e5d668&nbsp;</span><span style="color: #000000;">87727008</span><span style="color: #000000;">&nbsp;89493bbc&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpCreate</span><span style="color: #000000;">+</span><span style="color: #000000;">0x2c9</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])<br /></span><span style="color: #000000;">b44c695c&nbsp;8bda7bd1&nbsp;89493ba0&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;892be848&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IofCallDriver</span><span style="color: #000000;">+</span><span style="color: #000000;">0x63</span><span style="color: #000000;"><br /></span><span style="color: #000000;">WARNING:&nbsp;Stack&nbsp;unwind&nbsp;information&nbsp;not&nbsp;available.&nbsp;Following&nbsp;frames&nbsp;may&nbsp;be&nbsp;wrong.<br /></span><span style="color: #000000;">b44c6980&nbsp;8bda91ec&nbsp;87e5d7b0&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;b44c6a30&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x1bd1</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c699c&nbsp;8bda94f3&nbsp;87e5d7b0&nbsp;0000001b&nbsp;894dab28&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x31ec</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6a50&nbsp;8bda9f60&nbsp;87e5d7b0&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;b44c6a70&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x34f3</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6a60&nbsp;8bda9f8a&nbsp;87e5d7b0&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;b44c6a88&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3f60</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6a70&nbsp;8367a567&nbsp;87e5d7b0&nbsp;</span><span style="color: #000000;">89493980</span><span style="color: #000000;">&nbsp;894dab84&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3f8a</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6a88&nbsp;8387e5f5&nbsp;9ce1a1da&nbsp;b44c6c30&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IofCallDriver</span><span style="color: #000000;">+</span><span style="color: #000000;">0x63</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6b60&nbsp;8385f1a7&nbsp;876f0678&nbsp;87f6dde8&nbsp;89403d20&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopParseDevice</span><span style="color: #000000;">+</span><span style="color: #000000;">0xed7</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6bdc&nbsp;</span><span style="color: #000000;">83885215</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;b44c6c30&nbsp;</span><span style="color: #000000;">00000240</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ObpLookupObjectName</span><span style="color: #000000;">+</span><span style="color: #000000;">0x4fa</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6c3c&nbsp;8387d573&nbsp;b44c6dc0&nbsp;85f6dde8&nbsp;</span><span style="color: #000000;">89484500</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ObOpenObjectByName</span><span style="color: #000000;">+</span><span style="color: #000000;">0x159</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6cb8&nbsp;838b4d59&nbsp;b44c6e04&nbsp;</span><span style="color: #000000;">00120089</span><span style="color: #000000;">&nbsp;b44c6dc0&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopCreateFile</span><span style="color: #000000;">+</span><span style="color: #000000;">0x673</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6d14&nbsp;83806c27&nbsp;b44c6e04&nbsp;</span><span style="color: #000000;">00120089</span><span style="color: #000000;">&nbsp;b44c6dc0&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IoCreateFileEx</span><span style="color: #000000;">+</span><span style="color: #000000;">0x9e</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6d70&nbsp;8bdac7c7&nbsp;b44c6e04&nbsp;</span><span style="color: #000000;">00120089</span><span style="color: #000000;">&nbsp;b44c6dc0&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IoCreateFileSpecifyDeviceObjectHint</span><span style="color: #000000;">+</span><span style="color: #000000;">0x59</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6e10&nbsp;8bda9593&nbsp;0000004d&nbsp;b44c6ec0&nbsp;87e5d7b0&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x67c7</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6ec8&nbsp;8bda9f60&nbsp;87e5d7b0&nbsp;894d6db8&nbsp;b44c6ee8&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3593</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6ed8&nbsp;8bda9f8a&nbsp;87e5d7b0&nbsp;894d6db8&nbsp;b44c6f00&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3f60</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6ee8&nbsp;8367a567&nbsp;87e5d7b0&nbsp;894d6db8&nbsp;892e76ac&nbsp;flyfs</span><span style="color: #000000;">+</span><span style="color: #000000;">0x3f8a</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6f00&nbsp;8387e5f5&nbsp;9ce1a562&nbsp;b44c70a8&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IofCallDriver</span><span style="color: #000000;">+</span><span style="color: #000000;">0x63</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c6fd8&nbsp;8385f1a7&nbsp;876f0678&nbsp;85f6dde8&nbsp;894d8698&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopParseDevice</span><span style="color: #000000;">+</span><span style="color: #000000;">0xed7</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c7054&nbsp;</span><span style="color: #000000;">83885215</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;b44c70a8&nbsp;</span><span style="color: #000000;">00000240</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ObpLookupObjectName</span><span style="color: #000000;">+</span><span style="color: #000000;">0x4fa</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c70b0&nbsp;8387d573&nbsp;b44c71d8&nbsp;85f6dde8&nbsp;</span><span style="color: #000000;">00010000</span><span style="color: #000000;">&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">ObOpenObjectByName</span><span style="color: #000000;">+</span><span style="color: #000000;">0x159</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c712c&nbsp;838b4d59&nbsp;894d5490&nbsp;</span><span style="color: #000000;">00100001</span><span style="color: #000000;">&nbsp;b44c71d8&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IopCreateFile</span><span style="color: #000000;">+</span><span style="color: #000000;">0x673</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c7188&nbsp;8bd5b8e5&nbsp;894d5490&nbsp;</span><span style="color: #000000;">00100001</span><span style="color: #000000;">&nbsp;b44c71d8&nbsp;nt</span><span style="color: #000000;">!</span><span style="color: #000000;">IoCreateFileEx</span><span style="color: #000000;">+</span><span style="color: #000000;">0x9e</span><span style="color: #000000;"><br /></span><span style="color: #000000;">b44c7220&nbsp;8bd5bc59&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;</span><span style="color: #000000;">00000000</span><span style="color: #000000;">&nbsp;0000fffe&nbsp;fltmgr</span><span style="color: #000000;">!</span><span style="color: #000000;">FltpExpandFilePathWorker</span><span style="color: #000000;">+</span><span style="color: #000000;">0x167</span><span style="color: #000000;">&nbsp;(FPO:&nbsp;[Non</span><span style="color: #000000;">-</span><span style="color: #000000;">Fpo])</span></div><br /><span style="color: #3366ff;"></span>IMJPCMNT.EXE是Microsoft输入法进程。<br /><br /><br /><p ><span style="font-size: 14pt; font-family: Arial;"></span><span style="font-size: 14pt;" lang="EN-US"><o:p></o:p></span></p><img src="http://www.cnblogs.com/Sonic2007/aggbug/1541988.html?type=1" width="1" height="1" alt=""/><p><a href="http://www.cnblogs.com/Sonic2007/archive/2010/09/01/1541988.html" target="_blank">本文链接</a></p>http://www.cnblogs.com/Sonic2007/archive/2009/07/29/1534025.html

一、可重入函数1）什么是可重入性？可重入（reentrant）函数可以由多于一个任务并发使用，而不必担心数据错误。相反， 不可重入（non-reentrant）函数不能由超过一个任务所共享，除非能确保函数的互斥（或者使用信号量，或者在代码的关键部分禁用中断）。可重入 函数可以在任意时刻被中断，稍后再继续运行，不会丢失数据。可重入函数要么使用本地变量，要么在使用全局变量时保护自己的数据。2）可重入函...

2009-07-29T05:52:00Z2009-07-29T05:52:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2009/05/29/1491809.html

一直觉得很多文档对于dump文件分析过于简要，而且其中介绍的很多命令在实际操作中并不实用。其实Raymond老师在《软件调试》一书中已做了很大篇幅详细的讲解。自己感觉有必要总结一下这些零碎的细节点，以便自己和其它的技术爱好者分析时一起参考。

2009-05-29T13:35:00Z2009-05-29T13:35:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2009/05/07/1452239.html

在InfoQ上看到了这个“开发者面试百问”，知识点不少，CSDN上也有不少技术圈子的朋友在做这些questions。自己也有些兴趣，捡会的随便写了一些，不会的都空下了。最后看看不知道的还真不少，以后要多关注一下。

2009-05-07T14:04:00Z2009-05-07T14:04:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2008/07/08/1238167.html

任何时候系统内存资源相对磁盘空间来说都是相形见拙的。因为虚拟内存机制，使我们可以有相对丰富的地址资源(通常32bit的虚拟地址，可以有4G的寻址空间)，而这些资源对物理内存来说一般情况是总是绰绰有余的。所以在现代操作系统中，总是在相对紧张时使用一些策略，如FIFO、LRU等将物理内存的一些页面置入相对便宜的磁盘空间资源中。一般的UNIX系统，独立使用一个分区，即swappartition。而这方面...

2008-07-08T06:27:00Z2008-07-08T06:27:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2008/06/23/1228290.html

C++字符串完全指引之二 —— 字符串封装类原著：Michael Dunn原文出处：CodeProject：TheComplete Guide to C++ Strings, Part II 引言因为C语言风格的字符串容易出错且不易管理，黑客们甚至利用可能存在的缓冲区溢出bug把C语言风格的字符串作为攻击目标，所以出现了很多字符串封装类。不幸的是，在某些场合下我们不知道该使用哪个字符串类，也不知道...

2008-06-23T08:39:00Z2008-06-23T08:39:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2008/05/24/1150763.html

.NET委托技术浅析

2008-05-24T10:20:00Z2008-05-24T10:20:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2008/03/27/1125632.html

Windbg调试过滤驱动过程

2008-03-27T13:16:00Z2008-03-27T13:16:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2008/03/25/1122125.html

CLR应用程序域概述

2008-03-25T14:25:00Z2008-03-25T14:25:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/http://www.cnblogs.com/Sonic2007/archive/2008/03/22/1117538.html

Windbg内核调试之二: 常用命令

2008-03-22T04:30:00Z2008-03-22T04:30:00ZDa Vincihttp://www.cnblogs.com/Sonic2007/