\nHumans are distinguished among all animal species by their advanced\ndevelopment of and heavy reliance on tools.\nDon’t betray your ancestors.\nUse those tools you have.\n<\/P>\n
\nFor example, during the debugging of a thread pool problem,\nit looked like somebody did a \nI did a little legwork and contributed the following analysis\nto the mail thread:\n<\/P>\n \nOf all the DLLs loaded into the process,\nthe following call \nSHLWAPI.dll 77D72436 221 PostThreadMessageA \nOf those DLLs, these also call \nshlwapi.dll \nAstounded, somebody wanted to know how I came up with that list.\n<\/P>\n \nNothing magic.\nYou have the tools,\nyou have a brain,\nso connect the dots.\n<\/P>\n \nThe \nScrape the results off the screen, prune out the misses,\nand there you have it.\n<\/P>\n \n“I tried that, but the result wasn’t in the same format as what you posted.”\n<\/P>\n \nWell, yeah.\nThere’s no law that says that I can’t manually reformat the data\nbefore presenting it in an email message.\nSince there were only a dozen hits,\nit’s not worth writing a script\nto do that type of data munging.\nTyping “backspace, home, up-arrow” twelve times\nis a lot faster than writing a script to take the output of\nthe above batch file and turn it into the output I used in the\nemail message.\n<\/P>\n \nAnother boring batch file filters the list to those DLLs that\nalso call \nNo rocket science here.\nJust taking a bunch of tools and putting them together to solve\na problem.\nThat’s what your brain is for, after all.\n<\/P><\/p>\n","protected":false},"excerpt":{"rendered":" Humans are distinguished among all animal species by their advanced development of and heavy reliance on tools. Don’t betray your ancestors. Use those tools you have. For example, during the debugging of a thread pool problem, it looked like somebody did a PostThreadMessage to a thread pool thread and left the message unprocessed after the […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-21403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":" Humans are distinguished among all animal species by their advanced development of and heavy reliance on tools. Don’t betray your ancestors. Use those tools you have. For example, during the debugging of a thread pool problem, it looked like somebody did a PostThreadMessage to a thread pool thread and left the message unprocessed after the […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/21403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=21403"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/21403\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=21403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=21403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=21403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}PostThreadMessage<\/CODE>\nto a thread pool thread and left the message unprocessed after\nthe thread pool function returned.\nWho could it have been?\nWell, one idea was to see if there were any DLLs in the system\nwhich called both QueueUserWorkItem<\/CODE> and\nPostThreadMessage<\/CODE>.\n<\/P>\n\n
PostThreadMessage<\/CODE>:\n<\/P>\n
\nSHELL32.dll 77D78596 222 PostThreadMessageW
\nole32.dll 77D78596 222 PostThreadMessageW
\n… (list trimmed; you get the idea) …\n<\/P>\nQueueUserWorkItem<\/CODE>:\n<\/P>\n
\nshell32.dll
\n… (list trimmed; you get the idea) …\n<\/P>\n<\/BLOCKQUOTE>\nlm<\/CODE> debugger command lists all the DLLs loaded into\nthe process.\nCopy the output from the debugger window and paste it into a text\nfile.\nNow write a little script that takes each line of the text file\nand does a link \/dump \/imports<\/CODE> on the corresponding DLL.\nI happen to prefer perl for this sort of thing, but you can use\na boring batch file if you like.\n<\/P>\n\nfor \/f %i in (dlls.txt) do ^\n@echo %i & link \/dump \/imports %i | findstr PostThreadMessage\n<\/PRE>\n
QueueUserWorkItem<\/CODE>.\nWriting it (or a script in your favorite language) is left\nas an exercise.\n<\/P>\n