\nA particular scenario was hanging,\nand the team responsible for the scenario debugged it to the\npoint where they saw that their X component was\nwaiting for their Y component, which was waiting for Explorer,\nso they asked for help chasing the hang into Explorer.\n<\/P>\n
\nThe team was kind enough to have shared what they’ve learned\nso far:\n<\/P>\n
\nkd> !alpc<\/A> \/m 9c14d020<\/p>\nMessage 9c14d020\n MessageID : 0x0274 (628)\n CallbackID : 0xCCA5 (52389)\n SequenceNumber : 0x00000016 (22)\n Type : LPC_REQUEST\n DataLength : 0x0094 (148)\n TotalLength : 0x00AC (172)\n Canceled : No\n Release : No\n ReplyWaitReply : No\n Continuation : Yes\n OwnerPort : 82bb9db8 [ALPC_CLIENT_COMMUNICATION_PORT]\n WaitingThread : 834553c0\n QueueType : ALPC_MSGQUEUE_MAIN\n QueuePort : 84646730 [ALPC_CONNECTION_PORT]\n QueuePortOwnerProcess : 846209c0 (explorer.exe)\n ServerThread : 00000000 <———————–\n QuotaCharged : No\n CancelQueuePort : 00000000\n CancelSequencePort : 00000000\n CancelSequenceNumber : 0x00000000 (0)\n ClientContext : 02a56b80\n ServerContext : 00000000\n PortContext : 0701ea20\n CancelPortContext : 00000000\n SecurityData : 962f89b8\n View : 00000000\nkd> !process 846209c0 0\nPROCESS 846209c0 SessionId: 1 Cid: 0804 Peb: 7fbac000 ParentCid: 0724\n DirBase: 3e546380 ObjectTable: 97195300 HandleCount: 1041.\n Image: explorer.exe\n<\/PRE>\n
\nYikes, there is no thread signed up to service the request.\n<\/P>\n
\nI don’t know much about ALPC,\nbut I can fumble around.\nFortunately, this is debugging and not rocket surgery,\nso you still get full points if you stumble across the answer\nby guessing.\n<\/P>\n
\nI decided to start guessing by looking at what the\n
!alpc<\/CODE> command can tell me.\n<\/P>\n\nkd> !alpc -?<\/p>\n!alpc \/m MessageAddress\n Dumps the message at the specified address.<\/p>\n
!alpc \/p PortAddress\n Dumps the port at the specified address.\n<\/PRE>\n
\nWell, I already saw what the result was for dumping the message,\nso I may as well dump the port.\n<\/P>\n
\nkd> !alpc \/p 84646730<\/p>\n…\n 8 thread(s) are registered with port IO completion object:\n THREAD 84658d40 Cid 0804.0888 Teb: 7fa7e000 Win32Thread: 8214a748 WAIT\n THREAD 8466a040 Cid 0804.08c4 Teb: 7fa74000 Win32Thread: 8214c800 WAIT\n THREAD 84659a00 Cid 0804.08ec Teb: 7fa72000 Win32Thread: 82158d08 WAIT\n THREAD 8466c8c0 Cid 0804.08f0 Teb: 7fa6e000 Win32Thread: 82160420 WAIT\n THREAD 84671040 Cid 0804.0910 Teb: 7fa68000 Win32Thread: 8217c4e8 WAIT\n THREAD 8460d180 Cid 0804.099c Teb: 7fa5e000 Win32Thread: 820bad08 WAIT\n THREAD 834278c0 Cid 0804.0c80 Teb: 7fa6b000 Win32Thread: 820b9620 WAIT\n THREAD 8345ad40 Cid 0804.0da0 Teb: 7fba9000 Win32Thread: 821c6d08 WAIT\n…\n<\/PRE>\n
\nSo it looks like there are eight threads signed up to process\nevents on this port.\n(Is that what this means?\nI don’t know, but I’m going to assume that it does,\nbecause this is debugging.\nDebugging is an exercise in optimism.)\nLet’s see what they’re doing.\n<\/P>\n
\nkd> .thread 84658d40;k\nImplicit thread is now 84658d40\n *** Stack trace for last set context – .thread\/.cxr resets it\nChildEBP RetAddr\n940ef394 80f1505f nt!KiSwapContext+0x19\n940ef3d0 80f184e0 nt!KiSwapThread+0x34b\n940ef3fc 80f163fc nt!KiCommitThreadWait+0x26f\n940ef46c 80f4d2df nt!KeWaitForSingleObject+0x459\n940ef4b4 80e20838 nt!KiSchedulerApc+0x298\n940ef4c8 00000000 hal!KfLowerIrql+0x2c<\/p>\n[the others look the same]\n<\/PRE>\n
\nWell, I don’t know what they’re doing, but it looks like they’re\nwaiting for something.\nBut one of the threads looks different:\n<\/P>\n
\nkd> .thread 84671040;k\nImplicit thread is now 84671040\n *** Stack trace for last set context – .thread\/.cxr resets it\nChildEBP RetAddr\n9415f864 80f1505f nt!KiSwapContext+0x19\n9415f8a0 80f184e0 nt!KiSwapThread+0x34b\n9415f8cc 80eb3d6e nt!KiCommitThreadWait+0x26f\n9415f934 810c0527 nt!KeWaitForMultipleObjects+0x4e3\n9415fbe4 810c0703 nt!ObWaitForMultipleObjects+0x2fd\n9415fd38 80ef113c nt!NtWaitForMultipleObjects+0xca\n9415fd38 77945e04 nt!KiFastCallEntry+0x12c\n07e2f1c4 779437f6 ntdll!KiFastSystemCallRet\n07e2f1c8 7515c136 ntdll!NtWaitForMultipleObjects+0xa\n07e2f34c 77752658 KERNELBASE!WaitForMultipleObjectsEx+0xee\n07e2f368 777fbe60 KERNEL32!WaitForMultipleObjects+0x19\n07e2f3d4 777fc5de KERNEL32!WerpReportFaultInternal+0x1a3\n07e2f3e8 777df654 KERNEL32!WerpReportFault+0x6d\n07e2f3f4 751e517c KERNEL32!BasepReportFault+0x19\n07e2f490 77a0f95a KERNELBASE!UnhandledExceptionFilter+0x1e0\n07e2f4a0 77a0fd4d ntdll!TppExceptionFilter+0x1b\n07e2f4b4 77a1c66b ntdll!TppWorkerpInnerExceptionFilter+0x13\n07e2fb34 77753278 ntdll!TppWorkerThread+0xa6092\n07e2fb40 779761a6 KERNEL32!BaseThreadInitThunk+0xe\n07e2fb80 77976152 ntdll!__RtlUserThreadStart+0x4a\n07e2fb90 00000000 ntdll!_RtlUserThreadStart+0x1c\n<\/PRE>\n\nAh, well that explains why Explorer isn’t responding:\nIt crashed on an unhandled exception!\nWindows Error Reporting is busy trying to generate a report.\n<\/P>\n
\nNow to see what the crash was.\nI don’t know for sure, but I’m pretty confident that one\nof the parameters to\n
BasepReportFault<\/CODE> is\nanEXCEPTION_POINTERS<\/CODE>.\nWhy am I confident of that?\nBecause it would be hard to report the fault without it!\n<\/P>\n\nkd> dd 07e2f3f4 l4\n07e2f3f4 07e2f490 77a0f95a 07e2f4e8 00000001\n ChildEBP RetAddr Param1<\/p>\nkd> dd 07e2f4e8 l2\n07e2f4e8 07e2f620 07e2f63c \n ^ ^\n ExceptionRecord ContextRecord\nkd> .cxr 0x07e2f63c\neax=00000000 ebx=0451e2f8 ecx=e2af034f edx=77945e00 esi=00000000 edi=0451e2e0\neip=1df7fc6a esp=07e2f920 ebp=07e2f938 iopl=0 nv up ei pl zr na pe nc\ncs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246\ncontoso!ContosoPower::Disconnect+0xdd:\n001b:1df7fc6a 8b08 mov ecx,dword ptr [eax] ds:0023:00000000=????????\n<\/PRE>\n
\nAha, Explorer crashed due to a null pointer crash in the\n
ContosoPower::Disconnect<\/CODE>\nfunction.\n<\/P>\n\nPassing the buck onward to Contoso,\nthe report back was that this was a known issue,\nand a hotfix was available.\n<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
A particular scenario was hanging, and the team responsible for the scenario debugged it to the point where they saw that their X component was waiting for their Y component, which was waiting for Explorer, so they asked for help chasing the hang into Explorer. The team was kind enough to have shared what they’ve learned so […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-5233","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
A particular scenario was hanging, and the team responsible for the scenario debugged it to the point where they saw that their X component was waiting for their Y component, which was waiting for Explorer, so they asked for help chasing the hang into Explorer. The team was kind enough to have shared what they’ve learned so […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/5233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=5233"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/5233\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=5233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=5233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=5233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}