Re: 关于中断&dpc定时器

Windows内核调试

关于中断&dpc定时器

特来劲同学 2010-12-18, 11:20 上午

我在调试的过程中，发现某一个定时器dpc被频繁的调用，如下
f7a18e64 ee18635e 804f4758 861ec4f0 00000000 xxxxx+0x268a
f7a18e88 80500d88 80552840 00000000 f429d6f8 xxxxx+0x635e
f7a18fa4 80500e9f 3e42cc71 0000001e ffdff000 nt!KiTimerListExpire+0x122 (FPO: [0,62,0])
f7a18fd0 80542b8d 80553da0 00000000 000caf56 nt!KiTimerExpiration+0xaf (FPO: [4,6,0])
f7a18ff4 8054285a eebedb44 00000000 00000000 nt!KiRetireDpcList+0x46 (FPO: [0,0,0])
f7a18ff8 eebedb44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a (FPO: [Uses EBP] [0,0,1])
8054285a 00000000 00000009 bb835675 00000128 0xeebedb44
请问下各位前辈和老师，如何找到相应的定时器对象？如何查找到当前指令时在哪个中断处理中？（也有可能是系统时钟中断，但怎么能看到？）

Re: 关于中断&dpc定时器

特来劲同学 2010-12-18, 11:57 上午

刚才又调试了下，又发现一个疑问

kd> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
f7a18e64 ee18635e xxxxx+0x268a
f7a18e88 80500d88 xxxxx+0x635e
f7a18fa4 80500e9f nt!KiTimerListExpire+0x122
f7a18fd0 80542b8d nt!KiTimerExpiration+0xaf
f7a18ff4 8054285a nt!KiRetireDpcList+0x46
f7a18ff8 ee2a2c04 nt!KiDispatchInterrupt+0x2a
8054285a 00000000 0xee2a2c04
kd> !thread
THREAD 86340a38 Cid 05ac.04e4 Teb: 7ffdd000 Win32Thread: e11a6348 RUNNING on processor 0
IRP List:
    8618fae0: (0006,0190) Flags: 00000030 Mdl: 861627a8
    86335bd8: (0006,0190) Flags: 00000030 Mdl: 866b78b0
    86720630: (0006,0190) Flags: 00000000 Mdl: 00000000
Not impersonating
DeviceMap                 e1b08420
Owning Process            0       Image:         <Unknown>
Attached Process          861d8540       Image:         XXXX.exe
Wait Start TickCount      110483         Ticks: 1 (0:00:00:00.015)
Context Switch Count      462724                 LargeStack
UserTime                  00:00:53.437
KernelTime                00:14:32.328
Win32 Start Address XXXX (0x0225817b)
Start Address kernel32!BaseProcessStartThunk (0x7c8106f5)
Stack Init ee2a3000 Current ee2a2b94 Base ee2a3000 Limit ee29e000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 DecrementCount 16
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f7a18e64 ee18635e 804f4758 8634a030 00000000 xxxxx+0x268a
f7a18e88 80500d88 80552840 00000000 7f440a14 xxxxx+0x635e
f7a18fa4 80500e9f 04f66208 00000004 ffdff000 nt!KiTimerListExpire+0x122 (FPO: [0,62,0])
f7a18fd0 80542b8d 80553da0 00000000 0001af94 nt!KiTimerExpiration+0xaf (FPO: [4,6,0])
f7a18ff4 8054285a ee2a2c04 00000000 00000000 nt!KiRetireDpcList+0x46 (FPO: [0,0,0])
f7a18ff8 ee2a2c04 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a (FPO: [Uses EBP] [0,0,1])
8054285a 00000000 00000009 bb835675 00000128 0xee2a2c04

dpc不是在一个特定的内核栈中执行的么？怎么2个k命令显示的结果是一样？求老师和各位前辈教育