|
win7 64，故障现象是桌面快捷方式点不动，但是win键、右击任务栏有反应。explorer进程cpu很低。连下了4个dmp，发现explorer的前5个线程一动不动。 分析0号线程的kb，如图  想知道它Wait那个Object。但是从栈区数据上很难逆向出实际参数是啥。改用!cmkd.stack -p来解析WaitMulityObjectEx的实际入参 0:000> !cmkd.stack -p
Call Stack : 128 frames
## Stack-Pointer Return-Address Call-Site
00 00000000001497b8 000007fefce71420 ntdll!NtWaitForMultipleObjects+a
Parameter[0] = 0000000000000002
Parameter[1] = 0000000000149860
Parameter[2] = (unknown)
Parameter[3] = 0000000000000000
01 00000000001497c0 0000000076f71273 KERNELBASE!WaitForMultipleObjectsEx+e8
Parameter[0] = 0000000000000002
Parameter[1] = 00000000001498f0
Parameter[2] = 0000000000000000
Parameter[3] = 00000000000003e8
02 00000000001498c0 0000000077088f8d kernel32!WaitForMultipleObjectsExImplementation+b3 (perf)
Parameter[0] = 0000000000000002
Parameter[1] = 0000000000000000
Parameter[2] = 0000000000000000
Parameter[3] = 00000000000003e8
03 0000000000149950 0000000077086272 user32!RealMsgWaitForMultipleObjectsEx+12a
Parameter[0] = 0000000000000001
Parameter[1] = 0000000000149ad8
Parameter[2] = 00000000000003e8
Parameter[3] = (unknown) 随后解析handle*， 0:000> dq 00000000001498f0
00000000`001498f0 00000000`000012cc 00000000`0000002c 但是!handle就报错了 0:000> !handle 00000000`000012cc
Handle 00000000000012cc
Type <Error retrieving type>
0:000> !handle 00000000`0000002c
Handle 000000000000002c
Type <Error retrieving type> Error retrieving type不知道是咋回事。 亦或是对此故障，有什么看法，还盼大家不吝赐教。
|