admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

thread wait analysis now detects NtQueryObject hangs

Browse Source 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1463 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2009-06-25 06:55:13 +00:00
parent 6bbf2bd724
commit 0300fc1d0e
3 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trunk/CHANGELOG.txt
+1
View File
@@ -11,6 +11,7 @@ Process Hacker
colors
* Terminator test: TP1a (TP1, alternative method)
* Terminator test: TT1a (TT1, alternative method)
* Thread wait analysis now detects NtQueryObject hangs
* Small performance improvements
* FIXED:
* Broken system thread start addresses due to sign-extending
trunk/ProcessHacker.Native/Api/Functions.cs
+1 -1
View File
@@ -596,7 +596,7 @@ namespace ProcessHacker.Native.Api
[DllImport("kernel32.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool GetNamedPipeHandleState(
[In] int NamedPipeHandle,
[In] IntPtr NamedPipeHandle,
[Out] [Optional] out PipeState State,
[Out] [Optional] out int CurInstances,
[Out] [Optional] out int MaxCollectionCount,
trunk/ProcessHacker/Components/ThreadList.cs
+21 -4
View File
@@ -932,6 +932,23 @@ namespace ProcessHacker.Components
sb.AppendLine(this.GetHandleString(_pid, handle));
}
else if (
name.StartsWith("ntdll.dll!ntqueryobject") ||
name.StartsWith("ntdll.dll!zwqueryobject")
)
{
found = true;
IntPtr handle = stackFrame.Params[0];
// Use the KiFastSystemCallRet args if the handle we have is wrong.
if (handle.ToInt32() % 2 != 0 || handle == IntPtr.Zero)
handle = lastParams[1];
sb.AppendLine("Thread " + tid.ToString() + " is querying an object (most likely a named pipe):");
sb.AppendLine(this.GetHandleString(_pid, handle));
}
else if (
name.StartsWith("ntdll.dll!zwreadfile") ||
name.StartsWith("ntdll.dll!ntreadfile") ||
@@ -1025,9 +1042,9 @@ namespace ProcessHacker.Components
}
else if (
name.StartsWith("ntdll.dll!zwwaitforkeyedevent") ||
name.StartsWith("ntdll.dll!ntwaitforkeyedevent") ||
name.StartsWith("ntdll.dll!ntwaitforkeyedevent") ||
name.StartsWith("ntdll.dll!zwreleasekeyedevent") ||
name.StartsWith("ntdll.dll!ntreleasekeyedevent")
name.StartsWith("ntdll.dll!ntreleasekeyedevent")
)
{
found = true;
@@ -1035,8 +1052,8 @@ namespace ProcessHacker.Components
IntPtr handle = stackFrame.Params[0];
IntPtr key = stackFrame.Params[1];
sb.AppendLine("Thread " + tid.ToString() +
" is waiting (" + name + ") for a keyed event (key 0x" +
sb.AppendLine("Thread " + tid.ToString() +
" is waiting (" + name + ") for a keyed event (key 0x" +
key.ToString("x") + "):");
sb.AppendLine(this.GetHandleString(_pid, handle));