From 0300fc1d0e4e7912e56f043f0294c0dfd5d45724 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Thu, 25 Jun 2009 06:55:13 +0000
Subject: [PATCH] thread wait analysis now detects NtQueryObject hangs

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1463 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 trunk/CHANGELOG.txt                          |  1 +
 trunk/ProcessHacker.Native/Api/Functions.cs  |  2 +-
 trunk/ProcessHacker/Components/ThreadList.cs | 25 ++++++++++++++++----
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt
index f0320e0b6..491af158a 100644
--- a/trunk/CHANGELOG.txt
+++ b/trunk/CHANGELOG.txt
@@ -11,6 +11,7 @@ Process Hacker
      colors
    * Terminator test: TP1a (TP1, alternative method)
    * Terminator test: TT1a (TT1, alternative method)
+   * Thread wait analysis now detects NtQueryObject hangs
    * Small performance improvements
  * FIXED:
    * Broken system thread start addresses due to sign-extending 
diff --git a/trunk/ProcessHacker.Native/Api/Functions.cs b/trunk/ProcessHacker.Native/Api/Functions.cs
index 687be1678..35840e668 100644
--- a/trunk/ProcessHacker.Native/Api/Functions.cs
+++ b/trunk/ProcessHacker.Native/Api/Functions.cs
@@ -596,7 +596,7 @@ namespace ProcessHacker.Native.Api
         [DllImport("kernel32.dll", SetLastError = true)]
         [return: MarshalAs(UnmanagedType.Bool)]
         public static extern bool GetNamedPipeHandleState(
-            [In] int NamedPipeHandle, 
+            [In] IntPtr NamedPipeHandle, 
             [Out] [Optional] out PipeState State,
             [Out] [Optional] out int CurInstances,
             [Out] [Optional] out int MaxCollectionCount,
diff --git a/trunk/ProcessHacker/Components/ThreadList.cs b/trunk/ProcessHacker/Components/ThreadList.cs
index 4727fc2c0..e44ba92ce 100644
--- a/trunk/ProcessHacker/Components/ThreadList.cs
+++ b/trunk/ProcessHacker/Components/ThreadList.cs
@@ -932,6 +932,23 @@ namespace ProcessHacker.Components
 
                                 sb.AppendLine(this.GetHandleString(_pid, handle));
                             }
+                            else if (
+                                name.StartsWith("ntdll.dll!ntqueryobject") ||
+                                name.StartsWith("ntdll.dll!zwqueryobject")
+                                )
+                            {
+                                found = true;
+
+                                IntPtr handle = stackFrame.Params[0];
+
+                                // Use the KiFastSystemCallRet args if the handle we have is wrong.
+                                if (handle.ToInt32() % 2 != 0 || handle == IntPtr.Zero)
+                                    handle = lastParams[1];
+
+                                sb.AppendLine("Thread " + tid.ToString() + " is querying an object (most likely a named pipe):");
+
+                                sb.AppendLine(this.GetHandleString(_pid, handle));
+                            }
                             else if (
                                 name.StartsWith("ntdll.dll!zwreadfile") ||
                                 name.StartsWith("ntdll.dll!ntreadfile") ||
@@ -1025,9 +1042,9 @@ namespace ProcessHacker.Components
                             }
                             else if (
                                 name.StartsWith("ntdll.dll!zwwaitforkeyedevent") ||
-                                name.StartsWith("ntdll.dll!ntwaitforkeyedevent") || 
+                                name.StartsWith("ntdll.dll!ntwaitforkeyedevent") ||
                                 name.StartsWith("ntdll.dll!zwreleasekeyedevent") ||
-                                name.StartsWith("ntdll.dll!ntreleasekeyedevent") 
+                                name.StartsWith("ntdll.dll!ntreleasekeyedevent")
                                 )
                             {
                                 found = true;
@@ -1035,8 +1052,8 @@ namespace ProcessHacker.Components
                                 IntPtr handle = stackFrame.Params[0];
                                 IntPtr key = stackFrame.Params[1];
 
-                                sb.AppendLine("Thread " + tid.ToString() + 
-                                    " is waiting (" + name + ") for a keyed event (key 0x" + 
+                                sb.AppendLine("Thread " + tid.ToString() +
+                                    " is waiting (" + name + ") for a keyed event (key 0x" +
                                     key.ToString("x") + "):");
 
                                 sb.AppendLine(this.GetHandleString(_pid, handle));