如何确定哪个进程/线程拥有我的程序挂起的资源答案

【问题标题】：How can I work out which process/thread owns the resource that my program is hanging on如何确定哪个进程/线程拥有我的程序挂起的资源
【发布时间】：2014-06-11 18:15:55
【问题描述】：

我有一个在调用 NtClose 时挂起的用户模式进程。 NtClose 在尝试获取内核中的锁时挂起。我相信这是把手桌子的锁。这是堆栈的内核部分：

    THREAD fffffa800bd4fb50  Cid 277c.21d8  Teb: 000007fffff80000 Win32Thread: 0000000000000000 WAIT: (WrResource) KernelMode Non-Alertable
        fffffa80047bad20  SynchronizationEvent
    IRP List:
        fffffa80049f49c0: (0006,0430) Flags: 00000404  Mdl: 00000000
    Not impersonating
    DeviceMap                 fffff8a000008bc0
    Owning Process            fffffa800c195060       Image:         My_Service.exe
    Attached Process          N/A            Image:         N/A
    Wait Start TickCount      455527         Ticks: 223 (0:00:00:03.478)
    Context Switch Count      1703             
    UserTime                  00:00:00.015
    KernelTime                00:00:00.109
    Win32 Start Address 0x000000013f509190
    Stack Init fffff8800c3e0fb0 Current fffff8800c3e0790
    Base fffff8800c3e1000 Limit fffff8800c3db000 Call 0
    Priority 10 BasePriority 8 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    fffff880`0c3e07d0 fffff800`02ccc972 : fffffa80`0bd4fb50 fffffa80`0bd4fb50 fffff880`00000000 00000000`00000003 : nt!KiSwapContext+0x7a
    fffff880`0c3e0910 fffff800`02cddd8f : 00000000`00000000 fffff880`0af2d400 fffff880`00000068 fffff880`0af2d408 : nt!KiCommitThreadWait+0x1d2
    fffff880`0c3e09a0 fffff800`02cb7086 : 00000000`00000000 fffffa80`0000001b 00000000`00000000 fffff880`009eb100 : nt!KeWaitForSingleObject+0x19f
    fffff880`0c3e0a40 fffff800`02cdc1ac : ffffffff`fd9da600 fffffa80`047bad20 fffffa80`03e1d238 00000000`00000200 : nt!ExpWaitForResource+0xae
    fffff880`0c3e0ab0 fffff880`016e6f88 : 00000000`00000000 fffff8a0`0d555010 fffff880`0af2d840 fffff8a0`0a71e576 : nt!ExAcquireResourceExclusiveLite+0x14f
    fffff880`0c3e0b20 fffff880`01652929 : fffffa80`06fc72c0 fffffa80`049f49c0 fffff880`0af2d550 fffffa80`0bd4fb50 : Ntfs!NtfsCommonCleanup+0x2705
    fffff880`0c3e0f30 fffff800`02ccea37 : fffff880`0af2d550 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
    fffff880`0c3e0f60 fffff800`02cce9f8 : 00000000`00000000 00000000`00000000 fffff880`0c3e1000 fffff800`02ce2e42 : nt!KySwitchKernelStackCallout+0x27 (TrapFrame @ fffff880`0c3e0e20)
    fffff880`0af2d420 fffff800`02ce2e42 : 00000000`0000277c 00000000`00000002 00000000`00000002 fffff880`042f8965 : nt!KiSwitchKernelStackContinue
    fffff880`0af2d440 fffff880`016529a2 : fffff880`01652910 00000000`00000000 fffff880`0af2d800 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x2a2
    fffff880`0af2d520 fffff880`016f3894 : fffff880`0af2d5f0 fffff880`0af2d5f0 fffff880`0af2d5f0 fffff880`0af2d760 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
    fffff880`0af2d590 fffff880`01145bcf : fffff880`0af2d5f0 fffffa80`049f49c0 fffffa80`049f4da8 fffffa80`03ef5010 : Ntfs!NtfsFsdCleanup+0x144
    fffff880`0af2d800 fffff880`011446df : fffffa80`04e239a0 00000000`00000000 fffffa80`048cb100 fffffa80`049f49c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`0af2d890 fffff800`02fe3fef : fffffa80`049f49c0 fffffa80`0c195060 00000000`00000000 fffffa80`04aa93d0 : fltmgr!FltpDispatch+0xcf
    fffff880`0af2d8f0 fffff800`02fd1fe4 : 00000000`00000000 fffffa80`0c195060 fffff880`01165cb0 fffff800`02c64000 : nt!IopCloseFile+0x11f
    fffff880`0af2d980 fffff800`02fd1da1 : fffffa80`0c195060 fffffa80`00000001 fffff8a0`18385220 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
    fffff880`0af2da00 fffff800`02fd2364 : 00000000`0000cae8 fffffa80`0c195060 fffff8a0`18385220 00000000`0000cae8 : nt!ObpCloseHandleTableEntry+0xb1
    fffff880`0af2da90 fffff800`02cd61d3 : fffffa80`0bd4fb50 fffff880`0af2db60 00000001`3f64afd8 00000000`00000000 : nt!ObpCloseHandle+0x94

我的问题是，我如何才能确定系统上的哪个其他进程/线程使用 windbg 获取了这个内核资源？（顺便说一下，我正在查看来自客户的完整系统转储，我没有在调试器中复制此内容）

【问题讨论】：

标签： windows windbg freeze

【解决方案1】：

所以答案是使用kdext*.locks，这表明上面的线程与属于赛门铁克防病毒驱动程序之一的系统线程死锁。

这里引起问题的锁是内核ERESOURCE 锁。我发现!locks 有两个版本，一个用于用户模式临界区，另一个用于内核模式锁

【讨论】：