The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
THREAD ffffe00147c3d080 Cid 0194.01cc Teb: 00007ff6f2b9b000 Win32Thread: fffff90140933010 WAIT: (WrLpcReply) UserMode Non-Alertable
ffffe00147c3d6b0 Semaphore Limit 0x1
Waiting for reply to ALPC Message ffffc0004da24280 : queued at port ffffe00147b17310 : owned by process ffffe00147b90580
Owning Process ffffe00147c20900 Image: csrss.exe
Attached Process N/A Image: N/A
Wait Start TickCount 4459 Ticks: 2796340 (0:12:08:12.812)
Context Switch Count 7 IdealProcessor: 0
Win32 Start Address winsrv!TerminalServerRequestThread (0x00007ff923721ca0)
Stack Init ffffd00023e5a510 Current ffffd00023e59c80
Base ffffd00023e5b000 Limit ffffd00023e54000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Kernel stack not resident.
I am looking into a dump and seeing this csrss process waiting for reply to ALPC message, and this message is owned by a svchost process, however, the owning thread of svchost is not present on the svchost process threads list. Could this cause an issue with the functioning of the system? or this can be ignored? Any info regarding this is highly appreciated.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Kernel Debugging||30 January 2023||Live, Online|
|Developing Minifilters||20 March 2023||Live, Online|
|Internals & Software Drivers||17 April 2023||Live, Online|
|Writing WDF Drivers||22 May 2023||Live, Online|