All Your Code Does is initialize 256 CriticalSections.
why do you think !locks will show some increase or decrease ?
what is the reason for the 24 hours wait before trying to do another !locks ?
if this were not a dump but a live session you could try !gflags “user stack trace database”
to locate your creation with !cs -o
the lock count increases only if a thread Entered Your Critical Section and successfully acquired it
the lock count will decrease if the thread that acquired the CriticalSection Relinquished it with LeaveCriticalSection
A thread can die without relinquishing the ownership of Critical Section
if a CriticalSection is owned and locked by a thread any other thread that tried to acquire it will not be granted ownership and will go into a WaitState if the other thread went into a waitstate the contention count will be increased .
check the code and windbg display
this code Initialises one CriticalSection.
and creates ten threads.
each one of the thread will try to acquire ownership of the criticalsection
the first thread will succeed but it has a 10 second long work to perform before it can relinquish the CriticalSection
so all other thread will get into a wait state so the contention count will be 9 when
#include <stdio.h>
#include <windows.h>
#define THNO 10
CRITICAL_SECTION mycritty;
int counter = 0;
DWORD WINAPI tproc( LPVOID )
{
EnterCriticalSection(&mycritty);
counter++;
printf("%d\n",counter);
Sleep(10000);
LeaveCriticalSection(&mycritty);
return 0;
}
int main(void)
{
ULONG htid[THNO] = {0};
HANDLE hth[THNO] = {NULL};
InitializeCriticalSection( &mycritty );
for(int i = 0; i < THNO; i++)
{
hth[i] = CreateThread(NULL,0,&tproc,NULL,0,&htid[0]);
}
WaitForMultipleObjects(THNO, hth, TRUE, INFINITE);
return getchar();
}
when you reach the main there is no Critical Section
0:000> g critter!main
eax=015632b0 ebx=7ffdf000 ecx=99378b00 edx=76e570f4 esi=0013a778 edi=01560fb8
eip=000f1050 esp=003ef97c ebp=003ef9c0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
critter!main:
000f1050 55 push ebp
$$ noCriticalSections have been initialised yet @main
0:000> ?? critter!mycritty
struct _RTL_CRITICAL_SECTION
+0x000 DebugInfo : (null)
+0x004 LockCount : 0n0
+0x008 RecursionCount : 0n0
+0x00c OwningThread : (null)
+0x010 LockSemaphore : (null)
+0x014 SpinCount : 0
on executing the InitializeCritical Section() Api a critical section is initialized with NULL will be created
> 20: InitializeCriticalSection( &mycritty );
critter!main+0x50:
000f10a0 68d0991300 push offset critter!mycritty (001399d0)
0:000>
eax=00000000 ebx=7ffdf000 ecx=01561a70 edx=013effb8 esi=0013a778 edi=01560fb8
eip=000f10ab esp=003ef920 ebp=003ef978 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
> 21: for(int i = 0; i < THNO; i++)
critter!main+0x5b:
000f10ab c745a800000000 mov dword ptr [ebp-58h],0 ss:0023:003ef920=76e6eea6
0:000> ?? critter!mycritty
struct _RTL_CRITICAL_SECTION
+0x000 DebugInfo : 0x01561aa0 _RTL_CRITICAL_SECTION_DEBUG
+0x004 LockCount : 0n-1
+0x008 RecursionCount : 0n0
+0x00c OwningThread : (null)
+0x010 LockSemaphore : (null)
+0x014 SpinCount : 0
Setting a breakpoint on the ThreadProc and continuing all the threads will be created and the first hit on ThreadProc will happen
0:000> bp critter!tproc
0:000> g
Breakpoint 0 hit
eax=76b8ed5a ebx=00000000 ecx=00000000 edx=000f1000 esi=00000000 edi=00000000
eip=000f1000 esp=0024fe44 ebp=0024fe4c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
> 7: {
critter!tproc:
000f1000 55 push ebp
if you keep on stepping you can see the contetion count increasing upto 9 when all the ten threads have called thier ThreadProcs thecounter increased by 1 by the thread which suceeded to acquire the CriticalSection .
the gflags +ust is also enabled so stack trace is also available
0:010> ~
0 Id: 15c0.ad4 Suspend: 1 Teb: 7ffde000 Unfrozen
2 Id: 15c0.1360 Suspend: 1 Teb: 7ffd4000 Unfrozen
3 Id: 15c0.df8 Suspend: 1 Teb: 7ffd5000 Unfrozen
4 Id: 15c0.8e4 Suspend: 1 Teb: 7ffd6000 Unfrozen
5 Id: 15c0.17a4 Suspend: 1 Teb: 7ffd7000 Unfrozen
6 Id: 15c0.1760 Suspend: 1 Teb: 7ffd8000 Unfrozen
7 Id: 15c0.16ec Suspend: 1 Teb: 7ffd9000 Unfrozen
8 Id: 15c0.12bc Suspend: 1 Teb: 7ffda000 Unfrozen
9 Id: 15c0.171c Suspend: 1 Teb: 7ffdb000 Unfrozen
. 10 Id: 15c0.6a4 Suspend: 1 Teb: 7ffdc000 Unfrozen
0:010> ? critter!counter
Evaluate expression: 1284584 = 001399e8
0:010> ? poi(critter!counter)
Evaluate expression: 2 = 00000002
0:010> dx -r2 (ntdll!_RTL_CRITIcalSection*) &(critter!mycritty)
Error: Unable to find type '_RTL_CRITIcalSection *' for cast.
0:010> dx -r2 (ntdll!_RTL_CRITICAL_SECTION *) &(critter!mycritty)
(ntdll!_RTL_CRITICAL_SECTION *) &(critter!mycritty) : 0x1399d0 [Type: _RTL_CRITICAL_SECTION *]
[+0x000] DebugInfo : 0x1561aa0 [Type: _RTL_CRITICAL_SECTION_DEBUG *]
[+0x000] Type : 0x0 [Type: unsigned short]
[+0x002] CreatorBackTraceIndex : 0x12 [Type: unsigned short]
[+0x004] CriticalSection : 0x1399d0 [Type: _RTL_CRITICAL_SECTION *]
[+0x008] ProcessLocksList [Type: _LIST_ENTRY]
[+0x010] EntryCount : 0x0 [Type: unsigned long]
[+0x014] ContentionCount : 0x9 [Type: unsigned long]
[+0x018] Flags : 0x0 [Type: unsigned long]
[+0x01c] CreatorBackTraceIndexHigh : 0x0 [Type: unsigned short]
[+0x01e] SpareUSHORT : 0x6e [Type: unsigned short]
[+0x004] LockCount : -34 [Type: long]
[+0x008] RecursionCount : 1 [Type: long]
[+0x00c] OwningThread : 0x6a4 [Type: void *]
[+0x010] LockSemaphore : 0x48 [Type: void *]
[+0x014] SpinCount : 0x0 [Type: unsigned long]
0:010> !csa -o critter!mycritty
No export csa found
0:010> !cs -o critter!mycritty
-----------------------------------------
Critical section = 0x001399d0 (critter!mycritty+0x0)
DebugInfo = 0x01561aa0
LOCKED
LockCount = 0x8
WaiterWoken = No
OwningThread = 0x000006a4
RecursionCount = 0x1
LockSemaphore = 0x48
SpinCount = 0x00000000
OwningThread DbgId = ~10s
OwningThread Stack =
ChildEBP RetAddr Args to Child
0179f9fc 76b8ed6c 00000000 0179fa48 76e737eb critter!tproc+0x3a (FPO: [Non-Fpo]) (CONV: stdcall)
0179fa08 76e737eb 00000000 76c8333b 00000000 kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])
0179fa48 76e737be 000f1000 00000000 00000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])
0179fa60 00000000 000f1000 00000000 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])