Hi everybody!
I need your assistance...
Vista
There is C#A - client application(currently with one thread), A#A - any arbitrary application, C#T - client thread and A#T arbitrary application thread respectively.
In FS filter driver I subscribe on LoadImageNotifyRoutine in which thread(C#T) is waiting for an event which can only be set from another application's(C#A) thread which is checks if image is ok and then call driver function to set it. But thread(C#T) that get notifications also puts results to a console and just in that moment it is hangs up in waiting on alpc, csrss port. Also at the same moment another application(A#A) is trying to map image calling my notify routine and waits for C#T set it up, but it allready hangs up!
The system isn't respond because the subsystem is not responding (I guess).
kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks...............................................
Resource @ 0x8339e430 Exclusively owned
Contention Count = 21520
NumberOfExclusiveWaiters = 4
Threads: 8359ad78-01<*>
Threads Waiting On Exclusive Access:
82752550 835d04c0 83712030 8f5e4600
KD: Scanning for held locks..
Resource @ 0x8323e3d8 Exclusively owned
Contention Count = 598
NumberOfExclusiveWaiters = 2
Threads: 8f687990-01<*>
Threads Waiting On Exclusive Access:
8359aac0 8359ad78
KD: Scanning for held locks..........................................................................................................................................................................................
7474 total locks, 2 locks currently held
Those two threads that held locks
kd> !thread 8359ad78
THREAD 8359ad78 Cid 0260.02f4 Teb: 7ffda000 Win32Thread: ff8c7008 WAIT: (WrResource) KernelMode Non-Alertable
83480308 SynchronizationEvent
8359ae00 NotificationTimer
IRP List:
834df1e0: (0006,01d8) Flags: 00060970 Mdl: 00000000
Not impersonating
DeviceMap 84c08a20
Owning Process 8347e700 Image: csrss.exe
Wait Start TickCount 271594 Ticks: 132 (0:00:00:02.062)
Context Switch Count 83100
UserTime 00:00:00.0015
KernelTime 00:00:33.0953
Win32 Start Address 0x7592bdd0
Stack Init 8b2dc000 Current 8b2dbb08 Base 8b2dc000 Limit 8b2d9000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr Args to Child
8b2dbb20 81869b66 8359ae00 8359ad78 8359ae30 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
8b2dbb5c 818675bd 8359ad78 8323e3d8 8359ad78 nt!KiSwapThread+0x36d
8b2dbbbc 81873579 83480308 0000001b 00000000 nt!KeWaitForSingleObject+0x414
8b2dbbf4 81863aa6 83480308 fe416638 8b2dbc60 nt!ExpWaitForResource+0xbd
8b2dbc18 81873aa7 8323e3d8 00000001 8b2dbc3c nt!ExAcquireResourceExclusiveLite+0x96
8b2dbc28 8dad855d 8323e3d8 8dae8827 8b2dbc60 nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0x1c
WARNING: Frame IP not in any known module. Following frames may be wrong.
8b2dbc3c 8dac0afd 8b2dbc80 ff8b52a8 8b2dbc78 0x8dad855d
8b2dbc4c 8da98d6b 8b2dbc80 ff889578 ffbea4b0 0x8dac0afd
8b2dbd58 818461fa 00000004 00f4fe64 771f0f34 0x8da98d6b
8b2dbd58 00180016 00000004 00f4fe64 771f0f34 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8b2dbca4)
8b2dbd58 818461fa 00000004 00f4fe64 771f0f34 0x180016
8b2dbd58 771f0f34 00000004 00f4fe64 771f0f34 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8b2dbd64)
00f4fe64 00000000 00000000 00000000 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
kd> !thread 8f687990
THREAD 8f687990 Cid 0784.0d9c Teb: 7ffa8000 Win32Thread: fec7fbd0 GATEWAIT
Not impersonating
DeviceMap 8d5bdc30
Owning Process 836dd020 Image: explorer.exe
Wait Start TickCount 265673 Ticks: 6053 (0:00:01:34.578)
Context Switch Count 833
UserTime 00:00:00.0343
KernelTime 00:00:02.0296
Win32 Start Address 0x7381cc4d
Stack Init 8edc5fe0 Current 8edc5a98 Base 8edc6000 Limit 8edc3000 Call 42c
Priority 14 BasePriority 8 PriorityDecrement 6
ChildEBP RetAddr Args to Child
8edc5ab0 81869b66 00000000 8f687990 8edc5b50 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
8edc5aec 8189d905 8f687990 836dd108 00000001 nt!KiSwapThread+0x36d
8edc5b24 8189468d 00000000 836dd020 8f687990 nt!KeWaitForGate+0x198
8edc5b84 81a04b1b 00000000 fe7ea320 ff8b52a8 nt!ExfAcquirePushLockExclusive+0x112
8edc5ba0 81a0c4a7 8f5b0da1 05000000 8edc5c14 nt!MiUnsecureVirtualMemory+0x37
8edc5bb0 8dabff23 8f5b0da1 00000000 08000000 nt!MmUnsecureVirtualMemory+0xe
WARNING: Frame IP not in any known module. Following frames may be wrong.
8edc5c14 8dac0038 00000000 00000000 8edc5c74 0x8dabff23
8edc5c24 8dac128c 00000000 00000000 00000001 0x8dac0038
8edc5d38 818461fa 26010b7d 04f0f088 771f0f34 0x8dac128c
8edc5d38 26010b7d 26010b7d 04f0f088 771f0f34 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8edc5cd8)
8edc5d44 00000000 badb0d00 04f0f06c 8e005d64 0x26010b7d