How to get the handle from the function of KERNELBASE!WaitForMultipleObjectsEx when using windbg debugging

Question

My asp.net application hanged. So I scratched a dump file. I posted a question here. Now In this new post, I want to find out the lock handle.

0:177> kb 5
RetAddr           : Args to Child                                                           : Call Site
000007fe`fda11430 : 00000001`012f8bb8 00000000`00000000 000007fe`f1651000 000007fe`f1f00d1f : ntdll!NtWaitForMultipleObjects+0xa
00000000`77851723 : 00000000`0d67b0f8 00000000`0d67b0f0 00000000`00000000 00000000`0d67af50 : KERNELBASE!WaitForMultipleObjectsEx+0xe8
000007fe`fa2f0f15 : 00000000`00000000 00000000`00000000 00000000`0763d720 00000000`00000001 : kernel32!WaitForMultipleObjectsExImplementation+0xb3
000007fe`fa2f0cee : 00000000`00000001 00000000`0763d8e8 00000000`00000001 00000000`0763d8e8 : clr!WaitForMultipleObjectsEx_SO_TOLERANT+0x91
000007fe`fa2f0b79 : 00000000`00000000 00000000`0d67b2c9 00000000`0763d720 00000000`0d67b4c8 : clr!Thread::DoAppropriateAptStateWait+0x56

The stacktrace is posted above. From here and here , I learned how to try to find the handle, but I have some barrier: 1) the kb command displays the first three parameters. but I see four parameters that are splitted by the space.

00000000`0d67b0f8 00000000`0d67b0f0 00000000`00000000 00000000`0d67af50

I mess up and don't know which parameter is the handle and which represents the handle length.

Supporse the handle is 000000000d67b0f0, and the length is 000000000d67b0f8. If I input

dd 00000000`0d67b0f0 L?00000000`0d67b0f8

Will this ouput show the handle address? I tried to type into the command, but the output is toooo long. I can't find the handle address. I tried

dd 00000000`0d67b0f0 L1

but, also didn't find the handle.

Does somebody can help me? Thanks in advance!

I also find [DebugDiag 2.1](http://www.microsoft.com/en-us/download/details.aspx?id=42933) is quite good in analyzing deadlocks. Might be easier than doing it in WinDbg manually. — Thomas Weller, Jul 19 '14 at 11:46
1) the kb command displays the first three parameters. but I see four parameters that are splitted by the space. in x64 you cannot rely on this the first 4 parameters are passed via registers what you are looking at can be irrelevent unless the arguments were saved to homespace in stack (by using /homeparams switch while compiling) — blabb, Jul 19 '14 at 12:19
@ThomasW. Thank your post. I have use DebugDiag2.1 to analyze the deadlock, but there is no deadlock detected. I hava another question posted to seek answer. That question is about "[link](http://stackoverflow.com/questions/24596550/will-net-parallel-tasks-exhaust-all-the-threads-in-the-pool-and-cause-dead-lock): will .net Parallel Tasks exhaust all the threads in the pool and cause dead lock, the app hanged, incoming request can't be processed?" — gfan, Jul 21 '14 at 02:08

Anton Tykhyy · Answer 1 · 2014-07-19T10:15:06.323

length obviously cannot be 000000000d67b0f8, it's too much. Also you are looking at the wrong function. I have no idea what the arguments to KERNELBASE!WaitForMultipleObjectsEx are or what calling convention it uses, it's not public API. You need to look at the line below that, which refers to a call to kernel32!WaitForMultipleObjectsExImplementation. Its arguments look much more more like the arguments to WaitForMultipleObjectsEx: the first argument, length, is 1, which is reasonable, the next is a pointer to the array of handles and the rest are zero. So it seems that you need to dump the first HANDLE, that is ULONG_PTR, at the address 000000000763d720.

How to get the handle from the function of KERNELBASE!WaitForMultipleObjectsEx when using windbg debugging

1 Answers1