事件等待-等待链分析

事件等待-一个线程等待一个对象分析

1. 遍历所有进程，找到测试的进程

kd> !process 0 0

PROCESS 85ae8da0  SessionId: 0  Cid: 0d50    Peb: 7ffd7000  ParentCid: 0fb8
    DirBase: 140c0340  ObjectTable: e19a8400  HandleCount:  26.
    Image: WaitLinkTest.exe

2. 查看进程信息，找到线程

kd> !process 85ae8da0  
PROCESS 85ae8da0  SessionId: 0  Cid: 0d50    Peb: 7ffd7000  ParentCid: 0fb8
    DirBase: 140c0340  ObjectTable: e19a8400  HandleCount:  26.
    Image: WaitLinkTest.exe
    VadRoot 86329e50 Vads 32 Clone 0 Private 78. Modified 1. Locked 0.
    DeviceMap e19ed630
    Token                             e1f7b570
    ElapsedTime                       00:00:32.265
    UserTime                          00:00:00.015
    KernelTime                        00:00:00.015
    QuotaPoolUsage[PagedPool]         30052
    QuotaPoolUsage[NonPagedPool]      1280
    Working Set Sizes (now,min,max)  (376, 50, 345) (1504KB, 200KB, 1380KB)
    PeakWorkingSetSize                389
    VirtualSize                       9 Mb
    PeakVirtualSize                   11 Mb
    PageFaultCount                    414
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      104
    DebugPort                         85c51c80

        THREAD 85a9c900  Cid 0d50.0d54  Teb: 7ffdf000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            85af55e0  ProcessObject
        Not impersonating
        DeviceMap                 e19ed630
        Owning Process            0       Image:         
        Attached Process          85ae8da0       Image:         WaitLinkTest.exe
        Wait Start TickCount      26331          Ticks: 1999 (0:00:00:31.234)
        Context Switch Count      100             
        UserTime                  00:00:00.000
        KernelTime                00:00:00.015
        Win32 Start Address 0x00411122
        Start Address 0x7c810735
        Stack Init f48fd000 Cur