Debugging Tools for Windows |
Kdextx86.dll和Kdexts.dll中的!locks扩展命令显示内核ERESOURCE锁的信息。
该命令不要和!ntsdexts.locks扩展命令混淆。
Windows 2000 | Kdextx86.dll |
Windows XP和之后 | Kdexts.dll |
!locks扩展显示线程为资源而持有的所有的锁。锁可以是共享的(shared)或者独占的(exclusive),独占意味着其它线程不能访问该资源。当系统发生死锁时这个信息很有用。死锁是由于某个非执行的线程持有了某个资源的独占锁,但是其它执行的线程又需要这个所的时候会发生。
在Microsoft Windows 2000中通常可以通过查找非执行线程持有了某个执行线程请求的某个资源的独占锁的情况,来定位死锁。大多数的锁都是共享的。
下面是基本的!locks输出的示例:
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks......
Resource @ 0x80e97620 Shared 4 owning threads
Threads: ff688da0-01<*> ff687da0-01<*> ff686da0-01<*> ff685da0-01<*>
KD: Scanning for held locks.......................................................
Resource @ 0x80e23f38 Shared 1 owning threads
Threads: 80ed0023-01<*> *** Actual Thread 80ed0020
KD: Scanning for held locks.
Resource @ 0x80d8b0b0 Shared 1 owning threads
Threads: 80ed0023-01<*> *** Actual Thread 80ed0020
2263 total locks, 3 locks currently held
注意显示出来的每个线程的地址后面都跟有线程计数 (例如"-01")。如果某个线程后跟有 I "<*>",则该线程是锁的所有者。有些情况下,初始线程的地址会包含一个偏移。这种情况下,实际的线程地址也会显示出来。
如果想查看这些资源对象中某一个的更多信息,可以将"Resource @"后的地址作为其它命令的参数。要查看上面例子中的第二个资源,可以使用dt ERESOURCE 80d8b0b0或者!thread 80ed0020。或者也可以带-v选项再次使用!locks:
Resource @ 0x80d8b0b0 Shared 1 owning threads
Threads: 80ed0023-01<*> *** Actual Thread 80ed0020
THREAD 80ed0020 Cid 4.2c Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
8055e100 Unknown
Not impersonating
GetUlongFromAddress: unable to read from 00000000
Owning Process 80ed5238
WaitTime (ticks) 44294977
Context Switch Count 147830
UserTime 0:00:00.0000
KernelTime 0:00:02.0143
Start Address nt!ExpWorkerThread (0x80506aa2)
Stack Init fafa4000 Current fafa3d18 Base fafa4000 Limit fafa1000 Call 0
Priority 13 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr
fafa3d30 804fe997 nt!KiSwapContext+0x25 (FPO: [EBP 0xfafa3d48] [0,0,4]) [D:\NT\base\ntos\ke\i386\ctxswap.asm @ 139]
fafa3d48 80506a17 nt!KiSwapThread+0x85 (FPO: [Non-Fpo]) (CONV: fastcall) [d:\nt\base\ntos\ke\thredsup.c @ 1960]
fafa3d78 80506b36 nt!KeRemoveQueue+0x24c (FPO: [Non-Fpo]) (CONV: stdcall) [d:\nt\base\ntos\ke\queueobj.c @ 542]
fafa3dac 805ad8bb nt!ExpWorkerThread+0xc6 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\nt\base\ntos\ex\worker.c @ 1130]
fafa3ddc 8050ec72 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\nt\base\ntos\ps\create.c @ 2164]
00000000 00000000 nt!KiThreadStartup+0x16 [D:\NT\base\ntos\ke\i386\threadbg.asm @ 81]
1 total locks, 1 locks currently held