Win32: умирающий процесс вешается наглухо в критических секциях ntdll

Доброго всем времени!

Возникла непонятная ситуация, программа регистрирует COM-обьекты. регистрирует через regsvr32.exe ... но порой процесс этот вешается наглухо. Сделал дамп процесса полный и натравил на него WinDbg.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [E:\regsvr32.DMP]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols;srv*
Executable search path is:
Windows XP Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Wed Aug 17 10:55:37.000 2011 (UTC + 4:00)
System Uptime: 0 days 0:17:21.265
Process Uptime: 0 days 0:02:01.000
........................................
Loading unloaded module list
.
eax=00000000 ebx=00000000 ecx=ffffffff edx=0007fee4 esi=7c97e174 edi=00000000
eip=7c90e514 esp=0007fbe4 ebp=0007fc6c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c90e514 c3 ret

0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

Force unload of C:\WINDOWS\system32\user32.dll
Loading symbols for 7e410000 user32.dll -> user32.dll
ModLoad: 7e410000 7e4a1000 C:\WINDOWS\system32\user32.dll
Force unload of C:\WINDOWS\system32\ole32.dll
Loading symbols for 774e0000 ole32.dll -> ole32.dll
ModLoad: 774e0000 7761e000 C:\WINDOWS\system32\ole32.dll
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/regsvr32_exe/5_1_2600_5512/unknown/0_0_0_0/00000000.htm?Retriage=1

FAULTING_IP:
+29f1fc0
00000000 ?? ???

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD: 00000000

PROCESS_NAME: regsvr32.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CRITICAL_SECTION: 7c97e174 -- (!cs -s 7c97e174)

BLOCKING_THREAD: 000008d4

LOADERLOCK_BLOCKED_API: _ExitProcess:LdrShutdownProcess:LdrGetProcedureAddress:LdrpGetProcedureAddress:

DERIVED_WAIT_CHAIN:

Dl Eid Cid WaitType
-- --- ------- --------------------------
0 7e0.8d4 Critical Section (Self)

WAIT_CHAIN_COMMAND: ~0s;k;;

BUGCHECK_STR: APPLICATION_FAULT_Unowned_CriticalSection_SHUTDOWN_FILL_PATTERN_ffffffff

PRIMARY_PROBLEM_CLASS: Unowned_CriticalSection_SHUTDOWN_FILL_PATTERN_ffffffff

DEFAULT_BUCKET_ID: Unowned_CriticalSection_SHUTDOWN_FILL_PATTERN_ffffffff

LAST_CONTROL_TRANSFER: from 7c90df5a to 7c90e514

STACK_TEXT:
0007fbe0 7c90df5a 7c919b23 00000070 00000000 ntdll!KiFastSystemCallRet
0007fbe4 7c919b23 00000070 00000000 00000000 ntdll!NtWaitForSingleObject+0xc
0007fc6c 7c901046 0197e174 7c917c98 7c97e174 ntdll!RtlpWaitForCriticalSection+0x132
0007fc74 7c917c98 7c97e174 0000009c 00000000 ntdll!RtlEnterCriticalSection+0x46
0007fd24 7c917d08 6f880000 0007fd64 00000000 ntdll!LdrpGetProcedureAddress+0x117
0007fd40 5cb77f31 6f880000 0007fd64 00000000 ntdll!LdrGetProcedureAddress+0x18
0007fd70 5cb78d0d 00000002 00000000 7c9225f8 shimeng!NotifyShims+0x7c
0007fd7c 7c9225f8 00000000 7c90de6e 00000000 shimeng!SE_ProcessDying+0x9
0007fdf0 7c81caae 00000000 00000001 00000000 ntdll!LdrShutdownProcess+0x30
0007fee4 7c81cb26 00000000 77e8f3b0 ffffffff kernel32!_ExitProcess+0x42
0007fef8 77c39d45 00000000 0007ff14 77c39e78 kernel32!ExitProcess+0x14
0007ff04 77c39e78 00000000 00000000 0007ff28 msvcrt!__crtExitProcess+0x32
0007ff14 77c39e90 00000000 00000000 00000002 msvcrt!_cinit+0xee
0007ff28 010024d0 00000000 00640061 00720064 msvcrt!exit+0x12
0007ffc0 7c817077 00640061 00720064 7ffde000 regsvr32!wWinMainCRTStartup+0x1a9
0007fff0 00000000 01002327 00000000 78746341 kernel32!BaseProcessStart+0x23


FOLLOWUP_IP:
shimeng!NotifyShims+7c
5cb77f31 85c0 test eax,eax

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: shimeng!NotifyShims+7c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: shimeng

IMAGE_NAME: shimeng.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4802a114

STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s ; kb

FAILURE_BUCKET_ID: Unowned_CriticalSection_SHUTDOWN_FILL_PATTERN_ffffffff_80000003_shimeng.dll!NotifyShims

BUCKET_ID: APPLICATION_FAULT_Unowned_CriticalSection_SHUTDOWN_FILL_PATTERN_ffffffff_shimeng!NotifyShims+7c

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/regsvr32_exe/5_1_2600_5512/4802543f/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

Followup: MachineOwner
---------


0:000> !locks

CritSec ntdll!LdrpLoaderLock+0 at 7c97e174
LockCount 0
RecursionCount 0
OwningThread 0
EntryCount 11
ContentionCount 11
*** Locked

CritSec ntdll!FastPebLock+0 at 7c980620
LockCount 0
RecursionCount 1
OwningThread 8d4
EntryCount 1
ContentionCount 1
*** Locked

CritSec msvcrt!_C_Exit_Done+94 at 77c61ae8
LockCount 0
RecursionCount 1
OwningThread 8d4
EntryCount 0
ContentionCount 0
*** Locked

Scanned 331 critical sections


Может быть из всемогущих людей тут сталкивался с аналогичным подвисанием процесса когда вроде уже должен он был завершиться и вешался в самом самом конце своего жизненного цикла?

 

аргументации не хватает для сервера регистрации, нули там где должен быть аргумент)
скрипт установки бажный скорее всего)

 

cryptor:

Спасибо за идею но
если "срубить" процесс висящий regsvr32.exe и опять абсолютно также его запустить (с этими же аргументами) то он может "нормально" завершиться не зависнув в момент очистки своей.

 

Проблемы с ntdll!LdrpLoaderLock . Вероятнее всего это значит что в DllMain совершён какой-то нетривиальный вызов повлекший за собой длительное ожидание или ещё что-то.
В этом процессе не осталось ли случаем других тредов на чёмнить висящих?

 

ну да
провтыкал
там чёт другое
там её всю перебрать надо как мне видится..

 

100gold:

Спасибо вам что откликнулись!

есть:

0:000> !threads
Index TID TEB StackBase StackLimit DeAlloc StackSize ThreadProc
0 000008d4 0x7ffdd000 0x00080000 0x0007c000 0x00040000 0x00004000 0x1002327: regsvr32!wWinMainCRTStartup
Total VM consumed by thread stacks 0x00004000
0:000> !address 0x7ffdd000


Failed to map Heaps (error 80004005)
Usage: TEB
Allocation Base: 00000000
Base Address: 7ffdd000
End Address: 7ffde000
Region Size: 00001000
Type: 00000000
State: 00000000
Protect: 00000000
More info: !teb 0x7ffdd000
More info: dt ntdll!_TEB 0x7ffdd000

0:000> !teb 0x7ffdd000
TEB at 7ffdd000
ExceptionList: 0007fd14
StackBase: 00080000
StackLimit: 0007c000
SubSystemTib: 00000000
FiberData: 00001e00
ArbitraryUserPointer: 00000000
Self: 7ffdd000
EnvironmentPointer: 00000000
ClientId: 000007e0 . 000008d4
RpcHandle: 00000000
Tls Storage: 00000000
PEB Address: 7ffde000
LastErrorValue: 126
LastStatusValue: c0000135
Count Owned Locks: 0
HardErrorMode: 0
0:000> dt ntdll!_TEB 0x7ffdd000
+0x000 NtTib : _NT_TIB
+0x01c EnvironmentPointer : (null)
+0x020 ClientId : _CLIENT_ID
+0x028 ActiveRpcHandle : (null)
+0x02c ThreadLocalStoragePointer : (null)
+0x030 ProcessEnvironmentBlock : 0x7ffde000 _PEB
+0x034 LastErrorValue : 0x7e
+0x038 CountOfOwnedCriticalSections : 0
+0x03c CsrClientThread : (null)
+0x040 Win32ThreadInfo : 0xe320dc10 Void
+0x044 User32Reserved : [26] 0
+0x0ac UserReserved : [5] 0
+0x0c0 WOW32Reserved : (null)
+0x0c4 CurrentLocale : 0x419
+0x0c8 FpSoftwareStatusRegister : 0
+0x0cc SystemReserved1 : [54] (null)
+0x1a4 ExceptionCode : 0n0
+0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK
+0x1bc SpareBytes1 : [24] ""
+0x1d4 GdiTebBatch : _GDI_TEB_BATCH
+0x6b4 RealClientId : _CLIENT_ID
+0x6bc GdiCachedProcessHandle : (null)
+0x6c0 GdiClientPID : 0
+0x6c4 GdiClientTID : 0
+0x6c8 GdiThreadLocalInfo : (null)
+0x6cc Win32ClientInfo : [62] 8
+0x7c4 glDispatchTable : [233] (null)
+0xb68 glReserved1 : [29] 0
+0xbdc glReserved2 : (null)
+0xbe0 glSectionInfo : (null)
+0xbe4 glSection : (null)
+0xbe8 glTable : (null)
+0xbec glCurrentRC : (null)
+0xbf0 glContext : (null)
+0xbf4 LastStatusValue : 0xc0000135
+0xbf8 StaticUnicodeString : _UNICODE_STRING "mscoree.dll"
+0xc00 StaticUnicodeBuffer : [261] 0x6d
+0xe0c DeallocationStack : 0x00040000 Void
+0xe10 TlsSlots : [64] (null)
+0xf10 TlsLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0xf18 Vdm : (null)
+0xf1c ReservedForNtRpc : (null)
+0xf20 DbgSsReserved : [2] (null)
+0xf28 HardErrorsAreDisabled : 0
+0xf2c Instrumentation : [16] (null)
+0xf6c WinSockData : (null)
+0xf70 GdiBatchCount : 0
+0xf74 InDbgPrint : 0 ''
+0xf75 FreeStackOnTermination : 0 ''
+0xf76 HasFiberData : 0 ''
+0xf77 IdealProcessor : 0x1 ''
+0xf78 Spare3 : 0
+0xf7c ReservedForPerf : (null)
+0xf80 ReservedForOle : 0x000a9878 Void
+0xf84 WaitingOnLoaderLock : 1
+0xf88 Wx86Thread : _Wx86ThreadState
+0xf94 TlsExpansionSlots : (null)
+0xf98 ImpersonationLocale : 0
+0xf9c IsImpersonating : 0
+0xfa0 NlsCache : (null)
+0xfa4 pShimData : (null)
+0xfa8 HeapVirtualAffinity : 0
+0xfac CurrentTransactionHandle : (null)
+0xfb0 ActiveFrame : (null)
+0xfb4 SafeThunkCall : 0 ''
+0xfb5 BooleanSpare : [3] ""