Description
kd> !process 0 0
|
**** NT ACTIVE PROCESS DUMP ****
|
PROCESS b1320d88 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
|
DirBase: 006d1000 ObjectTable: e1000788 HandleCount: 72.
|
Image: System
|
|
PROCESS b124e7b0 SessionId: none Cid: 0050 Peb: 7ffdd000 ParentCid: 0004
|
DirBase: 0229b000 ObjectTable: e10558f8 HandleCount: 13.
|
Image: smss.exe
|
|
PROCESS b1172d88 SessionId: 0 Cid: 0080 Peb: 7ffaf000 ParentCid: 0050
|
DirBase: 1b901000 ObjectTable: e19b76d0 HandleCount: 44.
|
Image: csrss.exe
|
|
PROCESS b1157990 SessionId: 0 Cid: 0098 Peb: 7ffd5000 ParentCid: 0050
|
DirBase: 1b19a000 ObjectTable: e192bcf8 HandleCount: 33.
|
Image: winlogon.exe
|
|
kd> !process b1157990
|
PROCESS b1157990 SessionId: 0 Cid: 0098 Peb: 7ffd5000 ParentCid: 0050
|
DirBase: 1b19a000 ObjectTable: e192bcf8 HandleCount: 33.
|
Image: winlogon.exe
|
VadRoot b1151f38 Vads 196 Clone 0 Private 121. Modified 0. Locked 0.
|
DeviceMap b1350080
|
Token e19c1020
|
ElapsedTime 00:01:45.776
|
UserTime 00:00:00.000
|
KernelTime 00:00:00.074
|
QuotaPoolUsage[PagedPool] 0
|
QuotaPoolUsage[NonPagedPool] 0
|
Working Set Sizes (now,min,max) (2945024, 0, 300) (11780096KB, 0KB, 1200KB)
|
PeakWorkingSetSize 2945024
|
VirtualSize 23 Mb
|
PeakVirtualSize 24 Mb
|
PageFaultCount 0
|
MemoryPriority BACKGROUND
|
BasePriority 8
|
CommitCharge 66
|
|
THREAD b1156c60 Cid 0098.009c Teb: 7ffdf000 Win32Thread: b114b008 WAIT: (UserRequest) UserMode Non-Alertable
|
b101e5b8 NotificationEvent
|
b1156cd8 NotificationTimer
|
Not impersonating
|
Owning Process b1157990 Image: winlogon.exe
|
Attached Process N/A Image: N/A
|
Wait Start TickCount 4808 Ticks: 2625 (0:00:00:39.362)
|
Context Switch Count 160 LargeStack
|
UserTime 00:00:00.000
|
KernelTime 00:00:00.074
|
Stack Init f8592000 Current f8591bec Base f8592000 Limit f858e000 Call 0
|
Priority 9 BasePriority 8 PriorityDecrement 0
|
ChildEBP RetAddr
|
f8591c2c 80488e85 nt!KiSwapContext+0x19
|
f8591c94 804d2355 nt!KeWaitForSingleObject+0x425 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\ntoskrnl\ke\wait.c @ 547]
|
f8591d00 8050042b nt!NtWaitForSingleObject+0x135 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\ntoskrnl\ob\obwait.c @ 425]
|
f8591d1c 804ffacf nt!KiSystemCallTrampoline+0x1b (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\ntoskrnl\include\internal\i386\ke.h @ 748]
|
f8591d5c 80403e23 nt!KiSystemServiceHandler+0x22f (FPO: [Non-Fpo]) (CONV: fastcall) [d:\rossrc\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1813]
|
f8591d5c 7c92eb3e nt!KiFastCallEntry+0x8c (FPO: [0,0] TrapFrame @ f8591d64)
|
0012fc2c 7c9558bd ntdll!KiFastSystemCallRet (FPO: [0,0,0])
|
0012fc30 7c6a505c ntdll!NtWaitForSingleObject+0xc (FPO: [0,0,0])
|
0012fc7c 7c6a4fc4 kernel32!WaitForSingleObjectEx+0x8c (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\dll\win32\kernel32\client\synch.c @ 130]
|
0012fc90 7c597af9 kernel32!WaitForSingleObject+0x14 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\dll\win32\kernel32\client\synch.c @ 87]
|
0012fca4 7c597be6 advapi32!WaitForSCManager+0x99 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\dll\win32\advapi32\service\scm.c @ 1811]
|
0012fcdc 75001d34 advapi32!OpenSCManagerW+0x96 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\dll\win32\advapi32\service\scm.c @ 1879]
|
0012fd14 00401c21 wlnotify!SchedEventLogoff+0x2a4 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\dll\win32\wlnotify\schedsvc.c @ 34]
|
0012fd50 0040577f winlogon!CallNotificationDlls+0x201 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\base\system\winlogon\notify.c @ 312]
|
0012fd74 00404be6 winlogon!HandleLogoff+0x34f (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\base\system\winlogon\sas.c @ 913]
|
0012fd88 0040485a winlogon!DoGenericAction+0x156 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\base\system\winlogon\sas.c @ 1104]
|
0012fdc4 77a8249a winlogon!SASWindowProc+0x49a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\base\system\winlogon\sas.c @ 1473]
|
0012fdf4 77a74fdf user32!CALL_EXTERN_WNDPROC+0x1a (FPO: [0,0,0])
|
0012fe90 77a770a0 user32!IntCallWindowProcW+0x4bf (FPO: [Non-Fpo]) (CONV: fastcall) [d:\rossrc\reactos\win32ss\user\user32\windows\message.c @ 1522]
|
0012feb8 77a77354 user32!IntCallMessageProc+0x190 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\win32ss\user\user32\windows\message.c @ 1773]
|
0012ff0c 00407976 user32!DispatchMessageW+0x1d4 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\win32ss\user\user32\windows\message.c @ 2026]
|
0012ff38 0040c200 winlogon!WinMain+0x576 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\rossrc\reactos\base\system\winlogon\winlogon.c @ 476]
|
0012ff50 0040bdcc winlogon!main+0x20 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\sdk\lib\crt\startup\crt0_c.c @ 22]
|
0012ffe8 0040bb71 winlogon!__tmainCRTStartup+0x24c (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\sdk\lib\crt\startup\crtexe.c @ 315]
|
0012fff4 00000000 winlogon!WinMainCRTStartup+0x21 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\rossrc\reactos\sdk\lib\crt\startup\crtexe.c @ 172]
|
|
<...trimmed...>
|
Attachments
Issue Links
- blocks
-
CORE-14999 Long time to shutdown after installing .NET Framework
- Resolved
- relates to
-
CORE-16458 using Win32k.sys from 2k3ps2, reveals our shutdown being hacked just
- Untriaged