194 threads
Thread 867C5020 ProcID 4 ThreadID 8 Priority 0
Thread 864387A0 ProcID 994 ThreadID 9CC Priority 8
Thread 861B5DA8 ProcID 760 ThreadID 1F4 Priority 10
Thread 861E8500 ProcID 798 ThreadID 984 Waiting
Thread 86281A60 ProcID 798 ThreadID 6C4 Waiting
Thread 86246380 ProcID 6CC ThreadID 334 Waiting
Thread 85C206F0 ProcID 4E4 ThreadID 4FC Waiting
Thread 8622D7A0 ProcID 798 ThreadID 9EC Waiting
Thread 863675F8 ProcID 760 ThreadID D74 Waiting
Thread 86407CD0 ProcID 760 ThreadID D6C Waiting
Thread 865F0548 ProcID 400 ThreadID D88 Waiting
Thread 865F2020 ProcID 400 ThreadID 428 Waiting
Thread 85C1D6F0 ProcID 400 ThreadID 50C Waiting
Thread 865F24E8 ProcID 348 ThreadID 354 Waiting
Thread 86561460 ProcID 438 ThreadID 454 Waiting
Thread 86256400 ProcID 598 ThreadID 7C4 Waiting
Thread 86338AD0 ProcID C0 ThreadID 694 Waiting
Thread 861911E8 ProcID 798 ThreadID 5C8 Waiting
Thread 867C3020 ProcID 4 ThreadID 34 Waiting
Thread 863E77A0 ProcID 994 ThreadID 8E4 Waiting
Thread 861F9BA0 ProcID 994 ThreadID 99C Waiting
Thread 8634DDA8 ProcID 994 ThreadID 9B0 Waiting
Thread 85C0B6F0 ProcID 798 ThreadID 7A4 Waiting
Thread 85C016F0 ProcID 798 ThreadID 7E8 Waiting
Thread 86366720 ProcID 994 ThreadID 9F8 Waiting
Thread 86151400 ProcID 7BC ThreadID 7F8 Waiting
Thread 85C536F0 ProcID 400 ThreadID 4EC Waiting
Thread 85BD26F0 ProcID 798 ThreadID BF8 Waiting
Thread 85EA2798 ProcID 7DC ThreadID 7E0 Waiting
Thread 863305B0 ProcID 798 ThreadID 87C Waiting
Thread 86152B30 ProcID 798 ThreadID F58 Waiting
Thread 865AFB48 ProcID 798 ThreadID F9C Waiting
Thread 85BC16F0 ProcID 57C ThreadID 580 Waiting
Thread 862A4DA8 ProcID 54C ThreadID 550 Waiting
Thread 862894A0 ProcID 798 ThreadID 6A4 Waiting
Thread 862E0DA8 ProcID 554 ThreadID 558 Waiting
Thread 8638A8C8 ProcID 598 ThreadID 59C Waiting
Thread 862ED5D0 ProcID 348 ThreadID DCC Waiting
Thread 8638A2E0 ProcID 348 ThreadID 63C Waiting
Thread 85C0D6F0 ProcID 798 ThreadID 79C Waiting
Thread 85C006F0 ProcID 42C ThreadID 7EC Waiting
Thread 862CBDA8 ProcID 798 ThreadID 2D8 Waiting
Thread 862634D0 ProcID 400 ThreadID 404 Waiting
Thread 862EC978 ProcID 798 ThreadID 368 Waiting
Thread 85C336F0 ProcID 798 ThreadID 370 Waiting
Thread 863E0DA8 ProcID 504 ThreadID 680 Waiting
Thread 8643CBA0 ProcID D8C ThreadID D90 Waiting
Thread 862DE278 ProcID 348 ThreadID 868 Waiting
Thread 86544020 ProcID 994 ThreadID A9C Waiting
Thread 86415DA8 ProcID 760 ThreadID D70 Waiting
Thread 85C1A6F0 ProcID 514 ThreadID 51C Waiting
Thread 8622DD80 ProcID 1A4 ThreadID 810 Waiting
Thread 862FA630 ProcID 438 ThreadID 450 Waiting
Thread 8631FDA8 ProcID 438 ThreadID 44C Waiting
Thread 85BFE6F0 ProcID 42C ThreadID 7F0 Waiting
Thread 85C5A6F0 ProcID 994 ThreadID A90 Waiting
Thread 86453020 ProcID 994 ThreadID AF8 Waiting
Thread 86453308 ProcID 994 ThreadID AFC Waiting
Thread 862F4DA8 ProcID 348 ThreadID 34C Waiting
Thread 8634EDA8 ProcID 348 ThreadID 540 Waiting
Thread 867C56E8 ProcID 4 ThreadID 14 Waiting
Thread 862281D8 ProcID 514 ThreadID 6A8 Waiting
Thread 862BEB60 ProcID 798 ThreadID 668 Waiting
Thread 85E00798 ProcID 798 ThreadID 548 Waiting
Thread 8578EA68 ProcID 994 ThreadID 9E4 Waiting
Thread 86313898 ProcID 22C ThreadID 25C Waiting
Thread 86193718 ProcID 798 ThreadID 45C Waiting
Thread 85C476F0 ProcID 438 ThreadID 490 Waiting
Thread 85C3D6F0 ProcID 438 ThreadID 498 Waiting
Thread 85C5B6F0 ProcID 438 ThreadID 468 Waiting
Thread 861C8400 ProcID 798 ThreadID 6C0 Waiting
Thread 85E63798 ProcID 798 ThreadID 570 Waiting
Thread 8632B208 ProcID 798 ThreadID 2B4 Waiting
Thread 85E3B798 ProcID 798 ThreadID 538 Waiting
Thread 863A5910 ProcID 798 ThreadID 220 Waiting
Thread 85C0C6F0 ProcID 4E4 ThreadID 7A0 Waiting
Thread 861D6688 ProcID 4E4 ThreadID 8CC Waiting
Thread 86366998 ProcID 994 ThreadID 9F4 Waiting
Thread 85C426F0 ProcID 798 ThreadID F0 Waiting
Thread 86148910 ProcID 994 ThreadID A74 Waiting
Thread 862223F8 ProcID 798 ThreadID DA8 Waiting
Thread 8620A248 ProcID 798 ThreadID 104 Waiting
Thread 861D8D58 ProcID 4E4 ThreadID 8D0 Waiting
Thread 861D6900 ProcID 4E4 ThreadID 8C8 Waiting
Thread 85E91798 ProcID 504 ThreadID 3CC Waiting
Thread 86331AA0 ProcID 798 ThreadID 2D0 Waiting
Thread 862037B0 ProcID 798 ThreadID 478 Waiting
Thread 86216228 ProcID 798 ThreadID 5D4 Waiting
Thread 85C126F0 ProcID 514 ThreadID 52C Waiting
Thread 86387DA8 ProcID 798 ThreadID 2E0 Waiting
Thread 865FEDA8 ProcID 798 ThreadID 364 Waiting
Thread 85C686F0 ProcID 348 ThreadID 378 Waiting
Thread 862CFDA8 ProcID 798 ThreadID 7AC Waiting
Thread 85C056F0 ProcID 798 ThreadID 7A8 Waiting
Thread 8639FDA8 ProcID 798 ThreadID 27C Waiting
Thread 862FCC98 ProcID 1A4 ThreadID 4C8 Waiting
Thread 8628BDA8 ProcID 1A4 ThreadID 5EC Waiting
Thread 86559320 ProcID 1A4 ThreadID 390 Waiting
Thread 85EB5798 ProcID 7DC ThreadID 308 Waiting
Thread 8655C288 ProcID 1A4 ThreadID 38C Waiting
Thread 8644FBA8 ProcID 1A4 ThreadID C3C Waiting
Thread 8617D8B8 ProcID 798 ThreadID DE4 Waiting
Thread 86358DA8 ProcID 798 ThreadID 358 Waiting
Thread 86226020 ProcID 798 ThreadID F08 Waiting
Thread 85C316F0 ProcID 798 ThreadID 360 Waiting
Thread 861AB610 ProcID 798 ThreadID 960 Waiting
Thread 85BF56F0 ProcID 42C ThreadID 4D0 Waiting
Thread 85921720 ProcID 994 ThreadID AA4 Waiting
Thread 8615C570 ProcID 798 ThreadID AB8 Waiting
Thread 86302778 ProcID 5A0 ThreadID 5A4 Waiting
Thread 86438348 ProcID 994 ThreadID A98 Waiting
Thread 8648C620 ProcID 994 ThreadID 9A8 Waiting
Thread 862D9DA8 ProcID 348 ThreadID 3AC Waiting
Thread 861A2020 ProcID 438 ThreadID 4DC Waiting
Thread 86350DA8 ProcID 514 ThreadID 700 Waiting
Thread 86311DA8 ProcID 798 ThreadID 2DC Waiting
Thread 85BDC6F0 ProcID 514 ThreadID 3D4 Waiting
Thread 8619F178 ProcID 798 ThreadID 604 Waiting
Thread 85E7F798 ProcID 798 ThreadID 5F0 Waiting
Thread 85C436F0 ProcID 438 ThreadID 488 Waiting
Thread 86558768 ProcID 348 ThreadID 624 Waiting
Thread 85C566F0 ProcID 42C ThreadID 470 Waiting
Thread 86167530 ProcID 400 ThreadID 424 Waiting
Thread 8627A670 ProcID C0 ThreadID 294 Waiting
Thread 85C266F0 ProcID 798 ThreadID 380 Waiting
Thread 85E2F798 ProcID 108 ThreadID 154 Waiting
Thread 8632D940 ProcID C0 ThreadID AC0 Waiting
Thread 86438A18 ProcID 994 ThreadID 9AC Waiting
Thread 86235C08 ProcID 994 ThreadID C38 Waiting
Thread 861A66D0 ProcID 994 ThreadID AD4 Waiting
Thread 86166DA8 ProcID 2E4 ThreadID 2F8 Waiting
Thread 85E8F798 ProcID 2E4 ThreadID 100 Waiting
Thread 85C3C6F0 ProcID 7CC ThreadID 11C Waiting
Thread 85921998 ProcID 994 ThreadID AA0 Waiting
Thread 863EF020 ProcID 7CC ThreadID 754 Waiting
Thread 86452DA8 ProcID 7CC ThreadID AE4 Waiting
Thread 86453580 ProcID 994 ThreadID AE0 Waiting
Thread 85C176F0 ProcID 514 ThreadID 524 Waiting
Thread 85792DA8 ProcID 7CC ThreadID B54 Waiting
Thread 86372380 ProcID 994 ThreadID AAC Waiting
Thread 8617DB30 ProcID 798 ThreadID DC8 Waiting
Thread 85C0F6F0 ProcID 514 ThreadID 534 Waiting
Thread 85E5C798 ProcID 6CC ThreadID 788 Waiting
Thread 8621F3E8 ProcID 994 ThreadID 9A0 Waiting
Thread 85C106F0 ProcID 42C ThreadID 4B4 Waiting
Thread 86464878 ProcID 6CC ThreadID 748 Waiting
Thread 86415020 ProcID 6CC ThreadID 778 Waiting
Thread 85BCF6F0 ProcID 57C ThreadID 600 Waiting
Thread 86254B08 ProcID 4E4 ThreadID 908 Waiting
Thread 86198718 ProcID CC8 ThreadID D50 Waiting
Thread 85C4D6F0 ProcID 348 ThreadID 384 Waiting
Thread 8638C650 ProcID 760 ThreadID 758 Waiting
Thread 858B8020 ProcID C5C ThreadID C60 Waiting
Thread 85C4B6F0 ProcID 438 ThreadID 48C Waiting
Thread 86155778 ProcID 798 ThreadID C44 Waiting
Thread 86203DA8 ProcID 12C ThreadID 1C0 Waiting
Thread 861C5BA0 ProcID 12C ThreadID 8D4 Waiting
Thread 861C2020 ProcID 994 ThreadID 9A4 Waiting
Thread 86308DA8 ProcID 504 ThreadID 69C Waiting
Thread 861773F8 ProcID 634 ThreadID 794 Waiting
Thread 8621BA78 ProcID 3E8 ThreadID 8A4 Waiting
Thread 86259560 ProcID 760 ThreadID 230 Waiting
Thread 8615B320 ProcID 438 ThreadID 2C4 Waiting
Thread 85BF46F0 ProcID 42C ThreadID 4D4 Waiting
Thread 86118DA8 ProcID 4 ThreadID A8 Waiting
Thread 867C4020 ProcID 4 ThreadID 1C Waiting
Thread 8622D1C0 ProcID 7BC ThreadID 5C4 Waiting
Thread 85EAE798 ProcID 42C ThreadID 7E4 Waiting
Thread 85BED6F0 ProcID 574 ThreadID 578 Waiting
Thread 867C3DA8 ProcID 4 ThreadID 38 Waiting
Thread 8655BD40 ProcID 42C ThreadID 78 Waiting
Thread 85C2D6F0 ProcID 438 ThreadID 4A4 Waiting
Thread 861E5390 ProcID 760 ThreadID 2A0 Waiting
Thread 86317330 ProcID 598 ThreadID 5FC Waiting
Thread 863133A8 ProcID 798 ThreadID FEC Waiting
Thread 862592E8 ProcID 760 ThreadID 128 Waiting
Thread 8625CB78 ProcID 760 ThreadID 56C Waiting
Thread 867C43C8 ProcID 4 ThreadID 30 Waiting
Thread 86433DA8 ProcID 3E8 ThreadID 408 Waiting
Thread 861DE020 ProcID 3E8 ThreadID 3F8 Waiting
Thread 85BEF6F0 ProcID 89C ThreadID 8A0 Waiting
Thread 86421CB0 ProcID 760 ThreadID DE0 Waiting
Thread 8644B570 ProcID 3E8 ThreadID 410 Waiting
Thread 85BC66F0 ProcID 3E8 ThreadID 584 Waiting
Thread 86773520 ProcID C64 ThreadID C68 Waiting
Thread 861C4868 ProcID 760 ThreadID 414 Waiting
Thread 85E77798 ProcID 760 ThreadID 6E4 Waiting
Thread 861615E8 ProcID 994 ThreadID 998 Waiting
Thread 862D9208 ProcID 3E8 ThreadID 374 Waiting
Thread 867C5960 ProcID 4 ThreadID 10 Waiting
Thread 867C4640 ProcID 4 ThreadID 2C Waiting
Thread 8612B948 ProcID 718 ThreadID 74C Waiting
Thread 85BEC6F0 ProcID 760 ThreadID 148 Waiting
Thread 86460DA8 ProcID 718 ThreadID 744 Waiting
Необходимые пояснения - Priority означает что данный тред замечен в одном из списков KiDispatcherReadyListHead, Waiting - что данный тред замечен в списке KiWaitListHead. Task manager же утверждает что всего потоков в системе 388, что несколько отличается от 194
Дальше - например системные треды workers:
Thread 867C5BD8 Start 80533CD0 Y stack F7A08000 limit F7A05000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C5960 Start 80533CD0 Y stack F7A0C000 limit F7A09000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C56E8 Start 80533CD0 Y stack F7A10000 limit F7A0D000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C5470 Start 80533CD0 Y stack F7A14000 limit F7A11000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C4020 Start 80533CD0 Y stack F7A18000 limit F7A15000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C4DA8 Start 80533CD0 Y stack F7A1C000 limit F7A19000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C4B30 Start 80533CD0 Y stack F7A20000 limit F7A1D000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C48B8 Start 80533CD0 Y stack F7A24000 limit F7A21000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C4640 Start 80533CD0 Y stack F7A28000 limit F7A25000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C43C8 Start 80533CD0 Y stack F7A2C000 limit F7A29000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C3020 Start 80533CD0 Y stack F7A30000 limit F7A2D000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C3DA8 Start 80533CD0 Y stack F7A34000 limit F7A31000 \WINDOWS\system32\ntkrnlpa.exe
Thread 867C3B30 Start 80533CD0 Y stack F7A38000 limit F7A35000 \WINDOWS\system32\ntkrnlpa.exe
Красным помечены те, что не присутствуют в найденных в планировщике. Причем можно спросить отладчик например:
dt -r1 _KTHREAD 867C5470
ntdll!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x000 Type : 0x6 ''
+0x001 Absolute : 0 ''
+0x002 Size : 0x70 'p'
+0x003 Inserted : 0 ''
+0x004 SignalState : 0
+0x008 WaitListHead : _LIST_ENTRY [ 0x867c5478 - 0x867c5478 ]
+0x010 MutantListHead : _LIST_ENTRY [ 0x867c5480 - 0x867c5480 ]
+0x000 Flink : 0x867c5480 _LIST_ENTRY [ 0x867c5480 - 0x867c5480 ]
+0x004 Blink : 0x867c5480 _LIST_ENTRY [ 0x867c5480 - 0x867c5480 ]
+0x018 InitialStack : 0xf7a14000
+0x01c StackLimit : 0xf7a11000
+0x020 Teb : (null)
+0x024 TlsArray : (null)
+0x028 KernelStack : 0xf7a13d1c
+0x02c DebugActive : 0 ''
+0x02d State : 0x5 ''
+0x02e Alerted : [2] ""
+0x030 Iopl : 0 ''
+0x031 NpxState : 0xa ''
+0x032 Saturation : 0 ''
+0x033 Priority : 13 ''
+0x034 ApcState : _KAPC_STATE
+0x000 ApcListHead : [2] _LIST_ENTRY [ 0x867c54a4 - 0x867c54a4 ]
+0x010 Process : 0x867c62c0 _KPROCESS
+0x014 KernelApcInProgress : 0 ''
+0x015 KernelApcPending : 0 ''
+0x016 UserApcPending : 0 ''
+0x04c ContextSwitches : 0x43
+0x050 IdleSwapBlock : 0 ''
+0x051 Spare0 : [3] ""
+0x054 WaitStatus : 0
+0x058 WaitIrql : 0 ''
+0x059 WaitMode : 1 ''
+0x05a WaitNext : 0 ''
+0x05b WaitReason : 0xf ''
+0x05c WaitBlockList : 0x867c54e0 _KWAIT_BLOCK
+0x000 WaitListEntry : _LIST_ENTRY [ 0x867c5c48 - 0x8055a1c8 ]
+0x008 Thread : 0x867c5470 _KTHREAD
+0x00c Object : 0x8055a1c0
+0x010 NextWaitBlock : 0x867c54e0 _KWAIT_BLOCK
+0x014 WaitKey : 0
+0x016 WaitType : 1
+0x060 WaitListEntry : _LIST_ENTRY [ 0x0 - 0x80551f68 ]
+0x000 Flink : (null)
+0x004 Blink : 0x80551f68 _LIST_ENTRY [ 0x8632d9a0 - 0x867c3e08 ]
или вот еще например:
dt -r1 _KTHREAD 867C4DA8
ntdll!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x000 Type : 0x6 ''
+0x001 Absolute : 0 ''
+0x002 Size : 0x70 'p'
+0x003 Inserted : 0 ''
+0x004 SignalState : 0
+0x008 WaitListHead : _LIST_ENTRY [ 0x867c4db0 - 0x867c4db0 ]
+0x010 MutantListHead : _LIST_ENTRY [ 0x867c4db8 - 0x867c4db8 ]
+0x000 Flink : 0x867c4db8 _LIST_ENTRY [ 0x867c4db8 - 0x867c4db8 ]
+0x004 Blink : 0x867c4db8 _LIST_ENTRY [ 0x867c4db8 - 0x867c4db8 ]
+0x018 InitialStack : 0xf7a1c000
+0x01c StackLimit : 0xf7a19000
+0x020 Teb : (null)
+0x024 TlsArray : (null)
+0x028 KernelStack : 0xf7a1bd1c
+0x02c DebugActive : 0 ''
+0x02d State : 0x5 ''
+0x02e Alerted : [2] ""
+0x030 Iopl : 0 ''
+0x031 NpxState : 0xa ''
+0x032 Saturation : 0 ''
+0x033 Priority : 12 ''
+0x034 ApcState : _KAPC_STATE
+0x000 ApcListHead : [2] _LIST_ENTRY [ 0x867c4ddc - 0x867c4ddc ]
+0x010 Process : 0x867c62c0 _KPROCESS
+0x014 KernelApcInProgress : 0 ''
+0x015 KernelApcPending : 0 ''
+0x016 UserApcPending : 0 ''
+0x04c ContextSwitches : 1
+0x050 IdleSwapBlock : 0 ''
+0x051 Spare0 : [3] ""
+0x054 WaitStatus : 0
+0x058 WaitIrql : 0 ''
+0x059 WaitMode : 1 ''
+0x05a WaitNext : 0 ''
+0x05b WaitReason : 0xf ''
+0x05c WaitBlockList : 0x867c4e18 _KWAIT_BLOCK
+0x000 WaitListEntry : _LIST_ENTRY [ 0x867c4ba0 - 0x8055a204 ]
+0x008 Thread : 0x867c4da8 _KTHREAD
+0x00c Object : 0x8055a1fc
+0x010 NextWaitBlock : 0x867c4e18 _KWAIT_BLOCK
+0x014 WaitKey : 0
+0x016 WaitType : 1
+0x060 WaitListEntry : _LIST_ENTRY [ 0x0 - 0x80551f68 ]
+0x000 Flink : (null)
+0x004 Blink : 0x80551f68 _LIST_ENTRY [ 0x861d66e8 - 0x8644b5d0 ]
Т.е. определенно не попавшие в вынутые из планировщика потоки явно живут в отличном от KiWaitListHead списке. Спрашивается - в каком именно ?
Ждущие функции ( KeWaitForSingleObject/KeWaitForMultipleObject ) активно манипулируют полем _KTHREAD->WaitListEntry, периодически выписывая ждущий поток из KiWaitListHead. Поэтому огорчу, единого места, куда попадают все выписанные из KiWaitListHead списка потоки, нет. Надо пройтись по всем Dispatch объектам ( _DISPATCHER_HEADER ) в ядре и просмотреть поле WaitListHead. Тогда список потоков будет полным.
ОтветитьУдалитьв wrk в base\ntos\ke\wait.c есть примерно такой кусок кода:
ОтветитьУдалитьStackSwappable = KiIsKernelStackSwappable(WaitMode, Thread);
...
if (StackSwappable != FALSE) { InsertTailList(&CurrentPrcb->WaitListHead, &Thread->WaitListEntry);
}
Похоже что в глобальные waitlists не добавляются потоки с выгружаемым стеком