Menu

!cs debugger extension

!cs can be used in both user-mode debugger and kernel debugger to display information about critical sections in the current process. Matching symbols with type information is required, especially for ntdll.dll.

The syntax for this extension is:

cs [-s]�� ���������������������� - dump all the active critical sections in the current process.

!cs [-s] address���� ������ - dump critical section at this address.

!cs [-s] -d address� ����� - dump critical section corresponding to DebugInfo at this address.

-s will dump the critical section initialization stack trace if it's available.

Examples:

Dump information about a critical section using its address

0:001> ! cs 0x7803B0F8

Critical section�� = 0x7803B0F8 (MSVCRT!__app_type+0x4)

DebugInfo��������� = 0x6A262080

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

Dump information about a critical section using its address, including initialization stack trace

0:001> !cs -s 0x7803B0F8

Critical section�� = 0x7803B0F8 (MSVCRT!__app_type+0x4)

DebugInfo��������� = 0x6A262080

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

Stack trace for DebugInfo = 0x6A262080:

0x6A2137BD: ntdll!RtlInitializeCriticalSectionAndSpinCount+0x9B

0x6A207A4C: ntdll!LdrpCallInitRoutine+0x14

0x6A205569: ntdll!LdrpRunInitializeRoutines+0x1D9

0x6A20DCE1: ntdll!LdrpInitializeProcess+0xAE5

Dump information about a critical section using its debug info address

0:001> !cs -d 0x6A262080

DebugInfo��������� = 0x6A262080

Critical section�� = 0x7803B0F8 (MSVCRT!__app_type+0x4)

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

Dump information about a critical section using its debug info address, including initialization stack trace

0:001> !cs -s -d 0x6A262080

DebugInfo��������� = 0x6A262080

Critical section�� = 0x7803B0F8 (MSVCRT!__app_type+0x4)

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

Stack trace for DebugInfo = 0x6A262080:

0x6A2137BD: ntdll!RtlInitializeCriticalSectionAndSpinCount+0x9B

0x6A207A4C: ntdll!LdrpCallInitRoutine+0x14

0x6A205569: ntdll!LdrpRunInitializeRoutines+0x1D9

0x6A20DCE1: ntdll!LdrpInitializeProcess+0xAE

Dump information about all the active critical sections in the current process

0:001> !cs

-----------------------------------------

DebugInfo��������� = 0x6A261D60

Critical section�� = 0x6A262820 (ntdll!RtlCriticalSectionLock+0x0)

LOCKED

LockCount��������� = 0x0

OwningThread������ = 0x460

RecursionCount���� = 0x1

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

-----------------------------------------

DebugInfo��������� = 0x6A261D80

Critical section�� = 0x6A262580 (ntdll!DeferedCriticalSection+0x0)

NOT LOCKED

LockSemaphore����� = 0x7FC

SpinCount��������� = 0x0

-----------------------------------------

DebugInfo��������� = 0x6A262600

Critical section�� = 0x6A26074C (ntdll!LoaderLock+0x0)

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

.....

Dump information about all the active critical sections in the current process, including initialization stack trace

0:001> !cs -s

...

-----------------------------------------

DebugInfo������ ���= 0x6A261EA0

Critical section�� = 0xA8001C (+0xA8001C)

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

No stack trace saved

-----------------------------------------

DebugInfo��������� = 0x6A261EC0

Critical section�� = 0x6A263560 (ntdll!RtlpDphTargetDllsLock+0x0)

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

No stack trace saved

-----------------------------------------

DebugInfo��������� = 0x6A261EE0

Critical section�� = 0xA90608 (+0xA90608)

NOT LOCKED

LockSemaphore����� = 0x7EC

SpinCount��������� = 0x0

Stack trace for DebugInfo = 0x6A261EE0:

0x6A2137BD: ntdll!RtlInitializeCriticalSectionAndSpinCount+0x9B

0x6A20B0DC: ntdll!CsrpConnectToServer+0x1BE

0x6A20B2AA: ntdll!CsrClientConnectToServer+0x148

0x77DBE83F: KERNEL32!BaseDllInitialize+0x11F

0x6A207A4C: ntdll!LdrpCallInitRoutine+0x14

0x6A205569: ntdll!LdrpRunInitializeRoutines+0x1D9

0x6A20DCE1: ntdll!LdrpInitializeProcess+0xAE5

-----------------------------------------

DebugInfo��������� = 0x6A261F00

Critical section�� = 0x77E1AEB8 (KERNEL32!BaseDllRegistryCache+0x18)

NOT LOCKED

LockSemaphore����� = 0x0

SpinCount��������� = 0x0

Stack trace for DebugInfo = 0x6A261F00:

0x6A2137BD: ntdll!RtlInitializeCriticalSectionAndSpinCount+0x9B

0x6A207A4C: ntdll!LdrpCallInitRoutine+0x14

0x6A205569: ntdll!LdrpRunInitializeRoutines+0x1D9

0x6A20DCE1: ntdll!LdrpInitializeProcess+0xAE5