Partager via

Is a process hijacking your machine?

  • Article

Suppose there is a process on your machine that is hijacking your processor. Perhaps it’s in an infinite loop. Or perhaps you have no idea what a particular process is doing, and you’d like to find out.

If you have a debugger installed, like Visual Studio, it’s fairly simple to do some basic inspection.

First, start Task Manager (Ctrl-Shift-Esc) and look for the process in the Processes tab. You can sort columns by clicking on the header. For example, you can see which process is eating your CPU by sorting on the CPU column. Right click on the target process and choose “Debug”.

After a warning from Task Manager, you are prompted to choose a particular debugger and the kind of debugging (like native code, T-SQL or Common Language Runtime). Just choose all the defaults and the debugger will attach to the process.

Alternatively, you can start Visual Studio and choose Tools->Debug Processes, which will list the running processes and allow you to attach the debugger. It can even attach to a process on a remote machine (if the correct components and permissions are set).

Or you can start the debugger from a Watson error dialog. (If you choose to send crash information via Watson to Microsoft then we can try to inspect the failed process and determine what went wrong.)

I attached to a VFP8 process that ran this infinite loop code which doesn’t hijack the processor in Visual FoxPro because it yields 1 second of processor time each time through the loop, so other processes (like the debugger) won’t be too sluggish.

DO WHILE INKEY(1)!= 27

      DOEVENTS

ENDDO

After attaching, choose Debug->Windows->Modules to see what DLLs are loaded in the process. VFP loads a few dozen DLLs, many of which are Windows DLLs.

advapi32.dll

clbcatq.dll

comctl32.dll

comdlg32.dll

comres.dll

frxhdll.dll

gdi32.dll

GdiPlus.dll

imm32.dll

kernel32.dll

mpr.dll

MSCTF.dll

msi.dll

mslbui.dll

msvcp60.dll

msvcr70.dll

msvcrt.dll

ntdll.dll

ole32.dll

oleacc.dll

oleaut32.dll

oledlg.dll

rpcrt4.dll

shell32.dll

SHLWAPI.DLL

sxs.dll

URLMON.DLL

user32.dll

uxtheme.dll

version.dll

VFP8.exe

VFP8ENU.DLL

winmm.dll

winspool.drv

You can choose Debug->Break or you can hit F12 on the debug target application to cause an asynchronous breakpoint. (F12 actually injects a thread into the target process which causes the breakpoint.)

Choose Debug->Windows->Threads to choose various threads (each thread has its own call stack and usually the main thread is at the top) and Debug->Windows->Call stack to get more info:

> 7ffe0304()

  user32.dll!77d4414d()

  user32.dll!77d441b3()

  VFP8.exe!00494945()

  VFP8.exe!00713a13()

  VFP8.exe!0048414f()

  VFP8.exe!006e0fa2()

  VFP8.exe!004e8180()

  VFP8.exe!0082cd74()

  kernel32.dll!77e7a683()

  VFP8.exe!00427f34()

  VFP8.exe!0054fcbf()

  VFP8.exe!0046ef19()

  VFP8.exe!0040177d()

  ntdll.dll!77f58a3a()

  ntdll.dll!77f693c7()

  ntdll.dll!77f693f8()

This display doesn’t seem very useful, but Microsoft provides a public symbol server to help your debugger understand what code is being run.

You can set the environment variable _NT_SYMBOL_PATH to set the symbol path. Hit the Windows-Key Break (or right click on My Computer->Properties). Go to the Advanced tab, Environment Variables: New System Variable

Variable Name =_nt_symbol_path

Variable Value = srv*c:\symbols*https://msdl.microsoft.com/download/symbols

(You’ll need to restart VS to read this environment variable.)

Alternatively, you can set the symbol server via Visual Studio: Choose View->Solution Explorer, right click on the solution at the top and choose Properties. For Common Properties->Debug Symbol Files, put in this string for “Search these paths for symbol files”

srv*c:\symbols*https://msdl.microsoft.com/download/symbols

This indicates the web address to get the symbol files and a directory to cache them locally so they can be accessed much faster next time.

Select all in the Modules window, right click and choose to Reload symbols. (VS.Net 2003 may be a little different from VS Whidbey. You may have to Debug->Stop debugging, exit and save the solution, reattach to the same process)

Now the call stack is much more informative:

> 7ffe0304()

  ntdll.dll!_ZwDelayExecution@8() Line 595 + 0xc Asm

  kernel32.dll!_SleepEx@8() + 0x55

  kernel32.dll!_Sleep@4() + 0xb

  VFP8.exe!@EVKeyStillDown@8() - 0x188016

  VFP8.exe!@EVGetNextEvent@4() + 0x80

  VFP8.exe!@xeinkey_loop@28() + 0x10f

  VFP8.exe!@emod@0() + 0x19feb7

  VFP8.exe!@xxexpr@4() + 0x96

  VFP8.exe!@FRContinueExitLoop@4() + 0xb5

  VFP8.exe!@x_enddo@0() + 0x8

  VFP8.exe!@EXEPostCommand@8() - 0x2315e1

  VFP8.exe!@imode@0() + 0x4f

  VFP8.exe!@DllWinMain2@12() + 0xb6

  VFP8.exe!_DllWinMain@8() + 0x30

  VFP8.exe!_WinMain@16() + 0x16

  VFP8.exe!_WinMainCRTStartup() + 0x212

  kernel32.dll!_BaseProcessStart@4() + 0x23

I changed the test code to do something more meaningful: execute a user form in an infinite loop. I used the Class browser as a sample.

DO WHILE INKEY(1) != 27

      DO (_browser)

      _obrowser.Release

      DOEVENTS

ENDDO

Examining the call stack indicated that MSComCTL.OCX was in the call stack much of the time. This implements the treeview/listview controls of the class browser.

From the call stack, you can see meaningful names like KeyStillDown, EndDo, and inkey_loop.

This technique is a poor developer’s profiler: with a few asynchronous breaks you can determine where the most time is being spent.

(Keep in mind that VS is reconstructing a call stack from the optimized build of many modules and it can be very difficult and is not always correct.)

With symbols loaded, you can even put breakpoints on symbolic names. For example, @goof@4 is the symbol for goof, which is called usually when an error occurs.

BTW, Sysinternals has several tools that will allow you to see what registry entries and files are being accessed, or even to inspect various aspects of a particular process.

Happy debugging!

 

 

41045

Comments

  • Anonymous
    October 18, 2004
    Speaking of processes hijacking your machine... I often get cases where my machine hangs up for long periods (seemingly network related) without nailing the CPU load at 100%, especially at startup.

    Is there a similar tactic to handle this kind of case? (Especially difficult because it happens at startup, not later, so it's hard to fire up a debugger first... never mind figuring out which process to attach to).

  • Anonymous
    July 08, 2005
    discount pharmacy http://www.bestrxpills.com

  • Anonymous
    July 24, 2005
     
    I received a comment on my blog VFP handles some images differently with GDIPlus
    Here's another...

  • Anonymous
    March 10, 2006
    You have useful information but please put more updates.

  • Anonymous
    March 15, 2006
    You have excellent and very informative site.

  • Anonymous
    March 17, 2006
    You have very curious information site.

  • Anonymous
    April 11, 2006
    i like your site very much

  • Anonymous
    April 15, 2006
    you have very nice made website and information about

  • Anonymous
    April 24, 2006
    yours website is very good made with nice color layout

  • Anonymous
    May 03, 2006
    I received a comment on this post: Will GetLastError ever work properly in VFP8.0?.  I was consistently...

  • Anonymous
    May 15, 2006
    you got very nice site design and please get more updates

  • Anonymous
    August 21, 2006
    Very nice blog. I read it every day.

  • Anonymous
    August 25, 2006
    Sometimes something goes wrong with your program and you want to investigate why. You can start Visual...

  • Anonymous
    December 18, 2006
    thoughts from a professional developer I do not agree. Go to http://www.hotelsblog.info/keen_United%20Kingdom/orache_England/indescribably_Bournemouth_1.html

  • Anonymous
    December 21, 2006
    thoughts from a professional developer I do not agree. Go to http://fmis.coa.gov.tw/Members/car/nsurance_1.html

  • Anonymous
    March 21, 2007
    thoughts from a professional developer I do not agree. Go to http://www.goworks.info/daintiness_Poland/scission_West%20Poland/majolica_Gdansk_1.html

  • Anonymous
    March 28, 2007
    thoughts from a professional developer I do not agree. Go to http://www.docareers.info/incinerate_Germany/utmost_Bavaria%20(Bayern)/sedum_N%C3%83%C2%BCrnberg_1.html

  • Anonymous
    June 15, 2007
    Good site, nice design! Please also visit my site:

  • Anonymous
    August 14, 2007
    thoughts from a professional developer I do not agree. Go to http://apartments.waw.pl/

  • Anonymous
    September 28, 2007
    area login member myfreepaysite

  • Anonymous
    November 10, 2007
    I spent a few hours at a local company called 2Bot ( http://www.2bot.com/ ) which makes a 3-D printer

  • Anonymous
    November 10, 2007
    I spent a few hours at a local company called 2Bot ( http://www.2bot.com/ ) which makes a 3-D printer

  • Anonymous
    June 08, 2009
    How do you find out why your computer or a running program is so slow? Here’s one way. Let’s attach the

  • Anonymous
    June 19, 2009
    PingBack from http://debtsolutionsnow.info/story.php?id=4090