In Windbg, how do I determine if a ManualResetEvent is signaled or not?

问题

I took a memory dump of a process using

.dump /ma c:\mydump.dmp

I would like to figure out if a specific ManualResetEvent handle is set or waiting. I've tried

0:181> !handle 2db0 f Event
Handle 0000000000002db0
  Type          Event
  Attributes    0
  GrantedAccess 0x1f0003:
         Delete,ReadControl,WriteDac,WriteOwner,Synch
         QueryState,ModifyState
  HandleCount   2
  PointerCount  524289
  Name          <none>
  Object specific information

I have discovered that someone got more information using the same command somewhere on the internet.

  ...
  Object specific information
    Event Type Auto Reset <- this was missing when I tried
    Event is Waiting      <- this was missing when I tried

Anyone know what I'm doing wrong? Perhaps this is only possible when debugging a live application?

回答1:

use .dump /mah not just ma handle information is not captured with /ma

0:012> .dump /mah c:\mydumpu.dmp
Creating c:\mydumpu.dmp - mini user dump
Dump successfully written
0:012> .opendump c:\mydumpu.dmp

Loading Dump File [c:\mydumpu.dmp]
User Mini Dump File with Full Memory: Only application data is available

Opened 'c:\mydumpu.dmp'
||0:0:012> !handle 0 0 event
107 handles of type Event
||0:0:012> !handle 0 f event
Handle 2c
  Type          Event
  Attributes    0
  GrantedAccess 0x1f0003:
         Delete,ReadControl,WriteDac,WriteOwner,Synch
         QueryState,ModifyState
  HandleCount   2
  PointerCount  4
  Name          <none>
  Object Specific Information
    Event Type Auto Reset
    Event is Waiting

来源：https://stackoverflow.com/questions/31715429/in-windbg-how-do-i-determine-if-a-manualresetevent-is-signaled-or-not

标签

windbg

handle