title: Debugging a NotificationEvent in Kernel Debug (Windows)
body: <p>I'm debugging a process which is like frozen:</p>
  
  <ul>
  <li>I suspect the root cause is the thread below <code>THREAD 877f4030  Cid 0568.0fb8</code> that is stuck on the user-mode call to <code>GetOverlappedResult</code>.</li>
  </ul>
  
  <p>I have opened the dump with <code>kd.exe</code>.</p>
  
  <p>Namely, I'm interested into knowing more about the <code>NotificationEvent</code> which obviously is never releasing our thread.</p>
  
  <p>In the thread info we have:</p>
  
  <pre><code>879f6fdc  NotificationEvent
  </code></pre>
  
  <p>In what type should I cast address <code>879f6fdc</code> ? or in which structure field should I search for it, so as to understand, or have a clue to what is blocking the situation ?</p>
  
  <p>As far as the Thread Infos goes, this thread currently does not list any IRP that would be in undesired or unfinished state.</p>
  
  <p><hr>
  Below entire Thread Information for the corresponding thread:</p>
  
  <pre><code>THREAD 877f4030  Cid 0568.0fb8  Teb: 7ff3d000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
      879f6fdc  NotificationEvent
  Not impersonating
  DeviceMap                 89809fc8
  Owning Process            87950030       Image:         OurProduct.exe
  Attached Process          N/A            Image:         N/A
  Wait Start TickCount      1472232        Ticks: 5394 (0:00:01:24.146)
  Context Switch Count      2791788        IdealProcessor: 0
  UserTime                  00:00:06.848
  KernelTime                00:00:09.890
  Win32 Start Address MSVCR120!_threadstartex (0x721fbfb4)
  Stack Init 8c761fd0 Current 8c761bc8 Base 8c762000 Limit 8c75f000 Call 0
  Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
  Kernel stack not resident.
  ChildEBP RetAddr  Args to Child
  8c761be0 824cfced 877f4030 00000000 8ab36120 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
  8c761c18 824ceb4b 877f40f0 877f4030 879f6fdc nt!KiSwapThread+0x266
  8c761c40 824c856f 877f4030 877f40f0 00000000 nt!KiCommitThreadWait+0x1df
  8c761cb8 8267ae07 879f6fdc 00000006 826bca01 nt!KeWaitForSingleObject+0x393
  8c761d20 8248f8a6 00001018 00000000 00000000 nt!NtWaitForSingleObject+0xc6
  8c761d20 774f7094 00001018 00000000 00000000 nt!KiSystemServicePostCall (FPO: [0,3] TrapFrame @ 8c761d34)
  09f9f61c 774f6a24 758b179c 00001018 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
  09f9f620 758b179c 00001018 00000000 00000000 ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
  09f9f68c 758b7841 00001018 ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98 (FPO: [Non-Fpo])
  09f9f6a0 758cb9e1 00001018 ffffffff 064f3d10 KERNELBASE!WaitForSingleObject+0x12 (FPO: [Non-Fpo])
  09f9f6b8 745be159 00001018 0639ee0c 09f9f6ec KERNELBASE!GetOverlappedResult+0x57 (FPO: [Non-Fpo])
  </code></pre>
  
  <p>What is the correct way to proceed and know which event or synchronisation mechanism is faulting ?</p>
  
  <hr>
  
  <p>some commands on the NotificationEvent address:</p>
  
  <pre><code>0: kd&gt; !object 879f6fdc
  879f6fdc: Not a valid object (ObjectType invalid)
  
  0: kd&gt; dt nt!_KEVENT 879f6fdc
     +0x000 Header           : _DISPATCHER_HEADER
  </code></pre>
  
  <p>and then:</p>
  
  <pre><code>0: kd&gt; dt nt!_DISPATCHER_HEADER 879f6fdc
     +0x000 Type             : 0 ''
     +0x001 TimerControlFlags : 0 ''
     +0x001 Absolute         : 0y0
     +0x001 Coalescable      : 0y0
     +0x001 KeepShifting     : 0y0
     +0x001 EncodedTolerableDelay : 0y00000 (0)
     +0x001 Abandoned        : 0 ''
     +0x001 Signalling       : 0 ''
     +0x002 ThreadControlFlags : 0x4 ''
     +0x002 CpuThrottled     : 0y0
     +0x002 CycleProfiling   : 0y0
     +0x002 CounterProfiling : 0y1
     +0x002 Reserved         : 0y00000 (0)
     +0x002 Hand             : 0x4 ''
     +0x002 Size             : 0x4 ''
     +0x003 TimerMiscFlags   : 0 ''
     +0x003 Index            : 0y0
     +0x003 Processor        : 0y00000 (0)
     +0x003 Inserted         : 0y0
     +0x003 Expired          : 0y0
     +0x003 DebugActive      : 0 ''
     +0x003 ActiveDR7        : 0y0
     +0x003 Instrumented     : 0y0
     +0x003 Reserved2        : 0y0000
     +0x003 UmsScheduled     : 0y0
     +0x003 UmsPrimary       : 0y0
     +0x003 DpcActive        : 0 ''
     +0x000 Lock             : 0n262144
     +0x004 SignalState      : 0n0
     +0x008 WaitListHead     : _LIST_ENTRY [ 0x877f40f0 - 0x877f40f0 ]
  </code></pre>
  
  <p>from a former investigation I remember that if <code>+0x003 DpcActive</code> was 1, it would mean we'd be waiting for some hardware operation to put it to 0. But in this case it is 0.</p>
  
  <p>So right now, I just don't know what this NotificationEvent is waiting for.
  Any idea ?</p>