Recovering a frozen process

In a previous question I learned how to detect a frozen process:
http://www.experts-exchange.com/Programming/Programming_Languages/Visual_Basic/Q_21910881.html

Now the question is can I do something about it... is there any way to unfreeze the process or do I have to terminate it?
LVL 9
justchat_1Asked:
Who is Participating?
 
Mark_FreeSoftwareCommented:

i couldnt find any information about it, sorry,

however i have some idea: (no code, sorry)


attach your app to the program,
and detect the infinite loop

if found, then pause the process (suspend)

get the instruction pointer (at which address the next code is going to be executed, i really shouldnt know how)

save the next byte,
replace it with a ret (i think it was &HC3)
let the program execute a little piece of code (just let it jump from the ret)
then replace the ret back with the original byte
and resume the application


this is how i think it can be done, i can't help you further with the code, apart from these declarations:

Private Declare Function ResumeThread Lib "kernel32" (ByVal hThread As Long) As Long
Private Declare Function SuspendThread Lib "kernel32" (ByVal hThread As Integer) As Integer
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByVal lpBuffer As Any, ByVal nSize As Long, ByVal lpNumberOfBytesWritten As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
0
 
Mark_FreeSoftwareCommented:

depends,

if it is your process,
and you know the cause of the hanging,
maybey you can do somthing about it,

else you are out of luck
0
 
justchat_1Author Commented:
there are no windows messages I can send to break execution?  How would something like norton crashguard work?
0
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
sakuya_suCommented:
if its already crashed I dont think the messages will do anything, it is also up to the programmer of that application hwo these messages are handled
0
 
justchat_1Author Commented:
Thats not the case-the program is stuck in an infinite loop and is freezing up (but still running)... Norton crash guard has a way to kick the program out of the loop-does anyone know how?
0
 
Mark_FreeSoftwareCommented:

i think it requires some real low-level coding

you can't do that in one day in vb
0
 
justchat_1Author Commented:
Are there any dll's that could do this or links with more information?
0
 
justchat_1Author Commented:
Thats a big help...ill look into that!!

If any other experts have opinions or code feel free to post...
0
 
sakuya_suCommented:
the above can only work if the Process is started by your own program, just by attaching you still cannot write to the problem program' memory (can you?)
0
 
justchat_1Author Commented:
good question... I know that most program memory is read/execute only and I remember something about a way to change memory permissions but I dont remember if thats only for your own memory space or for other programs as well?
0
 
Mark_FreeSoftwareCommented:

the above can only work if the Process is started by your own program, just by attaching you still cannot write to the problem program' memory (can you?)

it is possible,
i did it even without pausing the code!
but this is VERY dangerous, because the program can crash

0
 
justchat_1Author Commented:
Dangerous until figured out or always dangerous?
0
 
Mark_FreeSoftwareCommented:

dangerous if the code is executing near that point

imagine this:

the program is executing some long instruction (say6 bytes)
at the same time you change one (or more) of those bytes

weird things can happen,
bluescreen,
total lockup,
nothing,
program just crashes,
etc
0
 
justchat_1Author Commented:
So it really depends on what code I break out of?
0
 
sakuya_suCommented:
well yeah unofficially you can have ASM code injections but those are like really dodgy practices
0
 
nffvrxqgrcfqvvcCommented:
I know there is something like this but only for Windows Vista (http://msdn.microsoft.com/library/en-us/recovery/recovery/registerapplicationrestart.asp)
I don't know of anything for 2000 or XP, The typical idea is if the application is hung you should check again a couple more times to make sure. if its hung you should first try to send WM_CLOSE, if this does not respond then you must terminate the process. This is what windows XP does when an application is hung. You might recall the dialog (send) (dont send) error. However since you know what application is hung the best you could probrably do is allow the user to restart the process since you know the path this wouldn't be a problem.
0
 
justchat_1Author Commented:
good link...its a shame thats not around yet

the restart idea isnt a bad one but what about applications that are working with unsaved data?
Also, how do I know if they were started with parameters (cause I would probably need to include them again)?
0
 
Mark_FreeSoftwareCommented:

>>the restart idea isnt a bad one but what about applications that are working with unsaved data?

they lose it, except if they have some emergency save built in (like ms word)


as far as i know, there are 2 different ways,
by code injection (that is what process explorer of sysinternals does)
and there seems to be an undocumented api way

too bad i cannot find the article that described this,
(still looking)
0
 
justchat_1Author Commented:
What would sending a system hibernating message do to a process?? (just to the process, not global)
0
 
justchat_1Author Commented:
Not what I was looking for but definitely valuable info..
0
 
Mark_FreeSoftwareCommented:

thanks for the points, and happy coding!



too bad you could find what you were looking for...
0
 
justchat_1Author Commented:
what im looking for is probably not possible :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.