In Frame 2, kernel32!WaitForMultipleObjects+0x19 , win32 API call is waiting on multiple objects/handles.
In Windbg, how can we determine those handles for this specific frame?
0:012> k
# ChildEBP RetAddr 00 093ffba0 7510285f ntdll!NtWaitForMultipleObjects+0xc
01 093ffd2c 76f89188 KERNELBASE!WaitForMultipleObjectsEx+0xcc
02 093ffd48 61006516 kernel32!WaitForMultipleObjects+0x19
03 093ffd80 610065b0 mshtml!CRenderThread::WaitForWork+0x82
04 093ffdc4 61130503 mshtml!CRenderThread::RenderThread+0x2b0
05 093ffdd4 6d363a31 mshtml!CRenderThread::StaticRenderThreadProc+0x23
06 (Inline) -------- IEShims!NS_CreateThread::ThreadProc+0x86
07 093ffe0c 76f8919f IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x94
08 093ffe18 776ead8f kernel32!BaseThreadInitThunk+0xe
09 093ffe60 776ead5a ntdll!__RtlUserThreadStart+0x2f
0a 093ffe70 00000000 ntdll!_RtlUserThreadStart+0x1b
**//Arguments passed in function call : kernel32!WaitForMultipleObjects+0x19**
0:012> dd 093ffd48
093ffd48 093ffd80 61006516 **00000002 093ffd6c**
093ffd58 **00000000 ffffffff** 00000000 00000000
093ffd68 05ef6078 00000778 000007c8 00000002
093ffd78 ffffffff 093ffdc4 093ffdc4 610065b0
093ffd88 093ffde0 00000000 00000006 61015990
093ffd98 1b541170 00000000 00000000 00000000
093ffda8 00000000 00000000 00000000 1b541170
093ffdb8 00000000 05ef6078 003ffdd4 093ffdd4
output of k
kd> $$ 00adfb88 7755fe39 ntdll!NtWaitForMultipleObjects+0xc (FPO: [5,0,0])
dumping dwords at ebp
kd> dd 00adfb88 l 8
00adfb88 77576a44 7755fe39 00000010 00412ca8
00adfb98 00000001 00000001 00000000 77cc0c57
kd> $$ ebp+8 = first argument = 10
kd> $$ ebp+c = secon argumet = * to handles 412ca8
kd> $$ the handles are
kd> dd 412ca8 l10
00412ca8 000000f4 000000f0 0000069c 00000900
00412cb8 00000464 000007d0 0000081c 00000828
00412cc8 000006d8 00000640 00000634 0000056c
00412cd8 0000037c 00000460 00000654 00000100
a script like this can fetch you all the handle
kd> .foreach /pS 1 /ps 1 (place { dd /c 1 412ca8 l10 } ) { !handle place 2}
output
PROCESS 86f6a6c8 SessionId: 1 Cid: 0b78 Peb: 7ffd8000 ParentCid: 0b6c
DirBase: 7e26c4c0 ObjectTable: b908ef00 HandleCount: 1079.
Image: explorer.exe
Handle table at b908ef00 with 1079 entries in use
00f4: Object: 86945a90 GrantedAccess: 001f0003 Entry: b90951e8
Object: 86945a90 Type: (84eaf350) Timer
ObjectHeader: 86945a78 (new version)
HandleCount: 1 PointerCount: 2
00f0: Object: 869416c0 GrantedAccess: 00100002 Entry: b90951e0
Object: 869416c0 Type: (84eaf350) Timer
ObjectHeader: 869416a8 (new version)
HandleCount: 1 PointerCount: 2
069c: Object: 86a12388 GrantedAccess: 00100004 Entry: b9095d38
Object: 86a12388 Type: (84ed06b8) WmiGuid
ObjectHeader: 86a12370 (new version)
HandleCount: 1 PointerCount: 2
0900: Object: 869b2d38 GrantedAccess: 001f0003 Entry: b8601200
Object: 869b2d38 Type: (84eb0978) Event
ObjectHeader: 869b2d20 (new version)
HandleCount: 1 PointerCount: 2
0464: Object: 85540d00 GrantedAccess: 001f0003 Entry: b90958c8
Object: 85540d00 Type: (84eb0978) Event
ObjectHeader: 85540ce8 (new version)
HandleCount: 1 PointerCount: 3
07d0: Object: 8552a480 GrantedAccess: 001f0003 Entry: b9095fa0
Object: 8552a480 Type: (84eb0978) Event
ObjectHeader: 8552a468 (new version)
HandleCount: 1 PointerCount: 4
081c: Object: 85cdde78 GrantedAccess: 001f0003 Entry: b8601038
Object: 85cdde78 Type: (84eb0978) Event
ObjectHeader: 85cdde60 (new version)
HandleCount: 1 PointerCount: 3
Directory Object: 98a802a8 Name: PRS_EXTERNAL_CHECK_CHANGED_NOTIFY
0828: Object: 86c4c938 GrantedAccess: 001f0003 Entry: b8601050
Object: 86c4c938 Type: (84eb0978) Event
ObjectHeader: 86c4c920 (new version)
HandleCount: 2 PointerCount: 5
Directory Object: 98a802a8 Name: {43a2b8d7-6fed-4c18-bd36-b4630d61afb5}
06d8: Object: 86d014d0 GrantedAccess: 001f0003 Entry: b9095db0
Object: 86d014d0 Type: (84eb0978) Event
ObjectHeader: 86d014b8 (new version)
HandleCount: 1 PointerCount: 2
0640: Object: 85ce4380 GrantedAccess: 001f0003 Entry: b9095c80
Object: 85ce4380 Type: (84eb0978) Event
ObjectHeader: 85ce4368 (new version)
HandleCount: 1 PointerCount: 2
0634: Object: 86f17e20 GrantedAccess: 001f0003 Entry: b9095c68
Object: 86f17e20 Type: (84eb0978) Event
ObjectHeader: 86f17e08 (new version)
HandleCount: 1 PointerCount: 2
056c: Object: 85ce7750 GrantedAccess: 001f0003 Entry: b9095ad8
Object: 85ce7750 Type: (84eb0978) Event
ObjectHeader: 85ce7738 (new version)
HandleCount: 1 PointerCount: 2
037c: Object: 86bbcae8 GrantedAccess: 001f0003 Entry: b90956f8
Object: 86bbcae8 Type: (84eb0978) Event
ObjectHeader: 86bbcad0 (new version)
HandleCount: 2 PointerCount: 3
0460: Object: 86cdab88 GrantedAccess: 001f0003 Entry: b90958c0
Object: 86cdab88 Type: (84eb0978) Event
ObjectHeader: 86cdab70 (new version)
HandleCount: 1 PointerCount: 2
0654: Object: 85ce6838 GrantedAccess: 001f0003 Entry: b9095ca8
Object: 85ce6838 Type: (84eb0978) Event
ObjectHeader: 85ce6820 (new version)
HandleCount: 1 PointerCount: 2
0100: Object: 865bb170 GrantedAccess: 00100002 Entry: b9095200
Object: 865bb170 Type: (84eaf350) Timer
ObjectHeader: 865bb158 (new version)
HandleCount: 1 PointerCount: 2
kd>