title: App busy but not responding : how to check what it's doing?
body: <p>We have a .NET app. 
  On some specific machines, the application doesn't respond anymore. However, in task manager, the app is listed as 'active' (instead of 'not responding'). We can also see in task manager that the process keeps using 10% of the processor.
  We don't have a clue however what it is doing?</p>
  
  <p>Is there a way we can see what what code is being called or what the process is currently doing (call stack?)</p>
  
  <p>EDIT: Apparently we can't use remote debugger because the machine is not connected over a network, debugging over the internet isn't supported.
  The CPU-analyzer.exe program seems great, but we can't get it to work ?
  We've created a dump file and analyzed it with windb, this is the output :</p>
  
  <pre><code>.................................................WARNING: rsaenh overlaps cryptsp
  </code></pre>
  
  <p>.WARNING: RpcRtRemote overlaps rsaenh
  ......WARNING: WindowsCodecs overlaps System_Drawing_ni
  ........
  .......WARNING: msdart overlaps shfolder
  ...WARNING: comsvcs overlaps oledb32
  ...............WARNING: dhcpcsvc6 overlaps dhcpcsvc
  ................WARNING: apphelp overlaps GdiPlus
  .........WARNING: winhttp overlaps Faultrep
  .WARNING: webio overlaps comctl32_71bf0000
  .............
  ......
  wow64win!NtUserPeekMessage+0xa:
  00000000`732efdea c3              ret
  0:000> !analyze -v</p>
  
  <hr>
  
  <ul>
  <li>*</li>
  <li>Exception Analysis                                   *</li>
  <li>*
  <hr></li>
  </ul>
  
  <p><strong>* WARNING: Unable to verify checksum for AppName.exe
  <em></strong> ERROR: Module load completed but symbols could not be loaded for AppName.exe
  <strong></em> WARNING: symbols timestamp is wrong 0x4ce7c496 0x4f9235ab for GdiPlus.dll
  *</strong> WARNING: symbols timestamp is wrong 0x4a5bdf81 0x4a5bda2e for comsvcs.dll</p>
  
  <p>FAULTING_IP: 
  +a7d01d0
  00000000`00000000 ??              ???</p>
  
  <p>EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
  ExceptionAddress: 0000000000000000
     ExceptionCode: 80000003 (Break instruction exception)
    ExceptionFlags: 00000000
  NumberParameters: 0</p>
  
  <p>FAULTING_THREAD:  0000000000001678</p>
  
  <p>PROCESS_NAME:  AppName.exe</p>
  
  <p>OVERLAPPED_MODULE: Address regions for 'msdart' and 'shfolder' overlap</p>
  
  <p>ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.</p>
  
  <p>EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid</p>
  
  <p>MOD_LIST: </p>
  
  <p>NTGLOBALFLAG:  0</p>
  
  <p>APPLICATION_VERIFIER_FLAGS:  0</p>
  
  <p>MANAGED_STACK: !dumpstack -EE
  No export dumpstack found</p>
  
  <p>ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]</p>
  
  <p>LAST_CONTROL_TRANSFER:  from 00000000732cadb3 to 00000000732efdea</p>
  
  <p>BUGCHECK_STR:  APPLICATION_FAULT_STACKIMMUNE_NOSOS</p>
  
  <p>PRIMARY_PROBLEM_CLASS:  STACKIMMUNE</p>
  
  <p>DEFAULT_BUCKET_ID:  STACKIMMUNE</p>
  
  <p>STACK_TEXT:<br>
  00000000<code>00000000 00000000</code>00000000 unknown!AppName.exe+0x0</p>
  
  <p>SYMBOL_NAME:  unknown!AppName.exe</p>
  
  <p>FOLLOWUP_NAME:  MachineOwner</p>
  
  <p>MODULE_NAME: unknown</p>
  
  <p>IMAGE_NAME:  unknown</p>
  
  <p>DEBUG_FLR_IMAGE_TIMESTAMP:  0</p>
  
  <p>STACK_COMMAND:  ** Pseudo Context ** ; kb</p>
  
  <p>FAILURE_BUCKET_ID:  STACKIMMUNE_80000003_unknown!Unloaded</p>
  
  <p>BUCKET_ID:  X64_APPLICATION_FAULT_STACKIMMUNE_NOSOS_unknown!AppName.exe</p>
  
  <h2>Followup: MachineOwner</h2>
  
  <p>Could this be the culprit : Address regions for 'msdart' and 'shfolder' overlap ??</p>