By Josh Straub 2007/07/01
Imagine yourself in this situation: you've been changing the data in a Windows application for a while, but you haven't saved yet (whoops). Suddenly, the program freezes and a sinking feeling sets in as you realize your data is lost, since the only choice now is to close and restart the program...
...or is it? Recently, Winamp froze on me and I faced losing the order of my 300 song playlist. Fortunately, I was able to unfreeze Winamp and resume normal operation! How? I used Process Explorer to locate the frozen thread in Winamp.exe and terminate it directly, allowing Winamp to continue right where it was before it froze! Sound like something you'd like to do, too? Read on:
I was browsing a website and listening to some tunes on Winamp, when I must have double-clicked too fast on the Playlist switching to a different track, and Winamp froze:
You can see the Winamp playlist is not responding; a gray menu from Paint Shop Pro has drawn over it, obscuring the Playlist with this graphical artifact that won't go away. Winamp is starting to play Pearl Jam - Breath, but it's stuck at 0:00. Not good. To make matters even worse, Winamp is set to "Always on Top", so although it's not responding, it still lands "on top" and makes the freeze really obnoxious to deal with!
Sysinternals makes a free tool called Process Explorer that works like an industrial-strength Windows Task Manager. I opened Process Explorer (working around the frozen Winamp windows) and selected Winamp from the task list, which looked like this:
Now we want to right-click on Winamp.exe in the Process Explorer task list, and select Properties. This brings up a host of information about the running task. Select the "Threads" tab, and we're faced with a list of running threads illustrated in the image below. Threads are individual parts of a program that run independently of each other. All programs contain threads; most programs contain many running threads, together they make up the program as you know it. But when a program freezes, often times it's just one specific thread that has actually frozen. How can we determine which one is holding up the show?
You can really tell Winamp is frozen at this point - it's hard to believe there could be any hope of bringing it back from the dead! If you notice on the right side of the image, there are 5 threads listed and I have selected the Winamp.exe thread with a Start Address titled "Winamp.exe+0x32bc0". How can I be sure this one is the frozen thread? If you react quickly to the program freeze, you can open up ProcExp and get to the Threads tab for the frozen program, and begin clicking on each thread one by one, making note of the "Start Time". Eventually you will find one (often at the very bottom of the Thread list, but not always) that has a Start Time equal in time to when the program froze. Looking at the task bar, you can see it's 4:02 PM, and the bottom thread has a Start Time of 03:59:16. When I took this snapshot, Winamp had frozen about 3 minutes earlier. It's almost like a smoking gun!
In other words, when I originally double-clicked Winamp, it started a new thread to do something (perhaps loading the MP3 to prepare for playback), but froze and locked up the entire program in the middle of doing so. Since none of the other threads have a Start Time close to this one, we can be pretty sure we've got the right thread. And since the program is frozen already, we're not taking a very big risk if we crash the program by guessing wrong. Now you can click Kill, which will kill the selected thread. You'll notice it change color and disappear from ProcExp's thread list. What happens next?
Voila!! After "Killing" the frozen thread, Winamp instantly resumes normal operation! I proved it by selecting a new track (Sevendust - 04 Silence) on the playlist. Look in the threads tab on ProcExp, and notice there are only 4 threads running now instead of 5. Now I can continue to use Winamp normally. However, since "digging into" a program and manipulating its threads isn't something the authors probably had in mind, it's a good idea to close the program and restart as soon as possible after saving your data (in my case I saved my playlist and then closed/restarted Winamp). You could leave the program running, but after manipulating the threads like we just did, you run the risk of unpredictable program behavior until it's closed. So this is sort of a "last resort", but you'll likely find that this trick works very well and very safe most of the time! And what a feeling of relief when the program unfreezes - it's as if it never froze in the first place!
This procedure works best on well-written multithreaded applications, and Winamp is as good as it gets. (My hat's off to Justin Frankel!) Other programs may have more complicated threads, or even worse, a single thread for everything. If your frozen program doesn't look as "easy" to unfreeze in ProcExp as my Winamp example, here's a few things to try:
Did you use the method in this article to get yourself out of a really tough situation? Drop me an email and let me know! I'd like to hear about it.
-- Josh Straub, 2007/07/01