You need a combination of minidump (use DrWatson to create them if you do not want to add your own mini-dump generation code) and userdump to start creating a mini-drive in freeze mode.
The thing about automatic hang-up detection is that it is difficult to solve when something is hanging, and when it just slows down or is blocked by IO, wait. I personally prefer the user to report this intentionally when they thought they hung him. Besides being much simpler (my applications don't hang out often, if at all :)), it also helps them “be part of the solution”. They like it.
First, check out the classic bugslayer article on alarms and symbols, which also provides excellent information on what happens to these things.
Secondly, get userdump , which allows you to create dumps, and to configure for dumping
When you have a dump, open it in WinDBG, and you can check all the status of the program, including threads and stop lights, registers, memory and parameters for functions. I think it will be especially interesting for you to use the ~ * kp "command in Windbg to get a stop call for each thread, but"! locks "to show all blocking objects. I think you will find that the hang will be due to a deadlock of synchronization objects, which will be difficult to track, since all threads are usually waiting for WaitForSingleObject, but look further at the stop calls to see application threads (rather than a framework such as background notifications and network routines.) After you narrow them down, you can see what calls have been made, maybe add some logging tools to the application to try give you more information the next time it failed.
Good luck.
Ps. A quick google reminded me of this: Debugging deadlocks . (CDB - windbg command line equivalent)
source share