Results 1 to 5 of 5

Thread: HP printer and cpu at 100%

  1. #1
    Red wine, not vodka! ZaiRoN's Avatar
    Join Date
    Oct 2001
    Location
    Italy
    Posts
    922
    Blog Entries
    17

    HP printer and cpu at 100%

    I’ll be in New York City from Thursday, I have too many things to prepare right now, and I don’t have time to end this story. Anyway, I thought it might be interesting to write something about this strange behaviour. It’s only a sort of preview, I hope to complete it in the near future.

    I have a new printer, it’s an hp c4380. Don’t know if it’s good or not, I don’t print too much. It was really easy to install and it works fine for me, I have nothing to complain about it… until some days ago when I noticed something strange. When the system starts, I sometimes happen to see the cpu at 100%:



    As you can see it happens when the system starts. It’s one of the starting process for sure. I opened ProcessExplorer just to have an idea about what’s going on:



    Svchost is used to load one or more services, there’s a specific list of services to load inside the registry. The problem doesn’t reside in svchost process, but it’s inside the specific loaded service. How to find it? ProcessExplorer is a great tool, it gives out a lot of information. Just click on the process item and you will have all the necessary information about the process. I’m interested in the command line section which is: “C:\WINDOWS\system32\svchost.exe -k HPService”. Ok, the problem should be inside HPService. To locate the name of the dll you can browse through the process properties, you’ll easily find out the dll: HPSLPSVC32.DLL

    This service belongs to hp printer and it’s used to check hp’s peripherals connected through the net. The service is automatically started (have a look at services.msc utility). I made some tries discovering that the problem arises when one or more computers connected to the lan are offline. I’m pretty sure there’s an error inside the dll, but how to find out where the problem is located at? In case like that, when the cpu works at 100%, the problem resides inside a loop. The process is waiting for something that won’t be received; it’s impossible to quit from it due to of a programming error. It could be an error on a variable initialization/update but there are many possibilities, there’s not a general explanation.

    What I did is to attach a debugger to the right svchost process hinstance. It’s pretty easy to locate the guilty loop, you only have to break on dll access. Here’s a snippet taken from the loop I was talking before:
    Code:
    10025D00  mov    eax, dword_100AC550
    10025D05  mov    ecx, [edi+4]
    10025D08  push   eax ; dwMilliseconds: 1000 ms
    10025D09  push   ecx ; hHandle
    10025D0A  call   ebx ; WaitForSingleObject
    10025D0C  mov    edx, [edi+10h]
    10025D0F  push   edx ; hEvent = 0
    10025D10  mov    esi, eax ; eax = WAIT_FAILED
    10025D12  call   ebp ; SetEvent
    10025D14  cmp    esi, WAIT_TIMEOUT
    10025D1A  jnz    short loc_10025D27
    10025D1C  mov    eax, [edi]
    10025D1E  mov    edx, [eax+24h]
    10025D21  mov    ecx, edi
    10025D23  call   edx ; call sub_100255E0
    10025D25  jmp    short loc_10025D00
    10025D27  cmp    esi, WAIT_FAILED
    10025D2A  jnz    short loc_10025D3A
    10025D2C  mov    eax, dword_100AC550
    10025D31  push   eax ; dwMilliseconds
    10025D32  call   ds:Sleep
    10025D38  jmp    short loc_10025D00
    Well, as you can see from the comments there are two problems:
    1. WaitForSingleObject returns WAIT_FAILED
    2. SetEvent’s parameter is 0

    I tried to call GetLastError after the two calls and the result was an ERROR_INVALID_HANDLE system error code. Pretty obvious eh!
    I don’t know where to look for now, an error on CreateEvent’s return value could be an answer. After a quick glance everything seems to be ok, but I need to check carefully.

    The problem occurs to many people out there. It was reported on HP forum support in March 2007, but the problem still exists. To solve (momentarily) it, it’s pretty easy: just set the service from automatic to manual… Anyway it could be interesting to find out where the problem resides, I’ll try to check when my trip will end.

  2. #2
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,206
    Blog Entries
    5
    Hehe, support is for wusses, that's how real reversers fix their computer problems.
    "Give a man a quote from the FAQ, and he'll ignore it. Print the FAQ, shove it up his ass, kick him in the balls, DDoS his ass and kick/ban him, and the point usually gets through eventually."

  3. #3
    I thought we preferred to just "apply" the "hammer" to the damn thing if it wouldn't "co-operate" with what we wanted to do!

    Regards,
    JMI

  4. #4
    I know this is pretty elementary but here goes, couldn't you just NOP it out?
    I know that is a lame answer, but it would work short term.....
    we are demons to some, angels to others.....

  5. #5
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    Quote Originally Posted by UrgeOverKill View Post
    I know this is pretty elementary but here goes, couldn't you just NOP it out?
    I know that is a lame answer, but it would work short term.....
    It seems safer to disable the service entirely rather than force it to run and have it skip its own synchronization checks. The latter could potentially lead to major problems, while the former approach is a "fail-safe".

Similar Threads

  1. Replies: 6
    Last Post: February 2nd, 2007, 16:44
  2. SoftICE to printer problem
    By toolmanx in forum Tools of Our Trade (TOT) Messageboard
    Replies: 33
    Last Post: January 29th, 2007, 09:15

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •