Stack Exchange
WinDbg | winhttp!HTTP_USER_REQUEST
I have a hang application (Outlook.exe) and got a memory dump and see the following call stack:
02 008fab0c 7380072c     winhttp!HTTP_USER_REQUEST::_HandleSyncPending+0x4e
03 008fab44 737ff1c2     winhttp!HTTP_USER_REQUEST::_SysQueryDataAvailable+0x8bc
04 008fab74 7380b106     winhttp!HTTP_USER_REQUEST::QueryDataAvailable+0xe2
05 008fac08 57e8b4db     winhttp!WinHttpQueryDataAvailable+0x366
...

How is it possible to see which URL is queried?
Edit: kb output:
0:000> kb
 # ChildEBP RetAddr      Args to Child              
00 008faac8 76c83e49     00003910 00000000 00000000 ntdll!NtWaitForSingleObject+0xc
01 008faac8 7380442c     00003910 ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x99
02 008fab0c 7380072c     26454c40 008fab9c 57edb309 winhttp!HTTP_USER_REQUEST::_HandleSyncPending+0x4e
03 008fab44 737ff1c2     295c0998 00002000 008fab9c winhttp!HTTP_USER_REQUEST::_SysQueryDataAvailable+0x8bc
04 008fab74 7380b106     008fab9c 00000001 57edb309 winhttp!HTTP_USER_REQUEST::QueryDataAvailable+0xe2
05 008fac08 57e8b4db     25c87bb0 008fac48 008fcfd4 winhttp!WinHttpQueryDataAvailable+0x366


You have a 32 bit application. Try kb, have a look at the parameters passed to WinHttpQueryDataAvailable. Unfortunately, HINTERNET is not a data structure, but just a handle.

I concur w/ @ThomasWeller. The problem is that you would need the internal state of winhttp because WinHttpQueryDataAvailable is not passed the URL. There's also a good chance that this state is in kernel mode. At least I would try something as dumb as searching for http (or other schemes) pattern in the dump using the s command (granted you have a full dump). This might return something useful if the winhttp state is kept in user mode (but you might stumble upon false positives too).

Thank you ThomasWeller and Neitsa for the feedback. Is there a way to check the handle of strings?
I know it is possible to check the memory like Neitsa suggested it. Something like !dpx 008fab0c 008fac08 would be possible. But I would be interested to check exactly the handle (if it's even possible?!).

Sadly no, there's no such things as a "string handle". The HINTERNET (and other winhttp handles are non securable objects handles (i.e. they don't seem to have a kernel counterpart) and winhttp seems to be relying on winsock: there's a good chance the whole winhttp state is kept in user mode, so if you have a full dump there's a chance you could find the string that was used to initiate the connection (it might just be an IP string though, and it might have been freed in the meantime...).

got it :) So we can just guess! At least it's something ;-)
