windbg查看设备栈设备树学习总结
来源：互联网 发布：mysql建立索引 编辑：程序博客网 时间：2024/06/14 23:33
用windbg寻找设备树根节点
http://blog.csdn.net/lixiangminghate/article/details/51729945用ReactOS上明确说过，Pnp管理器对每种设备都会创建一个虚拟root device用于构建设备树；同时这个新创建的root device又作为一个设备栈的栈底，往上形成完整的设备栈。用windbg调试时，可以看到这个虚拟设备属于/driver/pnpmanager驱动。
昨天出于好奇想看下设备树，结果发现只有虚拟设备attach在/driver/pnpmanger创建的设备上，而类似pci/usb设备的设备栈栈底根本不是/driver/pnpmanager设备，这让我很是怀疑，M$到底怎样形成以root为根节点的设备树。
如mssmbios.sys位于设备管理器system设备类下，注册表路径为:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\SYSTEM\0002
用windbg查看设备堆栈，可以看到这个设备attach在/driver/pnpmanger根节点上:
kd> !drvobj mssmbios Driver object (81f81da0) is for: \Driver\mssmbios Driver Extension List: (id , addr) Device Object list: 81c8e408 kd> !devstack 81c8e408 !DevObj !DrvObj !DevExt ObjectName > 81c8e408 \Driver\mssmbios 81c8e4c0 821e73d0 \Driver\PnpManager 821e7488 00000034 !DevNode 821e7288 : DeviceInst is "Root\SYSTEM\0002" ServiceName is "mssmbios"
又如DDK样例toaster的虚拟总线设备busenum同样位于system设备类下，注册表路径为:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\SYSTEM\0003
其设备栈为:,亦可看到栈底pnpmanager设备
[cpp] view plain copy
kd> !drvobj busenum
Driver object (81f81030) is for:
\Driver\busenum
Driver Extension List: (id , addr)
Device Object list:
81ff3030
kd> !devstack 81ff3030
!DevObj !DrvObj !DevExt ObjectName
> 81ff3030 \Driver\busenum 81ff30e8
821e7190 \Driver\PnpManager 821e7248 00000035
!DevNode 821a0008 :
DeviceInst is "Root\SYSTEM\0003"
ServiceName is "busenum"
然而，对于一些总线设备根本找不到pnpmanager,如PCI总线和USB总线:
[cpp] view plain copy
kd> !drvobj pci
Driver object (82189218) is for:
\Driver\PCI
Driver Extension List: (id , addr)
Device Object list:
82127c70 82127e50 82127030 821e03a0
...
8219cb98 821e5370 821ba160
kd> !devstack 82127c70
!DevObj !DrvObj !DevExt ObjectName
81d34028 \Driver\usbehci 81d340e0 USBFDO-1
82127790 \Driver\ACPI 82187810 00000064
> 82127c70 \Driver\PCI 82127d28 NTPNP_PCI0043
!DevNode 821272e8 :
DeviceInst is "PCI\VEN_15AD&DEV_0770&SUBSYS_077015AD&REV_00\4&47b7341&0&1888"
ServiceName is "usbehci"
[cpp] view plain copy
kd> !drvobj usbhub
Driver object (820de2c0) is for:
\Driver\usbhub
Driver Extension List: (id , addr)
Device Object list:
81c74c98 81d542f0 820f1b70 81fcac98
81c7ac98
kd> !devstack 81c74c98
!DevObj !DrvObj !DevExt ObjectName
> 81c74c98 \Driver\usbhub 81c74d50 00000079
81d542f0 \Driver\usbhub 81d543a8 USBPDO-3
!DevNode 81c82c48 :
DeviceInst is "USB\Vid_0e0f&Pid_0002\6&2edefd9b&0&2"
ServiceName is "usbhub"
对此，我百思不得解，pnpmanager去哪了？经过周AM指点，搞明白一件事:用!drvobj PCI列出pci设备中，除了最后一个是Fdo，其他都是Pdo(这里Fdo设备的意思是由PCI总线驱动AddDevice函数创建的设备，附加在底层的ACPI总线上，而Pdo设备是PCI总线探测到总线上接入了新设备，从而为这个新设备创建了一个Pdo以形成设备栈)。这些Fdo本身是由PCI总线创建，因此并不会attach在pnpmanager上，而通过查找Fdo设备的设备栈，才能找出栈底Pnpmanager。
顺着周AM的思路，我重新调试了一遍，的确找到了PCI总线所在的Pnpmanager，以上面的环境为例，
[cpp] view plain copy
kd> !drvobj pci
Driver object (82189218) is for:
\Driver\PCI
Driver Extension List: (id , addr)
Device Object list:
82127c70 82127e50 82127030 821e03a0
...
8219cb98 821e5370 821ba160
Pci总线驱动创建的设备0x821ba160就是Fdo(为什么Fdo位于最后?因为这是PCI!AddDevice创建的第一个设备对象，之后创建的设备对象都通过InsertListTail插入到设备队列头部，因此遍历设备队列时，Fdo是最后被遍历到的)，查看它的设备栈:
[cpp] view plain copy
kd> !devstack 821ba160
!DevObj !DrvObj !DevExt ObjectName
> 821ba160 \Driver\PCI 821ba218
821731a8 \Driver\ACPI 821e2940 00000038
!DevNode 821de178 :
DeviceInst is "ACPI\PNP0A03\2&daba3ff&0"
ServiceName is "pci"
PCI设备堆叠在ACPI的Pdo上，怪不得找不到在PCI的设备栈中找不到Pnpmanager。继续寻祖,查找ACPI驱动创建的Fdo:
[cpp] view plain copy
kd> !drvobj ACPI
Driver object (8219ca10) is for:
\Driver\ACPI
Driver Extension List: (id , addr)
Device Object list:
8212c628 8212c740 8212c858 82126538
...
821731a8 8219c8f8
kd> !devstack 8219c8f8
!DevObj !DrvObj !DevExt ObjectName
> 8219c8f8 \Driver\ACPI 821e2ea0
821a0aa8 \Driver\ACPI_HAL 821a0b60 00000037
!DevNode 8219cd50 :
DeviceInst is "ACPI_HAL\PNP0C08\0"
ServiceName is "ACPI"
同样ACPI的Fdo堆叠在ACPI_HAL驱动的Pdo上，继续寻祖，这次找ACPI_HAL的堆叠情况:
[cpp] view plain copy
kd> !drvobj ACPI_HAL
Driver object (821a0f38) is for:
\Driver\ACPI_HAL
Driver Extension List: (id , addr)
Device Object list:
821a0aa8 821a0bc8
kd> !devstack 821a0bc8
!DevObj !DrvObj !DevExt ObjectName
> 821a0bc8 \Driver\ACPI_HAL 821a0c80
821a4c68 \Driver\PnpManager 821a4d20 00000001
!DevNode 821a4b20 :
DeviceInst is "Root\ACPI_HAL\0000"
终于在ACPI_HAL驱动的Fdo设备栈中找到了Pnpmanager。这和Windows内核原理与实现书中提供的设备树的结构完全相似
如果此时再深究一下PnpManager驱动创建的设备对象，会发现系统中果真只有一个根设备节点，而其他的PnpManager设备对象都是为了扩展设备树一点一点生长出来的:
[cpp] view plain copy
kd> !drvobj PnpManager
Driver object (821eb2e8) is for:
\Driver\PnpManager
Driver Extension List: (id , addr)
Device Object list:
821e7190 821e73d0 821e7610 821e7850
...
821a4c68 821a4020
kd> !devstack 821a4020
!DevObj !DrvObj !DevExt ObjectName
> 821a4020 \Driver\PnpManager 821a40d8
!DevNode 821a4ee8 :
DeviceInst is "HTREE\ROOT\0" <----从名字能感觉出这是根设备节点
kd> !devstack 821a4c68
!DevObj !DrvObj !DevExt ObjectName
821a0bc8 \Driver\ACPI_HAL 821a0c80
> 821a4c68 \Driver\PnpManager 821a4d20 00000001 <----<span style="font-family: Arial, Helvetica, sans-serif;">名字看着这么没个性，肯定不是根设备节点了</span>
!DevNode 821a4b20 :
DeviceInst is "Root\ACPI_HAL\0000"
========
windbg 查看设备信息
http://blog.csdn.net/wjcsharp/article/details/111693491. 相关命令
!devobj 查看设备对象信息
!drvobj 查看驱动对象信息
!devstack 查看设备栈
2. 系统设备树
!devnode 0 1
[cpp] view plain copy
kd> !devnode 0 1
Dumping IopRootDeviceNode (= 0x865b1ee8)
DevNode 0x865b1ee8 for PDO 0x865b1020
InstancePath is "HTREE\ROOT\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b1ae0 for PDO 0x865b1c28
InstancePath is "Root\ACPI_HAL\0000"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e1630 for PDO 0x865adf00
InstancePath is "ACPI_HAL\PNP0C08\0"
ServiceName is "ACPI"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864c7118 for PDO 0x865691a8
InstancePath is "ACPI\PNP0A03\2&daba3ff&0"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b8c0 for PDO 0x865e46a0
InstancePath is "PCI\VEN_8086&DEV_7190&SUBSYS_00000000&REV_01\3&61aaa01&0&00"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b7a0 for PDO 0x8653aba8
InstancePath is "PCI\VEN_8086&DEV_7191&SUBSYS_00000000&REV_01\3&61aaa01&0&08"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b680 for PDO 0x865a8e50
InstancePath is "PCI\VEN_8086&DEV_7110&SUBSYS_00000000&REV_08\3&61aaa01&0&38"
ServiceName is "isapnp"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864ae3f0 for PDO 0x864aef10
InstancePath is "ISAPNP\ReadDataPort\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864ae2d0 for PDO 0x864aedf8
InstancePath is "ACPI\PNP0C02\1f"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
DevNode 0x864ae1b0 for PDO 0x864aece0
InstancePath is "ACPI\PNP0200\4&5289e18&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
DevNode 0x860a8008 for PDO 0x864aebc8
InstancePath is "ACPI\PNP0001\4&5289e18&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
DevNode 0x860a8ee8 for PDO 0x864aeab0
InstancePath is "ACPI\PNP0100\4&5289e18&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
DevNode 0x860a8dc8 for PDO 0x864ae998
InstancePath is "ACPI\PNP0B00\4&5289e18&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a8ca8 for PDO 0x864ae880
InstancePath is "ACPI\PNP0800\4&5289e18&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
DevNode 0x860a8b88 for PDO 0x864ae768
InstancePath is "ACPI\PNP0303\4&5289e18&0"
ServiceName is "i8042prt"
TargetDeviceNotify List - f 0xe16b4780 b 0xe16b4780
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a8a68 for PDO 0x864ae650
InstancePath is "ACPI\PNP0F13\4&5289e18&0"
ServiceName is "i8042prt"
TargetDeviceNotify List - f 0xe16ab3b8 b 0xe16ab3b8
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a8948 for PDO 0x864ae538
InstancePath is "ACPI\PNP0A05\4&5289e18&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a83c8 for PDO 0x860a8858
InstancePath is "ACPI\PNP0400\5&324d5432&0"
ServiceName is "Parport"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864cf548 for PDO 0x862f6040
InstancePath is "LPTENUM\MicrosoftRawPort\6&16ccfde1&0&LPT1"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a82a8 for PDO 0x860a8740
InstancePath is "ACPI\PNP0501\1"
ServiceName is "Serial"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a8188 for PDO 0x860a8628
InstancePath is "ACPI\PNP0501\2"
ServiceName is "Serial"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864b4008 for PDO 0x860a8510
InstancePath is "ACPI\PNP0700\5&324d5432&0"
ServiceName is "fdc"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860a64d0 for PDO 0x862c4840
InstancePath is "FDC\GENERIC_FLOPPY_DRIVE\6&1435b2e2&0&0"
ServiceName is "flpydisk"
TargetDeviceNotify List - f 0xe171a430 b 0xe171a430
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b560 for PDO 0x860a0e50
InstancePath is "PCI\VEN_8086&DEV_7111&SUBSYS_197615AD&REV_01\3&61aaa01&0&39"
ServiceName is "intelide"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864b4148 for PDO 0x864b4460
InstancePath is "PCIIDE\IDEChannel\4&23686003&0&0"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864b3008 for PDO 0x864b4290
InstancePath is "PCIIDE\IDEChannel\4&23686003&0&1"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86463a78 for PDO 0x86431b00
InstancePath is "IDE\CdRomNECVMWar_VMware_IDE_CDR10_______________1.00____\3031303030303030303030303030303030303130"
ServiceName is "cdrom"
TargetDeviceNotify List - f 0xe1615440 b 0xe16b74f0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b440 for PDO 0x864636f0
InstancePath is "PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61aaa01&0&3F"
ServiceName is "vmci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b320 for PDO 0x865e4c80
InstancePath is "PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61aaa01&0&78"
ServiceName is "vmx_svga"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8641b200 for PDO 0x865e3380
InstancePath is "PCI\VEN_104B&DEV_1040&SUBSYS_1040104B&REV_01\3&61aaa01&0&80"
ServiceName is "vmscsi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8643d8e8 for PDO 0x8647ca38
InstancePath is "SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S&Rev_1.0\4&5fcaafc&0&000"
ServiceName is "disk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a008 for PDO 0x8643e8f8
InstancePath is "PCI\VEN_15AD&DEV_0790&SUBSYS_00000000&REV_02\3&61aaa01&0&88"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86470648 for PDO 0x865173a0
InstancePath is "PCI\VEN_8086&DEV_7112&SUBSYS_197615AD&REV_00\4&47b7341&0&0088"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862534d0 for PDO 0x86253618
InstancePath is "USB\ROOT_HUB\5&1dc927ff&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864511f0 for PDO 0x8631e168
InstancePath is "USB\Vid_0e0f&Pid_0003\6&2edefd9b&0&1"
ServiceName is "usbccgp"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8632fcd0 for PDO 0x8632f030
InstancePath is "USB\Vid_0e0f&Pid_0003&MI_00\7&2cbb743&0&0000"
ServiceName is "HidUsb"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x860ab008 for PDO 0x86500d28
InstancePath is "HID\Vid_0e0f&Pid_0003&MI_00\8&3460d90f&0&0000"
ServiceName is "mouhid"
TargetDeviceNotify List - f 0xe16ab418 b 0xe16ab418
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8632fbb0 for PDO 0x8632fe18
InstancePath is "USB\Vid_0e0f&Pid_0003&MI_01\7&2cbb743&0&0001"
ServiceName is "HidUsb"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8631d108 for PDO 0x85f53630
InstancePath is "HID\Vid_0e0f&Pid_0003&MI_01\8&bf62b46&0&0000"
ServiceName is "mouhid"
TargetDeviceNotify List - f 0xe16ab478 b 0xe16ab478
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86423198 for PDO 0x85fa6de8
InstancePath is "USB\Vid_0e0f&Pid_0002\6&2edefd9b&0&2"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86470528 for PDO 0x86470030
InstancePath is "PCI\VEN_1022&DEV_2000&SUBSYS_20001022&REV_10\4&47b7341&0&0888"
ServiceName is "vmxnet"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86470408 for PDO 0x86470e50
InstancePath is "PCI\VEN_1274&DEV_1371&SUBSYS_13711274&REV_02\4&47b7341&0&1088"
ServiceName is "es1371"
TargetDeviceNotify List - f 0xe1ea4458 b 0xe1ea4458
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8607b660 for PDO 0x86473040
InstancePath is "LEGACY\JOYSTICK\5&24c8a7aa&0&ENUM&"
ServiceName is "gameenum"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864702e8 for PDO 0x86470c70
InstancePath is "PCI\VEN_15AD&DEV_0770&SUBSYS_077015AD&REV_00\4&47b7341&0&1888"
ServiceName is "usbehci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8645c1e0 for PDO 0x86412030
InstancePath is "USB\ROOT_HUB20\5&2f792170&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626aee8 for PDO 0x860bb1e0
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&A8"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626adc8 for PDO 0x86463288
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&A9"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626aca8 for PDO 0x865e4370
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AA"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626ab88 for PDO 0x865acc90
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AB"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626aa68 for PDO 0x865ac958
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AC"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a948 for PDO 0x865ad748
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AD"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a828 for PDO 0x86524e50
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AE"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a708 for PDO 0x86524c70
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AF"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a5e8 for PDO 0x865e1e50
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B0"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a4c8 for PDO 0x865e1b18
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B1"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a3a8 for PDO 0x865abe50
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B2"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a288 for PDO 0x865abb18
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B3"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8626a168 for PDO 0x8653a030
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B4"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe008 for PDO 0x8653a5a8
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B5"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbeee8 for PDO 0x8653a270
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B6"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbedc8 for PDO 0x865e2c58
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B7"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbeca8 for PDO 0x865e2920
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B8"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbeb88 for PDO 0x865aae50
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B9"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbea68 for PDO 0x865aac70
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BA"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe948 for PDO 0x865aa938
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BB"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe828 for PDO 0x865e3e50
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BC"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe708 for PDO 0x865e3c70
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BD"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe5e8 for PDO 0x865e3938
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BE"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe4c8 for PDO 0x86164030
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BF"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe3a8 for PDO 0x861648a8
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C0"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe288 for PDO 0x86164570
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C1"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85fbe168 for PDO 0x86164238
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C2"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86155008 for PDO 0x860bbcf8
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C3"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86155ee8 for PDO 0x860bb9c0
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C4"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86155dc8 for PDO 0x860bb688
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C5"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86155ca8 for PDO 0x865e9e50
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C6"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86155b88 for PDO 0x865e9b18
InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C7"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86155a68 for PDO 0x865e3268
InstancePath is "ACPI\PNP0C02\4"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
DevNode 0x865681c8 for PDO 0x8654f1a8
InstancePath is "ACPI\ACPI0003\1"
ServiceName is "CmBatt"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8657d1c8 for PDO 0x865ca1f8
InstancePath is "ACPI\GenuineIntel_-_x86_Family_6_Model_58\_0"
ServiceName is "intelppm"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865531c8 for PDO 0x865cd200
InstancePath is "ACPI\PNP0A05\10"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865ace48 for PDO 0x86164a88
InstancePath is "ACPI\PNP0A05\20"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8653e1c8 for PDO 0x86463f18
InstancePath is "ACPI\FixedButton\2&daba3ff&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b1780 for PDO 0x865b18c8
InstancePath is "Root\COMPOSITE_BATTERY\0000"
ServiceName is "Compbatt"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b1540 for PDO 0x865b1688
InstancePath is "Root\dmio\0000"
ServiceName is "dmio"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b1300 for PDO 0x865b1448
InstancePath is "Root\ftdisk\0000"
ServiceName is "ftdisk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x864629b8 for PDO 0x86431900
InstancePath is "STORAGE\Volume\1&30a96598&0&Signature99639963Offset7000Length9FF662000"
ServiceName is "VolSnap"
TargetDeviceNotify List - f 0xe14f3868 b 0xe167d340
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e8008 for PDO 0x865b1208
InstancePath is "Root\LEGACY_AFD\0000"
ServiceName is "AFD"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e8dc8 for PDO 0x865e8f10
InstancePath is "Root\LEGACY_BEEP\0000"
ServiceName is "Beep"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e8b88 for PDO 0x865e8cd0
InstancePath is "Root\LEGACY_DMBOOT\0000"
ServiceName is "dmboot"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e8948 for PDO 0x865e8a90
InstancePath is "Root\LEGACY_DMLOAD\0000"
ServiceName is "dmload"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e8628 for PDO 0x865e8770
InstancePath is "Root\LEGACY_FIPS\0000"
ServiceName is "Fips"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e83e8 for PDO 0x865e8530
InstancePath is "Root\LEGACY_GPC\0000"
ServiceName is "Gpc"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e81a8 for PDO 0x865e82f0
InstancePath is "Root\LEGACY_HTTP\0000"
ServiceName is "HTTP"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b0ee8 for PDO 0x865b0030
InstancePath is "Root\LEGACY_IPNAT\0000"
ServiceName is "IpNat"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b0ca8 for PDO 0x865b0df0
InstancePath is "Root\LEGACY_IPSEC\0000"
ServiceName is "IPSec"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b0a68 for PDO 0x865b0bb0
InstancePath is "Root\LEGACY_KSECDD\0000"
ServiceName is "ksecdd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b0828 for PDO 0x865b0970
InstancePath is "Root\LEGACY_MNMDD\0000"
ServiceName is "mnmdd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b05e8 for PDO 0x865b0730
InstancePath is "Root\LEGACY_MOUNTMGR\0000"
ServiceName is "mountmgr"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b03a8 for PDO 0x865b04f0
InstancePath is "Root\LEGACY_NDIS\0000"
ServiceName is "NDIS"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865b0168 for PDO 0x865b02b0
InstancePath is "Root\LEGACY_NDISTAPI\0000"
ServiceName is "NdisTapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e7ee8 for PDO 0x865e7030
InstancePath is "Root\LEGACY_NDISUIO\0000"
ServiceName is "Ndisuio"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e7ca8 for PDO 0x865e7df0
InstancePath is "Root\LEGACY_NDPROXY\0000"
ServiceName is "NDProxy"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e7a68 for PDO 0x865e7bb0
InstancePath is "Root\LEGACY_NETBT\0000"
ServiceName is "NetBT"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e7828 for PDO 0x865e7970
InstancePath is "Root\LEGACY_NULL\0000"
ServiceName is "Null"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e75e8 for PDO 0x865e7730
InstancePath is "Root\LEGACY_PARTMGR\0000"
ServiceName is "PartMgr"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e73a8 for PDO 0x865e74f0
InstancePath is "Root\LEGACY_PARVDM\0000"
ServiceName is "ParVdm"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e7168 for PDO 0x865e72b0
InstancePath is "Root\LEGACY_RASACD\0000"
ServiceName is "RasAcd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865afee8 for PDO 0x865af030
InstancePath is "Root\LEGACY_RDPCDD\0000"
ServiceName is "RDPCDD"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865afca8 for PDO 0x865afdf0
InstancePath is "Root\LEGACY_TCPIP\0000"
ServiceName is "Tcpip"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865afa68 for PDO 0x865afbb0
InstancePath is "Root\LEGACY_VGASAVE\0000"
ServiceName is "VgaSave"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865af828 for PDO 0x865af970
InstancePath is "Root\LEGACY_VMMEMCTL\0000"
ServiceName is "VMMEMCTL"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865af4f8 for PDO 0x865af640
InstancePath is "Root\LEGACY_VOLSNAP\0000"
ServiceName is "VolSnap"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865af2b8 for PDO 0x865af400
InstancePath is "Root\LEGACY_WANARP\0000"
ServiceName is "Wanarp"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e6008 for PDO 0x865af1c0
InstancePath is "Root\LEGACY_WS2IFSL\0000"
ServiceName is "WS2IFSL"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e6dc8 for PDO 0x865e6f10
InstancePath is "Root\MEDIA\MS_MMACM"
ServiceName is "audstub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e6b88 for PDO 0x865e6cd0
InstancePath is "Root\MEDIA\MS_MMDRV"
ServiceName is "audstub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e6948 for PDO 0x865e6a90
InstancePath is "Root\MEDIA\MS_MMMCI"
ServiceName is "audstub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e6708 for PDO 0x865e6850
InstancePath is "Root\MEDIA\MS_MMVCD"
ServiceName is "audstub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e64c8 for PDO 0x865e6610
InstancePath is "Root\MEDIA\MS_MMVID"
ServiceName is "audstub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e6288 for PDO 0x865e63d0
InstancePath is "Root\MS_L2TPMINIPORT\0000"
ServiceName is "Rasl2tp"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865ae008 for PDO 0x865e6190
InstancePath is "Root\MS_NDISWANIP\0000"
ServiceName is "NdisWan"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865aedc8 for PDO 0x865aef10
InstancePath is "Root\MS_PPPOEMINIPORT\0000"
ServiceName is "RasPppoe"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865aeb88 for PDO 0x865aecd0
InstancePath is "Root\MS_PPTPMINIPORT\0000"
ServiceName is "PptpMiniport"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865ae948 for PDO 0x865aea90
InstancePath is "Root\MS_PSCHEDMP\0000"
ServiceName is "PSched"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865ae708 for PDO 0x865ae850
InstancePath is "Root\MS_PSCHEDMP\0001"
ServiceName is "PSched"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865ae4c8 for PDO 0x865ae610
InstancePath is "Root\MS_PTIMINIPORT\0000"
ServiceName is "Raspti"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865ae288 for PDO 0x865ae3d0
InstancePath is "Root\RDPDR\0000"
ServiceName is "rdpdr"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e5008 for PDO 0x865ae190
InstancePath is "Root\RDP_KBD\0000"
ServiceName is "TermDD"
TargetDeviceNotify List - f 0xe16b4b20 b 0xe16b4b20
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e5dc8 for PDO 0x865e5f10
InstancePath is "Root\RDP_MOU\0000"
ServiceName is "TermDD"
TargetDeviceNotify List - f 0xe16a1aa0 b 0xe16a1aa0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e5b88 for PDO 0x865e5cd0
InstancePath is "Root\SYSTEM\0000"
ServiceName is "swenum"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85f7cee8 for PDO 0x86418f10
InstancePath is "SW\{cd171de3-69e5-11d2-b56d-0000f8754380}\{9B365890-165F-11D0-A195-0020AFD156E4}"
ServiceName is "wdmaud"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862e7008 for PDO 0x862e7d80
InstancePath is "SW\{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}\{9B365890-165F-11D0-A195-0020AFD156E4}"
ServiceName is "sysaudio"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8648a930 for PDO 0x8627c6b0
InstancePath is "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"
ServiceName is "kmixer"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e5948 for PDO 0x865e5a90
InstancePath is "Root\SYSTEM\0001"
ServiceName is "update"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e5708 for PDO 0x865e5850
InstancePath is "Root\SYSTEM\0002"
ServiceName is "mssmbios"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x865e54c8 for PDO 0x865e5610
InstancePath is "Root\VMWVMCIHOSTDEV\0000"
ServiceName is "vmci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
========
windows内核编程 白话设备栈
http://www.cnblogs.com/UnMovedMover/p/4195063.html在ntddk.h中定义了该函数原型：
#if (NTDDI_VERSION >= NTDDI_WINXP)
NTKERNELAPI
NTSTATUS
IoAttachDeviceToDeviceStackSafe(
__in PDEVICE_OBJECT SourceDevice,
__in PDEVICE_OBJECT TargetDevice,
__deref_out PDEVICE_OBJECT *AttachedToDeviceObject
);
#endif
我们加载微软的sfilter源码进行分析
1 创建sfilter的CDO
图1
驱动Sfilter.sys等待 文件系统驱动的加载 SfFsNotification
图2
我们可以看到 Ntfs.sys驱动的CDO地址是0x862c8270
这时候 我们的Sfilter即将创建一个FiDO附着在Ntfs的CDO上面
图3
新创建的FiDO的地址是0x86337998
而newDeviceObject->DriverObject的驱动地址正是我们的Sfilter的驱动地址
另外newDeviceObject->NextDevice是Sfilter!CDO的地址
这说明，IoCreateDevice的时候，新建的DeviceObject在会插在以往的DO之前 如图4
图4
下面的任务便是附着FiDO于Ntfs驱动的CDO之上
IoAttachDeviceToDeviceStackSafe(
newDeviceObject,
DeviceObject,
&devExt->AttachedToDeviceObject );
继续用winDBG查看
图5
FiDO的地址是0x86337998
FiDO->AttachedDevice的地址是0x00000000 此时FiDO在设备栈的最顶层
现在明了了 DeviceObject->AttachedDevice指向的是上层的设备
图6
图7
我们用winDBG验证一下
图8
========
阅读全文
0 0
- windbg查看设备栈设备树学习总结
- windbg 查看设备信息
- windbg常用查看设备command
- 字符设备学习总结
- Linux设备模型 学习总结
- Linux设备模型 学习总结
- Linux设备驱动学习总结
- 简单字符设备学习总结
- 字符设备驱动学习总结
- 学习windows驱动(设备对象设备栈)
- 77.windbg-!drvobj、.devstack（驱动对象,设备栈,AttachedDevice）
- 设备树dts学习
- Linux 设备树学习
- 查看所有设备树节点名称
- 如何查看USB设备
- LINUX 查看硬件设备
- LINUX 查看硬件设备
- 查看设备 MPLS 信息
- ListView中adapter加载数据的两种方式
- php 设计模式（注册器模式+工厂模式+数据库映射模式，单例模式+工厂模式+注册器模式混合使用）
- java foreach
- php 设计模式（观察者模式）
- java hashCode 理解
- windbg查看设备栈设备树学习总结
- haproxy的八种负载均衡策略
- 在mybatis框架中实现文件重写，并将文件名写入数据库
- 51Nod-1461-稳定桌
- 高阶篇：8.2）模具设计（了解）
- 实现DDD读书笔记1
- 第9章Spark 2.1.0新一代Tungsten优化引擎彻底解析
- OC基础-内存对象管理20
- HDU2521 反素数【因子数量+打表】
