Redigera

Dela via

!irpfind

  • Artikel

The !irpfind extension displays information about all I/O request packets (IRP) currently allocated in the target system, or about those IRPs matching the specified search criteria.

Syntax

!irpfind [-v][PoolType[RestartAddress[CriteriaData]]]

Parameters

-v
Displays verbose information.

PoolType
Specifies the type of pool to be searched. The following values are permitted:

0
Specifies nonpaged memory pool. This is the default.

1
Specifies paged memory pool.

2
Specifies the special pool.

4
Specifies the session pool.

RestartAddress
Specifies the hexadecimal address at which to begin the search. This is useful if the previous search was terminated prematurely. The default is zero.

Criteria
Specifies the criteria for the search. Only those IRPs that satisfy the given match will be displayed.

Criteria Match

arg

Finds all IRPs with a stack location where one of the arguments equals Data.

device

Finds all IRPs with a stack location where DeviceObject equals Data.

fileobject

Finds all IRPs whose Irp.Tail.Overlay.OriginalFileObject equals Data.

mdlprocess

Finds all IRPs whose Irp.MdlAddress.Process equals Data.

thread

Finds all IRPs whose Irp.Tail.Overlay.Thread equals Data.

userevent

Finds all IRPs whose Irp.UserEvent equals Data.

Data
Specifies the data to be matched in the search.

DLL

Kdexts.dll

Additional Information

See Plug and Play Debugging for applications of this extension command. For information about IRPs, see the Windows Driver Kit (WDK) documentation and Microsoft Windows Internals by Mark Russinovich and David Solomon.

Remarks

This example finds the IRP in the nonpaged pool that is going to set user event FF9E4F48 upon completion:

kd> !irpfind 0 0 userevent ff9e4f48

The following example produces a full listing of all IRPs in the nonpaged pool:

kd> !irpfind
Searching NonPaged pool (8090c000 : 8131e000) for Tag: Irp
8097c008 Thread 8094d900 current stack belongs to  \Driver\symc810
8097dec8 Thread 8094dda0 current stack belongs to  \FileSystem\Ntfs
809861a8 Thread 8094dda0 current stack belongs to  \Driver\symc810
809864e8 Thread 80951ba0 current stack belongs to  \Driver\Mouclass
80986608 Thread 80951ba0 current stack belongs to  \Driver\Kbdclass
80986728 Thread 8094dda0 current stack belongs to  \Driver\symc810