!irpfind re-visited ...

Ok, so what is the new magic to get a dump of active IRPs using !irpfind? I
just let “!irpfind 0” run for close to an hour on a system that was doing a
format on a stripped volume consisting of 3 FC SCSI hard drives, and
transferring data to and from another system. I should have seen IRPs out
the ying-yang, but !irpfind found nary a one. The only flags I have set
using GFLAGS are “Enable pool tagging” and “Create kernel mode stack trace
database”. Kernel Special Pool Tag is set for Text and Verify End.

Oh yeah … calling GFLAGS is a neat trick in the first place, since it
installs with the debugging tools on the host machine and NOT on the target.
Since my host and target are always connected via a LAN, I simply mapped to
the host and ran it from there.


Why the bloody hell does this change with every God damn release of WinDbg?



Gary G. Little
xxxxx@broadstor.com
xxxxx@inland.net