I’m having a problem using !irpfind when specifying a criteria. If I use
!irpfind without a criteria specified, I find irps. When I specify any
criteria I don’t get anything listed. Below is an irpfind without criteria
and an irpfind using device as a criteria. The first displays several irps.
One irp has a DevObj equal to ffbc7030. Using this for the device criteria
returns nothing. I’ve tried both ffbc7030 and 0xffbc7030.
Am I using the command incorrectly or is it just not working?
- Steve -
The following command produces this output:
0: kd> !irpfind 0 80cc2a48
Scanning large pool allocation table for Tag: Irp? (80eac000 :
80eb8000)
Searching NonPaged pool (80cc2a48 : 80ec0000) for Tag: Irp?
Irp [Thread] irpStack: (Mj,Mn) DevObj [Driver]
80cc3430 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cc36c0 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cc4350 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cc4600 [ffaef8e0] irpStack: ( 3, 0) ffbc7030 [\FileSystem\Npfs]
80cc5400 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cc5b78 [ffa33da8] irpStack: ( e, 9) ffb3aa10 [\Driver\AFD]
80cc5e70 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cc61b8 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x01900006
80cc8478 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80ccd3b8 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cce008 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cce800 [00000000] Irp is complete (CurrentLocation 4 > StackCount
3)
80cd0008 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2)
80cd0220 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x00000000
80cd0998 [80d712b8] irpStack: ( e, 0) ffba0030 [
\FileSystem\NetBIOS]
80cd3860 [ffaefba8] irpStack: ( 3, 0) ffbc7030 [\FileSystem\Npfs]
80cd3900 [00000000] Irp is complete (CurrentLocation 3 > StackCount
2) 0x43776f4c
…terminating - searched pool to 80cd4000
0: kd> !irpfind 0 80cc2a48 device ffbc7030
Looking for IRPs with device object == ffbc7030
Scanning large pool allocation table for Tag: Irp? (80eac000 :
80eb8000)
Searching NonPaged pool (80cc2a48 : 80ec0000) for Tag: Irp?
Searching NonPaged pool (fcc15000 : ffbe0000) for Tag: Irp?
…terminating - searched pool to fe8ec000