All,
In the context of KsPropertyHandler(), especially while a
KSPROPERTY_CONNECTION_STATE property set event occurring, I can get the
_FILE_OBJECT pointer for a audio pin from stack. Now I need to get more
information about the pin. Does anyone know what type the FsContext
member of the _FILE_OBJECT structure is? Any info will be highly
appreciated!
Best Regards
Raymond
In the early days of KS (KS 1.0) the agreement was that KS expected minidrivers to put their
object instance data in FsContext.
I am not sure about AVStream, but it is likely if it used FsContext of pin’s file object to put
KSPIN in there.
– Max.
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of
Zhang, Raymond
Sent: Sunday, May 08, 2005 11:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] What type is the FsContext member in _FILE_OBJECT structure for a kernerl stream
pin object?
All,
In the context of KsPropertyHandler(), especially while a KSPROPERTY_CONNECTION_STATE property set
event occurring, I can get the _FILE_OBJECT pointer for a audio pin from stack. Now I need to get
more information about the pin. Does anyone know what type the FsContext member of the
_FILE_OBJECT structure is? Any info will be highly appreciated!
Best Regards
Raymond
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Thank you, Max. I expect to get PKSPIN from the FsContext. But it’s not when I try “dt _KSPIN XXX” in WinDbg. I pasted the raw memory at the address of the FsContext = 0xe25f69c8.
Bt the way, do you know how to get KSPIN structure from a pin object (e.g. the object got by ObReferenceObjectByHandle() from a pin handle returned from KsCreatePin())? Now the one I got is a kernel object with type etc. (see MEM 2)
MEM 1:
e25f69c8 84571ce8 84efa378 854af078 e258f2bc 84f5e158 e111fcec e258f2bc 84fab7b0
e25f69e8 e25f69e8 e25f69e8 e258f2b0 e2417940 ffffffff 00000015 00070809 6d747355
e25f6a08 e16ef270 e29e44b8 00000000 00000000 dff21ce5 11d0f70f a00017b9 963122c9
e25f6a28 00000000 00000007 e2b04938 00000000 0c080807 61444d43 001c0001 00016b76
e25f6a48 00000016 00139c28 00000001 006f0001 56495569 00627265 006e0073 00720064
e25f6a68 00630065 00320033 0031005c 00000000 0c0b0808 43544e49 e1120e28 e103b858
e25f6a88 00000000 00000000 00000000 e1985010 f0077000 00c92000 00002500 00000087
e25f6aa8 00000011 00000000 00000220 00000000 3b050737 00000000 e1985dc8 00000005
MEM 2:
84f5e158 00700005 855c5ce8 00000000 85410698 00000000 00000000 00000000
84f5e174 00000000 853f1b48 00000000 00000000 00040000 00f800e8 e11c7418
84f5e190 00000000 00000000 00000000 00000000 00000000 00000000 00000000
84f5e1ac 00000000 00000000 00040000 00000001 84f5e1bc 84f5e1bc 00000000
84f5e1c8 0a150015 e56c6946 00000000 00000000 8553b178 84f86948 000000bc
84f5e1e4 80000000 00000001 00000000 855e6560 44001800 85455b20 00000000
84f5e200 00700005 8559f710 8559f688 e25d22b8 e1fe0dd0 854be520 00000000
Best Regards
Raymond Zhang
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Max Paklin
Sent: 2005??5??10?? 15:11
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] What type is the FsContext member in _FILE_OBJECT structure for a kernerl stream pin object?
In the early days of KS (KS 1.0) the agreement was that KS expected minidrivers to put their
object instance data in FsContext.
I am not sure about AVStream, but it is likely if it used FsContext of pin’s file object to put
KSPIN in there.
– Max.
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of
Zhang, Raymond
Sent: Sunday, May 08, 2005 11:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] What type is the FsContext member in _FILE_OBJECT structure for a kernerl stream
pin object?
All,
In the context of KsPropertyHandler(), especially while a KSPROPERTY_CONNECTION_STATE property set
event occurring, I can get the _FILE_OBJECT pointer for a audio pin from stack. Now I need to get
more information about the pin. Does anyone know what type the FsContext member of the
_FILE_OBJECT structure is? Any info will be highly appreciated!
Best Regards
Raymond
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@intel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Well… It does look like there is a bunch of pointers in there. You could examine what those
point to by casting them into all sorts of KS structures. Much easier however would be to break in
your property handler, walk up the stack and do a bit of disassembling.
I don’t think anybody would volounteer to do that for you. However before you begin it might be a
good idea to ask what exactly are you trying to do?
Whatever comes out from your digging will definitely be a hackery at best, i.e. nothing that you
can rely on in a production code.
– Max.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zhang, Raymond
Sent: Tuesday, May 10, 2005 1:44 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] What type is the FsContext member in
_FILE_OBJECT structure for a kernerl stream pin object?Thank you, Max. I expect to get PKSPIN from the FsContext.
But it’s not when I try “dt _KSPIN XXX” in WinDbg. I pasted
the raw memory at the address of the FsContext = 0xe25f69c8.Bt the way, do you know how to get KSPIN structure from a pin
object (e.g. the object got by ObReferenceObjectByHandle()
from a pin handle returned from KsCreatePin())? Now the one I
got is a kernel object with type etc. (see MEM 2)MEM 1:
e25f69c8 84571ce8 84efa378 854af078 e258f2bc 84f5e158
e111fcec e258f2bc 84fab7b0
e25f69e8 e25f69e8 e25f69e8 e258f2b0 e2417940 ffffffff
00000015 00070809 6d747355
e25f6a08 e16ef270 e29e44b8 00000000 00000000 dff21ce5
11d0f70f a00017b9 963122c9
e25f6a28 00000000 00000007 e2b04938 00000000 0c080807
61444d43 001c0001 00016b76
e25f6a48 00000016 00139c28 00000001 006f0001 56495569
00627265 006e0073 00720064
e25f6a68 00630065 00320033 0031005c 00000000 0c0b0808
43544e49 e1120e28 e103b858
e25f6a88 00000000 00000000 00000000 e1985010 f0077000
00c92000 00002500 00000087
e25f6aa8 00000011 00000000 00000220 00000000 3b050737
00000000 e1985dc8 00000005MEM 2:
84f5e158 00700005 855c5ce8 00000000 85410698 00000000
00000000 00000000
84f5e174 00000000 853f1b48 00000000 00000000 00040000
00f800e8 e11c7418 84f5e190 00000000 00000000 00000000
00000000 00000000 00000000 00000000 84f5e1ac 00000000
00000000 00040000 00000001 84f5e1bc 84f5e1bc 00000000
84f5e1c8 0a150015 e56c6946 00000000 00000000 8553b178
84f86948 000000bc
84f5e1e4 80000000 00000001 00000000 855e6560 44001800
85455b20 00000000 84f5e200 00700005 8559f710 8559f688
e25d22b8 e1fe0dd0 854be520 00000000Best Regards
Raymond Zhang-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Max Paklin
Sent: 2005年5月10日 15:11
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] What type is the FsContext member in
_FILE_OBJECT structure for a kernerl stream pin object?In the early days of KS (KS 1.0) the agreement was that KS
expected minidrivers to put their object instance data in FsContext.I am not sure about AVStream, but it is likely if it used
FsContext of pin’s file object to put KSPIN in there.– Max.
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zhang, Raymond
Sent: Sunday, May 08, 2005 11:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] What type is the FsContext member in
_FILE_OBJECT structure for a kernerl stream pin object?All,
In the context of KsPropertyHandler(), especially while a
KSPROPERTY_CONNECTION_STATE property set event occurring, I
can get the _FILE_OBJECT pointer for a audio pin from stack.
Now I need to get more information about the pin. Does anyone
know what type the FsContext member of the _FILE_OBJECT
structure is? Any info will be highly appreciated!Best Regards
Raymond
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256You are currently subscribed to ntdev as:
xxxxx@intel.com To unsubscribe send a blank email to
xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
I solved the issue. Final answer is the FsContext is an internal type, CPinInstance (or some other similar name). What I need is one of its data member, volume node no (an integer).
Raymond
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Max Paklin
Sent: 2005??5??17?? 15:29
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] What type is the FsContext member in _FILE_OBJECT structure for a kernerl stream pin object?
Well… It does look like there is a bunch of pointers in there. You could examine what those
point to by casting them into all sorts of KS structures. Much easier however would be to break in
your property handler, walk up the stack and do a bit of disassembling.
I don’t think anybody would volounteer to do that for you. However before you begin it might be a
good idea to ask what exactly are you trying to do?
Whatever comes out from your digging will definitely be a hackery at best, i.e. nothing that you
can rely on in a production code.
– Max.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zhang, Raymond
Sent: Tuesday, May 10, 2005 1:44 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] What type is the FsContext member in
_FILE_OBJECT structure for a kernerl stream pin object?Thank you, Max. I expect to get PKSPIN from the FsContext.
But it’s not when I try “dt _KSPIN XXX” in WinDbg. I pasted
the raw memory at the address of the FsContext = 0xe25f69c8.Bt the way, do you know how to get KSPIN structure from a pin
object (e.g. the object got by ObReferenceObjectByHandle()
from a pin handle returned from KsCreatePin())? Now the one I
got is a kernel object with type etc. (see MEM 2)MEM 1:
e25f69c8 84571ce8 84efa378 854af078 e258f2bc 84f5e158
e111fcec e258f2bc 84fab7b0
e25f69e8 e25f69e8 e25f69e8 e258f2b0 e2417940 ffffffff
00000015 00070809 6d747355
e25f6a08 e16ef270 e29e44b8 00000000 00000000 dff21ce5
11d0f70f a00017b9 963122c9
e25f6a28 00000000 00000007 e2b04938 00000000 0c080807
61444d43 001c0001 00016b76
e25f6a48 00000016 00139c28 00000001 006f0001 56495569
00627265 006e0073 00720064
e25f6a68 00630065 00320033 0031005c 00000000 0c0b0808
43544e49 e1120e28 e103b858
e25f6a88 00000000 00000000 00000000 e1985010 f0077000
00c92000 00002500 00000087
e25f6aa8 00000011 00000000 00000220 00000000 3b050737
00000000 e1985dc8 00000005MEM 2:
84f5e158 00700005 855c5ce8 00000000 85410698 00000000
00000000 00000000
84f5e174 00000000 853f1b48 00000000 00000000 00040000
00f800e8 e11c7418 84f5e190 00000000 00000000 00000000
00000000 00000000 00000000 00000000 84f5e1ac 00000000
00000000 00040000 00000001 84f5e1bc 84f5e1bc 00000000
84f5e1c8 0a150015 e56c6946 00000000 00000000 8553b178
84f86948 000000bc
84f5e1e4 80000000 00000001 00000000 855e6560 44001800
85455b20 00000000 84f5e200 00700005 8559f710 8559f688
e25d22b8 e1fe0dd0 854be520 00000000Best Regards
Raymond Zhang-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Max Paklin
Sent: 2005年5月10日 15:11
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] What type is the FsContext member in
_FILE_OBJECT structure for a kernerl stream pin object?In the early days of KS (KS 1.0) the agreement was that KS
expected minidrivers to put their object instance data in FsContext.I am not sure about AVStream, but it is likely if it used
FsContext of pin’s file object to put KSPIN in there.– Max.
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zhang, Raymond
Sent: Sunday, May 08, 2005 11:41 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] What type is the FsContext member in
_FILE_OBJECT structure for a kernerl stream pin object?All,
In the context of KsPropertyHandler(), especially while a
KSPROPERTY_CONNECTION_STATE property set event occurring, I
can get the _FILE_OBJECT pointer for a audio pin from stack.
Now I need to get more information about the pin. Does anyone
know what type the FsContext member of the _FILE_OBJECT
structure is? Any info will be highly appreciated!Best Regards
Raymond
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256You are currently subscribed to ntdev as:
xxxxx@intel.com To unsubscribe send a blank email to
xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@intel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com