Hello everyone.
When I analyze the core dump file after the crash, I can't find the local pFilter parameter in the FilterSendNetBufferList function. It may have been optimized away. But I see the FilterModuleContext value, which is a pointer to the global MS_FILTER structure. Now I have the address of this variable (structure). How can I view this memory as a structure (MS_FILTER) in WinDbg?
dt
display type command will do this. The syntax is clunky but usable. The gui also provides a wrapper for it, but the command line is frequently easier.
Thank You mr. Mark_Roddy
One more question, if possible.
In my NDIS filter driver I queue IRPs from user in DeviceIoControl and when invokes FilterSendNetBufferList or FilterReceiveNetBufferList I use these IRPs for return buffers from NBLs. It is working good, but when I run under Verifier, sometimes, I do not know yet, but I get illegal IRP. up to the present time I can not understand, but I want to avoid this crash, using exception.
How to catch exception from MmGetSystemAddressForMdlSafe(pFilter→snd→pIrp[n], ..)
WinDbg shows, that when windows crashes, IRP, that I queued in DeviceIoControl, is illegal, all fields of that Irp are anavailable. So I want to put MmGetSystemAddressForMdlSafe(pFilter→snd→pIrp[n], ..) into try-catch construction.
Thank You