我如何检索有关IRP的信息？ [英] How can i retrieve info about IRP ?

问题描述

调试设备驱动程序时如何检索驱动程序IRP信息？它已注册并发送和接收的irp？

When debugging a device driver how can retrieve the driver IRP information ? the irp it has registered ans sending and receiving ?

我在windbg中使用哪些命令？ 

which Commands i use from my windbg ? 

谢谢 

Thanks 

推荐答案

在IRP调度例程（读取，写入，IOCTL，...）上放置一个断点并检查IRP为它进来了。 如果您正在调试没有源代码的驱动程序，请查看DriverObject，然后将断点放在MajorFunction
数组的所有地址上。

Place a breakpoint on the IRP dispatch routines (read, write, IOCTL, ...) and examine the IRP as it comes in.  If you are debugging a driver without source code look at the DriverObject then put breakpoints at all the addresses of the MajorFunction array.

这篇关于我如何检索有关IRP的信息？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！