Skip to content

PDO differences in "filter" vs. "function" mode #90

Description

@forderud

The FsContext field becomes null after removing the WdfFdoInitSetFilter call to convert the filter driver into a function driver.

Filter driver

kd> !wdfiotarget 0x000044725f30dd78
Treating handle as a KMDF handle!

WDFIOTARGET 000044725f30dd78
=========================
!wdfdevice 0x000044725ef6c358
Target Device: !devobj  0xffffbb8da031e040
Target PDO: !devobj  0xffffbb8d9f5f4060

Type: Remote target
State:  WdfIoTargetStarted

Requests pending: 0

Requests sent: 0

Requests sent with ignore-target-state: 0

Target name:  \Device\00000034
Target FileObject: dt nt!_FILE_OBJECT  0xffffbb8d9d5b5970
WDF file !handle  0xffffffff80002fac. Search for 'Object: xxxx Type: File', run '!fileobj xxxx'
Open type:  WdfIoTargetOpenByName


kd> dt nt!_FILE_OBJECT  0xffffbb8d9d5b5970
   +0x000 Type             : 0n5
   +0x002 Size             : 0n216
   +0x008 DeviceObject     : 0xffffbb8d`9f5f4060 _DEVICE_OBJECT
   +0x010 Vpb              : (null) 
   +0x018 FsContext        : 0xffffbb8d`9d6be770 Void
   +0x020 FsContext2       : (null) 
   +0x028 SectionObjectPointer : (null) 
   +0x030 PrivateCacheMap  : (null) 
   +0x038 FinalStatus      : 0n0
   +0x040 RelatedFileObject : (null) 
   +0x048 LockOperation    : 0 ''
   +0x049 DeletePending    : 0 ''
   +0x04a ReadAccess       : 0 ''
   +0x04b WriteAccess      : 0 ''
   +0x04c DeleteAccess     : 0 ''
   +0x04d SharedRead       : 0 ''
   +0x04e SharedWrite      : 0 ''
   +0x04f SharedDelete     : 0 ''
   +0x050 Flags            : 0x40000
   +0x058 FileName         : _UNICODE_STRING ""
   +0x068 CurrentByteOffset : _LARGE_INTEGER 0x0
   +0x070 Waiters          : 0
   +0x074 Busy             : 0
   +0x078 LastLock         : (null) 
   +0x080 Lock             : _KEVENT
   +0x098 Event            : _KEVENT
   +0x0b0 CompletionContext : (null) 
   +0x0b8 IrpListLock      : 0
   +0x0c0 IrpList          : _LIST_ENTRY [ 0xffffbb8d`9d5b5a30 - 0xffffbb8d`9d5b5a30 ]
   +0x0d0 FileObjectExtension : (null) 


kd> !handle  0xffffffff80002fac

PROCESS ffffbb8d97682040
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 001aa000  ObjectTable: ffff818f8083ddc0  HandleCount: 2981.
    Image: System

Kernel handle table at ffff818f8083ddc0 with 2981 entries in use

80002fac: Object: ffffbb8d9d5b5970  GrantedAccess: 00000003 (Audit) Entry: ffff818f878f8eb0
Object: ffffbb8d9d5b5970  Type: (ffffbb8d976afe80) File
    ObjectHeader: ffffbb8d9d5b5940 (new version)
        HandleCount: 1  PointerCount: 32769

Function driver

kd> !wdfiotarget 0x000044725fc0bd38
Treating handle as a KMDF handle!

WDFIOTARGET 000044725fc0bd38
=========================
!wdfdevice 0x0000447261437ca8
Target Device: !devobj  0xffffbb8da02bba50
Target PDO: !devobj  0xffffbb8da07a14b0

Type: Remote target
State:  WdfIoTargetStarted

Requests pending: 0

Requests sent: 0

Requests sent with ignore-target-state: 0

Target name:  \Device\00000038
Target FileObject: dt nt!_FILE_OBJECT  0xffffbb8da2002340
WDF file !handle  0xffffffff80001cc8. Search for 'Object: xxxx Type: File', run '!fileobj xxxx'
Open type:  WdfIoTargetOpenByName


kd> dt nt!_FILE_OBJECT  0xffffbb8da2002340
   +0x000 Type             : 0n5
   +0x002 Size             : 0n216
   +0x008 DeviceObject     : 0xffffbb8d`a07a14b0 _DEVICE_OBJECT
   +0x010 Vpb              : (null) 
   +0x018 FsContext        : (null) 
   +0x020 FsContext2       : (null) 
   +0x028 SectionObjectPointer : (null) 
   +0x030 PrivateCacheMap  : (null) 
   +0x038 FinalStatus      : 0n0
   +0x040 RelatedFileObject : (null) 
   +0x048 LockOperation    : 0 ''
   +0x049 DeletePending    : 0 ''
   +0x04a ReadAccess       : 0 ''
   +0x04b WriteAccess      : 0 ''
   +0x04c DeleteAccess     : 0 ''
   +0x04d SharedRead       : 0 ''
   +0x04e SharedWrite      : 0 ''
   +0x04f SharedDelete     : 0 ''
   +0x050 Flags            : 0x40000
   +0x058 FileName         : _UNICODE_STRING ""
   +0x068 CurrentByteOffset : _LARGE_INTEGER 0x0
   +0x070 Waiters          : 0
   +0x074 Busy             : 0
   +0x078 LastLock         : (null) 
   +0x080 Lock             : _KEVENT
   +0x098 Event            : _KEVENT
   +0x0b0 CompletionContext : (null) 
   +0x0b8 IrpListLock      : 0
   +0x0c0 IrpList          : _LIST_ENTRY [ 0xffffbb8d`a2002400 - 0xffffbb8d`a2002400 ]
   +0x0d0 FileObjectExtension : (null) 


kd> !handle  0xffffffff80001cc8

PROCESS ffffbb8d97682040
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 001aa000  ObjectTable: ffff818f8083ddc0  HandleCount: 2714.
    Image: System

Kernel handle table at ffff818f8083ddc0 with 2714 entries in use

80001cc8: Object: ffffbb8da2002340  GrantedAccess: 00000003 (Protected) Entry: ffff818f860f9320
Object: ffffbb8da2002340  Type: (ffffbb8d976afe80) File
    ObjectHeader: ffffbb8da2002310 (new version)
        HandleCount: 1  PointerCount: 32769

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions