windows - Windbg ethread - IrpList location -


i'm struggling make sense of output windbg.

what i'm trying find out how many irps (interrupt request packets) queued in particular thread, here have:

lkd> !thread thread fffffa8001fce270 irp list: fffffa8001cf3b60 ... 

so tells me current thread has 1 irp in it's list, , it's address.

however, next command what's confusing me slightly:

lkd> ??@$thread->irplist struct _list_entry [ 0xfffffa8001cf3b80 - 0xfffffa8001cf3b80 ] +0x000 flink   0xfffffa8001cf3b80 _list_entry [ 0xfffffa8001fce658 -     0xfffffa8001fce658] +0x000 blink   0xfffffa8001cf3b80 _list_entry [ 0xfffffa8001fce658 -     0xfffffa8001fce658] 

all of information coming out of _ethread structure, , according windbg offset 'irplist' element in structure 0x3e8.

so if thread (_ethread) starts @ offset 0xfffffa8001fce270, irplist element should @ offset 0xfffffa8001fce658 (0xfffffa8001fce270 + 0x3e8)

however, don't understand why windbg reporting irp list entry @ offset 0xfffffa8001cf3b80.

i'm getting wrong end of stick here, if can point me in right direction, i'd appreciate it.

thanks

the list address not 0xfffffa8001cf3b80. that's address of list entry in irp, @ irp+0x20 (0xfffffa8001cf3b60 + 0x20 = 0xfffffa8001cf3b80). list entry address in ethread 0xfffffa8001fce658 (0xfffffa8001fce658 - fffffa8001fce270 = 0x3e8).


Comments

Popular posts from this blog

c++ - Creating new partition disk winapi -

Android Prevent Bluetooth Pairing Dialog -

php - joomla get content in onBeforeCompileHead function -