當前位置：首頁 > 编程资源 > 编程问答 >内容正文

编程问答

windbg查看设备栈设备树学习总结

發布時間：2025/4/14 编程问答 36 豆豆

生活随笔收集整理的這篇文章主要介紹了 windbg查看设备栈设备树学习总结小編覺得挺不錯的,現在分享給大家,幫大家做個參考.

用windbg尋找設備樹根節點

http://blog.csdn.net/lixiangminghate/article/details/51729945

? ? 用ReactOS上明確說過，Pnp管理器對每種設備都會創建一個虛擬root device用于構建設備樹；同時這個新創建的root device又作為一個設備棧的棧底，往上形成完整的設備棧。用windbg調試時，可以看到這個虛擬設備屬于/driver/pnpmanager驅動。

? ? 昨天出于好奇想看下設備樹，結果發現只有虛擬設備attach在/driver/pnpmanger創建的設備上，而類似pci/usb設備的設備棧棧底根本不是/driver/pnpmanager設備，這讓我很是懷疑，M$到底怎樣形成以root為根節點的設備樹。

如mssmbios.sys位于設備管理器system設備類下，注冊表路徑為:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\SYSTEM\0002

用windbg查看設備堆棧，可以看到這個設備attach在/driver/pnpmanger根節點上:

kd> !drvobj mssmbios Driver object (81f81da0) is for: \Driver\mssmbios Driver Extension List: (id , addr) Device Object list: 81c8e408 kd> !devstack 81c8e408 !DevObj !DrvObj !DevExt ObjectName > 81c8e408 \Driver\mssmbios 81c8e4c0 821e73d0 \Driver\PnpManager 821e7488 00000034 !DevNode 821e7288 : DeviceInst is "Root\SYSTEM\0002" ServiceName is "mssmbios"

又如DDK樣例toaster的虛擬總線設備busenum同樣位于system設備類下，注冊表路徑為:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\SYSTEM\0003
其設備棧為:,亦可看到棧底pnpmanager設備

[cpp] view plain copy
kd> !drvobj busenum ?
Driver object (81f81030) is for: ?
?\Driver\busenum ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
81ff3030 ? ?
kd> !devstack 81ff3030 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
> 81ff3030 ?\Driver\busenum ? ?81ff30e8 ? ?
? 821e7190 ?\Driver\PnpManager 821e7248 ?00000035 ?
!DevNode 821a0008 : ?
? DeviceInst is "Root\SYSTEM\0003" ?
? ServiceName is "busenum" ?
? ? 然而，對于一些總線設備根本找不到pnpmanager,如PCI總線和USB總線:
[cpp] view plain copy
kd> !drvobj pci ?
Driver object (82189218) is for: ?
?\Driver\PCI ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
82127c70 ?82127e50 ?82127030 ?821e03a0 ?
... ?
8219cb98 ?821e5370 ?821ba160 ? ?
kd> !devstack 82127c70 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
? 81d34028 ?\Driver\usbehci ? ?81d340e0 ?USBFDO-1 ?
? 82127790 ?\Driver\ACPI ? ? ? 82187810 ?00000064 ?
> 82127c70 ?\Driver\PCI ? ? ? ?82127d28 ?NTPNP_PCI0043 ?
!DevNode 821272e8 : ?
? DeviceInst is "PCI\VEN_15AD&DEV_0770&SUBSYS_077015AD&REV_00\4&47b7341&0&1888" ?
? ServiceName is "usbehci" ?

[cpp] view plain copy
kd> !drvobj usbhub ?
Driver object (820de2c0) is for: ?
?\Driver\usbhub ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
81c74c98 ?81d542f0 ?820f1b70 ?81fcac98 ?
81c7ac98 ? ?
kd> !devstack ?81c74c98 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
> 81c74c98 ?\Driver\usbhub ? ? 81c74d50 ?00000079 ?
? 81d542f0 ?\Driver\usbhub ? ? 81d543a8 ?USBPDO-3 ?
!DevNode 81c82c48 : ?
? DeviceInst is "USB\Vid_0e0f&Pid_0002\6&2edefd9b&0&2" ?
? ServiceName is "usbhub" ?
? ? 對此，我百思不得解，pnpmanager去哪了？經過周AM指點，搞明白一件事:用!drvobj PCI列出pci設備中，除了最后一個是Fdo，其他都是Pdo(這里Fdo設備的意思是由PCI總線驅動AddDevice函數創建的設備，附加在底層的ACPI總線上，而Pdo設備是PCI總線探測到總線上接入了新設備，從而為這個新設備創建了一個Pdo以形成設備棧)。這些Fdo本身是由PCI總線創建，因此并不會attach在pnpmanager上，而通過查找Fdo設備的設備棧，才能找出棧底Pnpmanager。
? ? 順著周AM的思路，我重新調試了一遍，的確找到了PCI總線所在的Pnpmanager，以上面的環境為例，

[cpp] view plain copy
kd> !drvobj pci ?
Driver object (82189218) is for: ?
?\Driver\PCI ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
82127c70 ?82127e50 ?82127030 ?821e03a0 ?
... ?
8219cb98 ?821e5370 ?821ba160 ??
Pci總線驅動創建的設備0x821ba160就是Fdo(為什么Fdo位于最后?因為這是PCI!AddDevice創建的第一個設備對象，之后創建的設備對象都通過InsertListTail插入到設備隊列頭部，因此遍歷設備隊列時，Fdo是最后被遍歷到的)，查看它的設備棧:
[cpp] view plain copy
kd> !devstack 821ba160 ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
> 821ba160 ?\Driver\PCI ? ? ? ?821ba218 ? ?
? 821731a8 ?\Driver\ACPI ? ? ? 821e2940 ?00000038 ?
!DevNode 821de178 : ?
? DeviceInst is "ACPI\PNP0A03\2&daba3ff&0" ?
? ServiceName is "pci" ?
? ? PCI設備堆疊在ACPI的Pdo上，怪不得找不到在PCI的設備棧中找不到Pnpmanager。繼續尋祖,查找ACPI驅動創建的Fdo:
[cpp] view plain copy
kd> !drvobj ACPI ?
Driver object (8219ca10) is for: ?
?\Driver\ACPI ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
8212c628 ?8212c740 ?8212c858 ?82126538 ?
... ?
821731a8 ?8219c8f8 ? ?
kd> !devstack 8219c8f8 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
> 8219c8f8 ?\Driver\ACPI ? ? ? 821e2ea0 ? ?
? 821a0aa8 ?\Driver\ACPI_HAL ? 821a0b60 ?00000037 ?
!DevNode 8219cd50 : ?
? DeviceInst is "ACPI_HAL\PNP0C08\0" ?
? ServiceName is "ACPI" ?
? ? 同樣ACPI的Fdo堆疊在ACPI_HAL驅動的Pdo上，繼續尋祖，這次找ACPI_HAL的堆疊情況:
[cpp] view plain copy
kd> !drvobj ACPI_HAL ?
Driver object (821a0f38) is for: ?
?\Driver\ACPI_HAL ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
821a0aa8 ?821a0bc8 ? ?
kd> !devstack 821a0bc8 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
> 821a0bc8 ?\Driver\ACPI_HAL ? 821a0c80 ? ?
? 821a4c68 ?\Driver\PnpManager 821a4d20 ?00000001 ?
!DevNode 821a4b20 : ?
? DeviceInst is "Root\ACPI_HAL\0000" ?
? ? 終于在ACPI_HAL驅動的Fdo設備棧中找到了Pnpmanager。這和Windows內核原理與實現書中提供的設備樹的結構完全相似
? ? 如果此時再深究一下PnpManager驅動創建的設備對象，會發現系統中果真只有一個根設備節點，而其他的PnpManager設備對象都是為了擴展設備樹一點一點生長出來的:

[cpp] view plain copy
kd> !drvobj PnpManager ?
Driver object (821eb2e8) is for: ?
?\Driver\PnpManager ?
Driver Extension List: (id , addr) ?
??
Device Object list: ?
821e7190 ?821e73d0 ?821e7610 ?821e7850 ?
... ?
821a4c68 ?821a4020 ? ?
kd> !devstack ?821a4020 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
> 821a4020 ?\Driver\PnpManager 821a40d8 ? ?
!DevNode 821a4ee8 : ?
? DeviceInst is "HTREE\ROOT\0" <----從名字能感覺出這是根設備節點 ?
kd> !devstack 821a4c68 ? ?
? !DevObj ? !DrvObj ? ? ? ? ? ?!DevExt ? ObjectName ?
? 821a0bc8 ?\Driver\ACPI_HAL ? 821a0c80 ? ?
> 821a4c68 ?\Driver\PnpManager 821a4d20 ?00000001 ?<----<span style="font-family: Arial, Helvetica, sans-serif;">名字看著這么沒個性，肯定不是根設備節點了</span> ?
!DevNode 821a4b20 : ?
? DeviceInst is "Root\ACPI_HAL\0000" ??
========

windbg 查看設備信息

http://blog.csdn.net/wjcsharp/article/details/11169349

1. 相關命令
!devobj 查看設備對象信息
!drvobj 查看驅動對象信息
!devstack 查看設備棧
2. 系統設備樹
!devnode 0 1
[cpp] view plain copy
kd> !devnode 0 1 ?
Dumping IopRootDeviceNode (= 0x865b1ee8) ?
DevNode 0x865b1ee8 for PDO 0x865b1020 ?
? InstancePath is "HTREE\ROOT\0" ?
? State = DeviceNodeStarted (0x308) ?
? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b1ae0 for PDO 0x865b1c28 ?
? ? InstancePath is "Root\ACPI_HAL\0000" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? DevNode 0x865e1630 for PDO 0x865adf00 ?
? ? ? InstancePath is "ACPI_HAL\PNP0C08\0" ?
? ? ? ServiceName is "ACPI" ?
? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? DevNode 0x864c7118 for PDO 0x865691a8 ?
? ? ? ? InstancePath is "ACPI\PNP0A03\2&daba3ff&0" ?
? ? ? ? ServiceName is "pci" ?
? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b8c0 for PDO 0x865e46a0 ?
? ? ? ? ? InstancePath is "PCI\VEN_8086&DEV_7190&SUBSYS_00000000&REV_01\3&61aaa01&0&00" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b7a0 for PDO 0x8653aba8 ?
? ? ? ? ? InstancePath is "PCI\VEN_8086&DEV_7191&SUBSYS_00000000&REV_01\3&61aaa01&0&08" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b680 for PDO 0x865a8e50 ?
? ? ? ? ? InstancePath is "PCI\VEN_8086&DEV_7110&SUBSYS_00000000&REV_08\3&61aaa01&0&38" ?
? ? ? ? ? ServiceName is "isapnp" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x864ae3f0 for PDO 0x864aef10 ?
? ? ? ? ? ? InstancePath is "ISAPNP\ReadDataPort\0" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x864ae2d0 for PDO 0x864aedf8 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0C02\1f" ?
? ? ? ? ? ? State = DeviceNodeInitialized (0x302) ?
? ? ? ? ? ? Previous State = DeviceNodeUninitialized (0x301) ?
? ? ? ? ? DevNode 0x864ae1b0 for PDO 0x864aece0 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0200\4&5289e18&0" ?
? ? ? ? ? ? State = DeviceNodeInitialized (0x302) ?
? ? ? ? ? ? Previous State = DeviceNodeUninitialized (0x301) ?
? ? ? ? ? DevNode 0x860a8008 for PDO 0x864aebc8 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0001\4&5289e18&0" ?
? ? ? ? ? ? State = DeviceNodeInitialized (0x302) ?
? ? ? ? ? ? Previous State = DeviceNodeUninitialized (0x301) ?
? ? ? ? ? DevNode 0x860a8ee8 for PDO 0x864aeab0 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0100\4&5289e18&0" ?
? ? ? ? ? ? State = DeviceNodeInitialized (0x302) ?
? ? ? ? ? ? Previous State = DeviceNodeUninitialized (0x301) ?
? ? ? ? ? DevNode 0x860a8dc8 for PDO 0x864ae998 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0B00\4&5289e18&0" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x860a8ca8 for PDO 0x864ae880 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0800\4&5289e18&0" ?
? ? ? ? ? ? State = DeviceNodeInitialized (0x302) ?
? ? ? ? ? ? Previous State = DeviceNodeUninitialized (0x301) ?
? ? ? ? ? DevNode 0x860a8b88 for PDO 0x864ae768 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0303\4&5289e18&0" ?
? ? ? ? ? ? ServiceName is "i8042prt" ?
? ? ? ? ? ? TargetDeviceNotify List - f 0xe16b4780 ?b 0xe16b4780 ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x860a8a68 for PDO 0x864ae650 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0F13\4&5289e18&0" ?
? ? ? ? ? ? ServiceName is "i8042prt" ?
? ? ? ? ? ? TargetDeviceNotify List - f 0xe16ab3b8 ?b 0xe16ab3b8 ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x860a8948 for PDO 0x864ae538 ?
? ? ? ? ? ? InstancePath is "ACPI\PNP0A05\4&5289e18&0" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x860a83c8 for PDO 0x860a8858 ?
? ? ? ? ? ? ? InstancePath is "ACPI\PNP0400\5&324d5432&0" ?
? ? ? ? ? ? ? ServiceName is "Parport" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? DevNode 0x864cf548 for PDO 0x862f6040 ?
? ? ? ? ? ? ? ? InstancePath is "LPTENUM\MicrosoftRawPort\6&16ccfde1&0&LPT1" ?
? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x860a82a8 for PDO 0x860a8740 ?
? ? ? ? ? ? ? InstancePath is "ACPI\PNP0501\1" ?
? ? ? ? ? ? ? ServiceName is "Serial" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x860a8188 for PDO 0x860a8628 ?
? ? ? ? ? ? ? InstancePath is "ACPI\PNP0501\2" ?
? ? ? ? ? ? ? ServiceName is "Serial" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x864b4008 for PDO 0x860a8510 ?
? ? ? ? ? ? ? InstancePath is "ACPI\PNP0700\5&324d5432&0" ?
? ? ? ? ? ? ? ServiceName is "fdc" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? DevNode 0x860a64d0 for PDO 0x862c4840 ?
? ? ? ? ? ? ? ? InstancePath is "FDC\GENERIC_FLOPPY_DRIVE\6&1435b2e2&0&0" ?
? ? ? ? ? ? ? ? ServiceName is "flpydisk" ?
? ? ? ? ? ? ? ? TargetDeviceNotify List - f 0xe171a430 ?b 0xe171a430 ?
? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b560 for PDO 0x860a0e50 ?
? ? ? ? ? InstancePath is "PCI\VEN_8086&DEV_7111&SUBSYS_197615AD&REV_01\3&61aaa01&0&39" ?
? ? ? ? ? ServiceName is "intelide" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x864b4148 for PDO 0x864b4460 ?
? ? ? ? ? ? InstancePath is "PCIIDE\IDEChannel\4&23686003&0&0" ?
? ? ? ? ? ? ServiceName is "atapi" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x864b3008 for PDO 0x864b4290 ?
? ? ? ? ? ? InstancePath is "PCIIDE\IDEChannel\4&23686003&0&1" ?
? ? ? ? ? ? ServiceName is "atapi" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x86463a78 for PDO 0x86431b00 ?
? ? ? ? ? ? ? InstancePath is "IDE\CdRomNECVMWar_VMware_IDE_CDR10_______________1.00____\3031303030303030303030303030303030303130" ?
? ? ? ? ? ? ? ServiceName is "cdrom" ?
? ? ? ? ? ? ? TargetDeviceNotify List - f 0xe1615440 ?b 0xe16b74f0 ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b440 for PDO 0x864636f0 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61aaa01&0&3F" ?
? ? ? ? ? ServiceName is "vmci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b320 for PDO 0x865e4c80 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61aaa01&0&78" ?
? ? ? ? ? ServiceName is "vmx_svga" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8641b200 for PDO 0x865e3380 ?
? ? ? ? ? InstancePath is "PCI\VEN_104B&DEV_1040&SUBSYS_1040104B&REV_01\3&61aaa01&0&80" ?
? ? ? ? ? ServiceName is "vmscsi" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x8643d8e8 for PDO 0x8647ca38 ?
? ? ? ? ? ? InstancePath is "SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S&Rev_1.0\4&5fcaafc&0&000" ?
? ? ? ? ? ? ServiceName is "disk" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a008 for PDO 0x8643e8f8 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_0790&SUBSYS_00000000&REV_02\3&61aaa01&0&88" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x86470648 for PDO 0x865173a0 ?
? ? ? ? ? ? InstancePath is "PCI\VEN_8086&DEV_7112&SUBSYS_197615AD&REV_00\4&47b7341&0&0088" ?
? ? ? ? ? ? ServiceName is "usbuhci" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x862534d0 for PDO 0x86253618 ?
? ? ? ? ? ? ? InstancePath is "USB\ROOT_HUB\5&1dc927ff&0" ?
? ? ? ? ? ? ? ServiceName is "usbhub" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? DevNode 0x864511f0 for PDO 0x8631e168 ?
? ? ? ? ? ? ? ? InstancePath is "USB\Vid_0e0f&Pid_0003\6&2edefd9b&0&1" ?
? ? ? ? ? ? ? ? ServiceName is "usbccgp" ?
? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? ? DevNode 0x8632fcd0 for PDO 0x8632f030 ?
? ? ? ? ? ? ? ? ? InstancePath is "USB\Vid_0e0f&Pid_0003&MI_00\7&2cbb743&0&0000" ?
? ? ? ? ? ? ? ? ? ServiceName is "HidUsb" ?
? ? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? ? ? DevNode 0x860ab008 for PDO 0x86500d28 ?
? ? ? ? ? ? ? ? ? ? InstancePath is "HID\Vid_0e0f&Pid_0003&MI_00\8&3460d90f&0&0000" ?
? ? ? ? ? ? ? ? ? ? ServiceName is "mouhid" ?
? ? ? ? ? ? ? ? ? ? TargetDeviceNotify List - f 0xe16ab418 ?b 0xe16ab418 ?
? ? ? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? ? DevNode 0x8632fbb0 for PDO 0x8632fe18 ?
? ? ? ? ? ? ? ? ? InstancePath is "USB\Vid_0e0f&Pid_0003&MI_01\7&2cbb743&0&0001" ?
? ? ? ? ? ? ? ? ? ServiceName is "HidUsb" ?
? ? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? ? ? DevNode 0x8631d108 for PDO 0x85f53630 ?
? ? ? ? ? ? ? ? ? ? InstancePath is "HID\Vid_0e0f&Pid_0003&MI_01\8&bf62b46&0&0000" ?
? ? ? ? ? ? ? ? ? ? ServiceName is "mouhid" ?
? ? ? ? ? ? ? ? ? ? TargetDeviceNotify List - f 0xe16ab478 ?b 0xe16ab478 ?
? ? ? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? ? DevNode 0x86423198 for PDO 0x85fa6de8 ?
? ? ? ? ? ? ? ? InstancePath is "USB\Vid_0e0f&Pid_0002\6&2edefd9b&0&2" ?
? ? ? ? ? ? ? ? ServiceName is "usbhub" ?
? ? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x86470528 for PDO 0x86470030 ?
? ? ? ? ? ? InstancePath is "PCI\VEN_1022&DEV_2000&SUBSYS_20001022&REV_10\4&47b7341&0&0888" ?
? ? ? ? ? ? ServiceName is "vmxnet" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x86470408 for PDO 0x86470e50 ?
? ? ? ? ? ? InstancePath is "PCI\VEN_1274&DEV_1371&SUBSYS_13711274&REV_02\4&47b7341&0&1088" ?
? ? ? ? ? ? ServiceName is "es1371" ?
? ? ? ? ? ? TargetDeviceNotify List - f 0xe1ea4458 ?b 0xe1ea4458 ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x8607b660 for PDO 0x86473040 ?
? ? ? ? ? ? ? InstancePath is "LEGACY\JOYSTICK\5&24c8a7aa&0&ENUM&" ?
? ? ? ? ? ? ? ServiceName is "gameenum" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? DevNode 0x864702e8 for PDO 0x86470c70 ?
? ? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_0770&SUBSYS_077015AD&REV_00\4&47b7341&0&1888" ?
? ? ? ? ? ? ServiceName is "usbehci" ?
? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? ? ? DevNode 0x8645c1e0 for PDO 0x86412030 ?
? ? ? ? ? ? ? InstancePath is "USB\ROOT_HUB20\5&2f792170&0" ?
? ? ? ? ? ? ? ServiceName is "usbhub" ?
? ? ? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626aee8 for PDO 0x860bb1e0 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&A8" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626adc8 for PDO 0x86463288 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&A9" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626aca8 for PDO 0x865e4370 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AA" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626ab88 for PDO 0x865acc90 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AB" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626aa68 for PDO 0x865ac958 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AC" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a948 for PDO 0x865ad748 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AD" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a828 for PDO 0x86524e50 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AE" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a708 for PDO 0x86524c70 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AF" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a5e8 for PDO 0x865e1e50 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B0" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a4c8 for PDO 0x865e1b18 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B1" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a3a8 for PDO 0x865abe50 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B2" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a288 for PDO 0x865abb18 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B3" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x8626a168 for PDO 0x8653a030 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B4" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe008 for PDO 0x8653a5a8 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B5" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbeee8 for PDO 0x8653a270 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B6" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbedc8 for PDO 0x865e2c58 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B7" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbeca8 for PDO 0x865e2920 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B8" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbeb88 for PDO 0x865aae50 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B9" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbea68 for PDO 0x865aac70 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BA" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe948 for PDO 0x865aa938 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BB" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe828 for PDO 0x865e3e50 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BC" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe708 for PDO 0x865e3c70 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BD" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe5e8 for PDO 0x865e3938 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BE" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe4c8 for PDO 0x86164030 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BF" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe3a8 for PDO 0x861648a8 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C0" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe288 for PDO 0x86164570 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C1" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x85fbe168 for PDO 0x86164238 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C2" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x86155008 for PDO 0x860bbcf8 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C3" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x86155ee8 for PDO 0x860bb9c0 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C4" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x86155dc8 for PDO 0x860bb688 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C5" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x86155ca8 for PDO 0x865e9e50 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C6" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x86155b88 for PDO 0x865e9b18 ?
? ? ? ? ? InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C7" ?
? ? ? ? ? ServiceName is "pci" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x86155a68 for PDO 0x865e3268 ?
? ? ? ? ? InstancePath is "ACPI\PNP0C02\4" ?
? ? ? ? ? State = DeviceNodeInitialized (0x302) ?
? ? ? ? ? Previous State = DeviceNodeUninitialized (0x301) ?
? ? ? DevNode 0x865681c8 for PDO 0x8654f1a8 ?
? ? ? ? InstancePath is "ACPI\ACPI0003\1" ?
? ? ? ? ServiceName is "CmBatt" ?
? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? DevNode 0x8657d1c8 for PDO 0x865ca1f8 ?
? ? ? ? InstancePath is "ACPI\GenuineIntel_-_x86_Family_6_Model_58\_0" ?
? ? ? ? ServiceName is "intelppm" ?
? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? DevNode 0x865531c8 for PDO 0x865cd200 ?
? ? ? ? InstancePath is "ACPI\PNP0A05\10" ?
? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? ? DevNode 0x865ace48 for PDO 0x86164a88 ?
? ? ? ? ? InstancePath is "ACPI\PNP0A05\20" ?
? ? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? ? DevNode 0x8653e1c8 for PDO 0x86463f18 ?
? ? ? ? InstancePath is "ACPI\FixedButton\2&daba3ff&0" ?
? ? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b1780 for PDO 0x865b18c8 ?
? ? InstancePath is "Root\COMPOSITE_BATTERY\0000" ?
? ? ServiceName is "Compbatt" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b1540 for PDO 0x865b1688 ?
? ? InstancePath is "Root\dmio\0000" ?
? ? ServiceName is "dmio" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b1300 for PDO 0x865b1448 ?
? ? InstancePath is "Root\ftdisk\0000" ?
? ? ServiceName is "ftdisk" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? DevNode 0x864629b8 for PDO 0x86431900 ?
? ? ? InstancePath is "STORAGE\Volume\1&30a96598&0&Signature99639963Offset7000Length9FF662000" ?
? ? ? ServiceName is "VolSnap" ?
? ? ? TargetDeviceNotify List - f 0xe14f3868 ?b 0xe167d340 ?
? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e8008 for PDO 0x865b1208 ?
? ? InstancePath is "Root\LEGACY_AFD\0000" ?
? ? ServiceName is "AFD" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e8dc8 for PDO 0x865e8f10 ?
? ? InstancePath is "Root\LEGACY_BEEP\0000" ?
? ? ServiceName is "Beep" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e8b88 for PDO 0x865e8cd0 ?
? ? InstancePath is "Root\LEGACY_DMBOOT\0000" ?
? ? ServiceName is "dmboot" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e8948 for PDO 0x865e8a90 ?
? ? InstancePath is "Root\LEGACY_DMLOAD\0000" ?
? ? ServiceName is "dmload" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e8628 for PDO 0x865e8770 ?
? ? InstancePath is "Root\LEGACY_FIPS\0000" ?
? ? ServiceName is "Fips" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e83e8 for PDO 0x865e8530 ?
? ? InstancePath is "Root\LEGACY_GPC\0000" ?
? ? ServiceName is "Gpc" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e81a8 for PDO 0x865e82f0 ?
? ? InstancePath is "Root\LEGACY_HTTP\0000" ?
? ? ServiceName is "HTTP" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b0ee8 for PDO 0x865b0030 ?
? ? InstancePath is "Root\LEGACY_IPNAT\0000" ?
? ? ServiceName is "IpNat" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b0ca8 for PDO 0x865b0df0 ?
? ? InstancePath is "Root\LEGACY_IPSEC\0000" ?
? ? ServiceName is "IPSec" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b0a68 for PDO 0x865b0bb0 ?
? ? InstancePath is "Root\LEGACY_KSECDD\0000" ?
? ? ServiceName is "ksecdd" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b0828 for PDO 0x865b0970 ?
? ? InstancePath is "Root\LEGACY_MNMDD\0000" ?
? ? ServiceName is "mnmdd" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b05e8 for PDO 0x865b0730 ?
? ? InstancePath is "Root\LEGACY_MOUNTMGR\0000" ?
? ? ServiceName is "mountmgr" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b03a8 for PDO 0x865b04f0 ?
? ? InstancePath is "Root\LEGACY_NDIS\0000" ?
? ? ServiceName is "NDIS" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865b0168 for PDO 0x865b02b0 ?
? ? InstancePath is "Root\LEGACY_NDISTAPI\0000" ?
? ? ServiceName is "NdisTapi" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e7ee8 for PDO 0x865e7030 ?
? ? InstancePath is "Root\LEGACY_NDISUIO\0000" ?
? ? ServiceName is "Ndisuio" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e7ca8 for PDO 0x865e7df0 ?
? ? InstancePath is "Root\LEGACY_NDPROXY\0000" ?
? ? ServiceName is "NDProxy" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e7a68 for PDO 0x865e7bb0 ?
? ? InstancePath is "Root\LEGACY_NETBT\0000" ?
? ? ServiceName is "NetBT" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e7828 for PDO 0x865e7970 ?
? ? InstancePath is "Root\LEGACY_NULL\0000" ?
? ? ServiceName is "Null" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e75e8 for PDO 0x865e7730 ?
? ? InstancePath is "Root\LEGACY_PARTMGR\0000" ?
? ? ServiceName is "PartMgr" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e73a8 for PDO 0x865e74f0 ?
? ? InstancePath is "Root\LEGACY_PARVDM\0000" ?
? ? ServiceName is "ParVdm" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e7168 for PDO 0x865e72b0 ?
? ? InstancePath is "Root\LEGACY_RASACD\0000" ?
? ? ServiceName is "RasAcd" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865afee8 for PDO 0x865af030 ?
? ? InstancePath is "Root\LEGACY_RDPCDD\0000" ?
? ? ServiceName is "RDPCDD" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865afca8 for PDO 0x865afdf0 ?
? ? InstancePath is "Root\LEGACY_TCPIP\0000" ?
? ? ServiceName is "Tcpip" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865afa68 for PDO 0x865afbb0 ?
? ? InstancePath is "Root\LEGACY_VGASAVE\0000" ?
? ? ServiceName is "VgaSave" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865af828 for PDO 0x865af970 ?
? ? InstancePath is "Root\LEGACY_VMMEMCTL\0000" ?
? ? ServiceName is "VMMEMCTL" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865af4f8 for PDO 0x865af640 ?
? ? InstancePath is "Root\LEGACY_VOLSNAP\0000" ?
? ? ServiceName is "VolSnap" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865af2b8 for PDO 0x865af400 ?
? ? InstancePath is "Root\LEGACY_WANARP\0000" ?
? ? ServiceName is "Wanarp" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e6008 for PDO 0x865af1c0 ?
? ? InstancePath is "Root\LEGACY_WS2IFSL\0000" ?
? ? ServiceName is "WS2IFSL" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e6dc8 for PDO 0x865e6f10 ?
? ? InstancePath is "Root\MEDIA\MS_MMACM" ?
? ? ServiceName is "audstub" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e6b88 for PDO 0x865e6cd0 ?
? ? InstancePath is "Root\MEDIA\MS_MMDRV" ?
? ? ServiceName is "audstub" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e6948 for PDO 0x865e6a90 ?
? ? InstancePath is "Root\MEDIA\MS_MMMCI" ?
? ? ServiceName is "audstub" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e6708 for PDO 0x865e6850 ?
? ? InstancePath is "Root\MEDIA\MS_MMVCD" ?
? ? ServiceName is "audstub" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e64c8 for PDO 0x865e6610 ?
? ? InstancePath is "Root\MEDIA\MS_MMVID" ?
? ? ServiceName is "audstub" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e6288 for PDO 0x865e63d0 ?
? ? InstancePath is "Root\MS_L2TPMINIPORT\0000" ?
? ? ServiceName is "Rasl2tp" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865ae008 for PDO 0x865e6190 ?
? ? InstancePath is "Root\MS_NDISWANIP\0000" ?
? ? ServiceName is "NdisWan" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865aedc8 for PDO 0x865aef10 ?
? ? InstancePath is "Root\MS_PPPOEMINIPORT\0000" ?
? ? ServiceName is "RasPppoe" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865aeb88 for PDO 0x865aecd0 ?
? ? InstancePath is "Root\MS_PPTPMINIPORT\0000" ?
? ? ServiceName is "PptpMiniport" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865ae948 for PDO 0x865aea90 ?
? ? InstancePath is "Root\MS_PSCHEDMP\0000" ?
? ? ServiceName is "PSched" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865ae708 for PDO 0x865ae850 ?
? ? InstancePath is "Root\MS_PSCHEDMP\0001" ?
? ? ServiceName is "PSched" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865ae4c8 for PDO 0x865ae610 ?
? ? InstancePath is "Root\MS_PTIMINIPORT\0000" ?
? ? ServiceName is "Raspti" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865ae288 for PDO 0x865ae3d0 ?
? ? InstancePath is "Root\RDPDR\0000" ?
? ? ServiceName is "rdpdr" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e5008 for PDO 0x865ae190 ?
? ? InstancePath is "Root\RDP_KBD\0000" ?
? ? ServiceName is "TermDD" ?
? ? TargetDeviceNotify List - f 0xe16b4b20 ?b 0xe16b4b20 ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e5dc8 for PDO 0x865e5f10 ?
? ? InstancePath is "Root\RDP_MOU\0000" ?
? ? ServiceName is "TermDD" ?
? ? TargetDeviceNotify List - f 0xe16a1aa0 ?b 0xe16a1aa0 ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e5b88 for PDO 0x865e5cd0 ?
? ? InstancePath is "Root\SYSTEM\0000" ?
? ? ServiceName is "swenum" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? DevNode 0x85f7cee8 for PDO 0x86418f10 ?
? ? ? InstancePath is "SW\{cd171de3-69e5-11d2-b56d-0000f8754380}\{9B365890-165F-11D0-A195-0020AFD156E4}" ?
? ? ? ServiceName is "wdmaud" ?
? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? DevNode 0x862e7008 for PDO 0x862e7d80 ?
? ? ? InstancePath is "SW\{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}\{9B365890-165F-11D0-A195-0020AFD156E4}" ?
? ? ? ServiceName is "sysaudio" ?
? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? ? DevNode 0x8648a930 for PDO 0x8627c6b0 ?
? ? ? InstancePath is "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}" ?
? ? ? ServiceName is "kmixer" ?
? ? ? State = DeviceNodeStarted (0x308) ?
? ? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e5948 for PDO 0x865e5a90 ?
? ? InstancePath is "Root\SYSTEM\0001" ?
? ? ServiceName is "update" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e5708 for PDO 0x865e5850 ?
? ? InstancePath is "Root\SYSTEM\0002" ?
? ? ServiceName is "mssmbios" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
? DevNode 0x865e54c8 for PDO 0x865e5610 ?
? ? InstancePath is "Root\VMWVMCIHOSTDEV\0000" ?
? ? ServiceName is "vmci" ?
? ? State = DeviceNodeStarted (0x308) ?
? ? Previous State = DeviceNodeEnumerateCompletion (0x30d) ?
========

windows內核編程白話設備棧

http://www.cnblogs.com/UnMovedMover/p/4195063.html
在ntddk.h中定義了該函數原型：

#if (NTDDI_VERSION >= NTDDI_WINXP)

NTKERNELAPI

NTSTATUS

IoAttachDeviceToDeviceStackSafe(

? ? __in ?PDEVICE_OBJECT SourceDevice,

? ? __in ?PDEVICE_OBJECT TargetDevice,

? ? __deref_out PDEVICE_OBJECT *AttachedToDeviceObject

? ? );

#endif
?
我們加載微軟的sfilter源碼進行分析

1 創建sfilter的CDO

圖1

驅動Sfilter.sys等待文件系統驅動的加載 SfFsNotification

圖2

我們可以看到 Ntfs.sys驅動的CDO地址是0x862c8270

這時候我們的Sfilter即將創建一個FiDO附著在Ntfs的CDO上面 ?

圖3

新創建的FiDO的地址是0x86337998

而newDeviceObject->DriverObject的驅動地址正是我們的Sfilter的驅動地址

另外newDeviceObject->NextDevice是Sfilter!CDO的地址

這說明，IoCreateDevice的時候，新建的DeviceObject在會插在以往的DO之前如圖4

圖4

下面的任務便是附著FiDO于Ntfs驅動的CDO之上?

IoAttachDeviceToDeviceStackSafe(

　　newDeviceObject,

? ?　DeviceObject,

? ? ?&devExt->AttachedToDeviceObject );

繼續用winDBG查看

圖5

FiDO的地址是0x86337998

FiDO->AttachedDevice的地址是0x00000000 此時FiDO在設備棧的最頂層

現在明了了 DeviceObject->AttachedDevice指向的是上層的設備
圖6?

圖7

我們用winDBG驗證一下

圖8
========

總結

以上是生活随笔為你收集整理的windbg查看设备栈设备树学习总结的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。