The !irpfind extension displays information about all I/O request packets (IRP) currently allocated in the target system, or about those IRPs matching the specified search criteria.

Syntax

Syntax in Windows 2000

!irpfind [PoolType [RestartAddress [Criteria Data]]] 

Syntax in Windows XP and later

!irpfind [-v] [PoolType [RestartAddress [Criteria Data]]] 

Parameters

-v

(Windows XP and later) Displays verbose information.

PoolType

Specifies the type of pool to be searched. The following values are permitted:

0

Specifies nonpaged memory pool. This is the default.

1

Specifies paged memory pool.

2

Specifies the special pool.

4

(Windows XP and later) Specifies the session pool.

RestartAddress

Specifies the hexadecimal address at which to begin the search. This is useful if the previous search was terminated prematurely. The default is zero.

Criteria

Specifies the criteria for the search. Only those IRPs that satisfy the given match will be displayed.

Criteria	Match
arg	Finds all IRPs with a stack location where one of the arguments equals Data.
device	Finds all IRPs with a stack location where DeviceObject equals Data.
fileobject	Finds all IRPs whose Irp.Tail.Overlay.OriginalFileObject equals Data.
mdlprocess	Finds all IRPs whose Irp.MdlAddress.Process equals Data.
thread	Finds all IRPs whose Irp.Tail.Overlay.Thread equals Data.
userevent	Finds all IRPs whose Irp.UserEvent equals Data.

Data

Specifies the data to be matched in the search.

DLL

Comments

This example finds the IRP in the nonpaged pool that is going to set user event FF9E4F48 upon completion:

kd> !irpfind 0 0 userevent ff9e4f48

The following example produces a full listing of all IRPs in the nonpaged pool:

kd> !irpfind
Searching NonPaged pool (8090c000 : 8131e000) for Tag: Irp
8097c008 Thread 8094d900 current stack belongs to  \Driver\symc810
8097dec8 Thread 8094dda0 current stack belongs to  \FileSystem\Ntfs
809861a8 Thread 8094dda0 current stack belongs to  \Driver\symc810
809864e8 Thread 80951ba0 current stack belongs to  \Driver\Mouclass
80986608 Thread 80951ba0 current stack belongs to  \Driver\Kbdclass
80986728 Thread 8094dda0 current stack belongs to  \Driver\symc810

Additional Information

See Plug and Play Debugging for applications of this extension command. For information about IRPs, see the Windows Driver Kit (WDK) documentation and Microsoft Windows Internals by Mark Russinovich and David Solomon.