Export (0) Print
Expand All
!ca
!ih
!tz
!vm
Expand Minimize
This topic has not yet been rated - Rate this topic

!irpfind

The !irpfind extension displays information about all I/O request packets (IRP) currently allocated in the target system, or about those IRPs matching the specified search criteria.

Syntax in Windows 2000

!irpfind [PoolType [RestartAddress [Criteria Data]]] 

Syntax in Windows XP and later


    !irpfind [-v] [PoolType [RestartAddress [Criteria Data]]] 

Parameters

-v

(Windows XP and later) Displays verbose information.

PoolType

Specifies the type of pool to be searched. The following values are permitted:

0

Specifies nonpaged memory pool. This is the default.

1

Specifies paged memory pool.

2

Specifies the special pool.

4

(Windows XP and later) Specifies the session pool.

RestartAddress

Specifies the hexadecimal address at which to begin the search. This is useful if the previous search was terminated prematurely. The default is zero.

Criteria

Specifies the criteria for the search. Only those IRPs that satisfy the given match will be displayed.

CriteriaMatch

arg

Finds all IRPs with a stack location where one of the arguments equals Data.

device

Finds all IRPs with a stack location where DeviceObject equals Data.

fileobject

Finds all IRPs whose Irp.Tail.Overlay.OriginalFileObject equals Data.

mdlprocess

Finds all IRPs whose Irp.MdlAddress.Process equals Data.

thread

Finds all IRPs whose Irp.Tail.Overlay.Thread equals Data.

userevent

Finds all IRPs whose Irp.UserEvent equals Data.

 

Data

Specifies the data to be matched in the search.

DLL

Windows 2000

Kdextx86.dll

Windows XP and later

Kdexts.dll

 

Additional Information

See Plug and Play Debugging for applications of this extension command. For information about IRPs, see the Windows Driver Kit (WDK) documentation and Microsoft Windows Internals by Mark Russinovich and David Solomon. (These resources may not be available in some languages and countries.)

Remarks

This example finds the IRP in the nonpaged pool that is going to set user event FF9E4F48 upon completion:

kd> !irpfind 0 0 userevent ff9e4f48

The following example produces a full listing of all IRPs in the nonpaged pool:

kd> !irpfind
Searching NonPaged pool (8090c000 : 8131e000) for Tag: Irp
8097c008 Thread 8094d900 current stack belongs to  \Driver\symc810
8097dec8 Thread 8094dda0 current stack belongs to  \FileSystem\Ntfs
809861a8 Thread 8094dda0 current stack belongs to  \Driver\symc810
809864e8 Thread 80951ba0 current stack belongs to  \Driver\Mouclass
80986608 Thread 80951ba0 current stack belongs to  \Driver\Kbdclass
80986728 Thread 8094dda0 current stack belongs to  \Driver\symc810

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft. All rights reserved.