The !irpfind extension displays information about all I/O request packets (IRP) currently allocated in the target system, or about those IRPs matching the specified search criteria.
Syntax in Windows 2000
!irpfind [PoolType [RestartAddress [Criteria Data]]]
Syntax in Windows XP and later
!irpfind [-v] [PoolType [RestartAddress [Criteria Data]]]
(Windows XP and later) Displays verbose information.
Specifies the type of pool to be searched. The following values are permitted:
Specifies the hexadecimal address at which to begin the search. This is useful if the previous search was terminated prematurely. The default is zero.
Specifies the criteria for the search. Only those IRPs that satisfy the given match will be displayed.
Finds all IRPs with a stack location where one of the arguments equals Data.
Finds all IRPs with a stack location where DeviceObject equals Data.
Finds all IRPs whose Irp.Tail.Overlay.OriginalFileObject equals Data.
Finds all IRPs whose Irp.MdlAddress.Process equals Data.
Finds all IRPs whose Irp.Tail.Overlay.Thread equals Data.
Finds all IRPs whose Irp.UserEvent equals Data.
Specifies the data to be matched in the search.
Windows XP and later
See Plug and Play Debugging for applications of this extension command. For information about IRPs, see the Windows Driver Kit (WDK) documentation and Microsoft Windows Internals by Mark Russinovich and David Solomon. (These resources may not be available in some languages and countries.)
This example finds the IRP in the nonpaged pool that is going to set user event FF9E4F48 upon completion:
kd> !irpfind 0 0 userevent ff9e4f48
The following example produces a full listing of all IRPs in the nonpaged pool:
kd> !irpfind Searching NonPaged pool (8090c000 : 8131e000) for Tag: Irp 8097c008 Thread 8094d900 current stack belongs to \Driver\symc810 8097dec8 Thread 8094dda0 current stack belongs to \FileSystem\Ntfs 809861a8 Thread 8094dda0 current stack belongs to \Driver\symc810 809864e8 Thread 80951ba0 current stack belongs to \Driver\Mouclass 80986608 Thread 80951ba0 current stack belongs to \Driver\Kbdclass 80986728 Thread 8094dda0 current stack belongs to \Driver\symc810
Build date: 1/27/2014