Edit

!drivers

  • Article

Note

In Windows XP and later versions of Windows, the !drivers extension is obsolete. To display information about loaded drivers and other modules, use the lm command.

The command lm t n displays information in a format very similar to the old !drivers extension. However, this command will not display the memory usage of the drivers as the !drivers extension did. It will only display the drivers' start and end addresses, image names, and timestamps. The !vm and !memusage extensions can be used to display memory usage statistics.

!drivers [Flags]

Parameters

Flags
Can be any combination of the following values. (The default is 0x0.)

Bit 0 (0x1)
Causes the display to include information about resident and standby memory.

Bit 1 (0x2)
If this bit is set and bit 2 (0x4) is not set, the display will include information about resident, standby, and locked memory, as well as the loader entry address. If bit 2 is set, this causes the display to be a much longer and more detailed list of the driver image. Information about the headers is included, as is section information.

Bit 2 (0x4)
Causes the display to be a much longer and more detailed list of the driver image. Information about each section is included. If bit 1 (0x2) is set, this will also include header information.

DLL

Windows 2000

Kdextx86.dll

Windows XP and later

Unavailable

Additional Information

See Plug and Play Debugging for applications of this extension command. For information about drivers and their memory use, see the Windows Driver Kit (WDK) documentation and Microsoft Windows Internals by Mark Russinovich and David Solomon.

Remarks

An explanation of this command's display is given in the following table:

Column Meaning

Base

The starting address of the device driver code, in hexadecimal. When the memory address used by the code that causes a stop falls between the base address for a driver and the base address for the next driver in the list, that driver is frequently the cause of the fault. For instance, the base for Ncrc810.sys is 0x80654000. Any address between that and 0x8065a000 belongs to this driver.

Code Size

The size, in kilobytes, of the driver code, in both hexadecimal and decimal.

Data Size

The amount of space, in kilobytes, allocated to the driver for data, in both hexadecimal and decimal.

Locked

(Only when Flag 0x2 is used) The amount of memory locked by the driver.

Resident

(Only when Flag 0x1 or 0x2 is used) The amount of the driver's memory that actually resides in physical memory.

Standby

(Only when Flag 0x1 or 0x2 is used) The amount of the driver's memory that is on standby.

Loader Entry

(Only when Flag 0x2 is used) The loader entry address.

Driver Name

The driver file name.

Creation Time

The link date of the driver. Do not confuse this with the file date of the driver, which can be set by external tools. The link date is set by the compiler when a driver or executable file is compiled. It should be close to the file date, but it is not always the same.

The following is a truncated example of this command:

kd> !drivers
Loaded System Driver Summary
Base     Code Size      Data Size      Driver Name  Creation Time
80080000 f76c0 (989 kb) 1f100 (124 kb) ntoskrnl.exe Fri May 26 15:13:00
80400000 d980  ( 54 kb) 4040  ( 16 kb) hal.dll      Tue May 16 16:50:34
80654000 3f00  ( 15 kb) 1060   ( 4 kb) ncrc810.sys  Fri May 05 20:07:04
8065a000 a460  ( 41 kb) 1e80   ( 7 kb) SCSIPORT.SYS Fri May 05 20:08:05