Kernel Memory Space Analyzer — Plug-In Reference (Phase 3)
Last Updated: 12/25/99
1.1.1 Stop 0A (IRQL_NOT_LESS_OR_EQUAL)
1.1.2 Stop 1E
(KMODE_EXCEPTION_NOT_HANDLED)
1.1.3 Stop 49
(PAGE_FAULT_WITH_INTERRUPTS_OFF)
1.1.4 Stop 50
(PAGE_FAULT_IN_NONPAGED_AREA)
1.1.5 Stop 7F
(UNEXPECTED_KERNEL_MODE_TRAP)
1.2 Driver Verifier Stop Codes
1.2.1 Stop BE
(ATTEMPTED_WRITE_TO_READONLY_MEMORY)
1.2.2 Stop C1
(SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION)
1.2.3 Stop C2 (BAD_POOL_CALLER)
1.2.4 Stop C4
(DRIVER_VERIFIER_DETECTED_VIOLATION)
1.2.5 Stop C5 (DRIVER_CORRUPTED_EXPOOL)
1.2.6 Stop C6
(DRIVER_CAUGHT_MODIFYING_FREED_POOL)
1.2.7 Stop C7 (TIMER_OR_DPC_INVALID)
1.2.8 Stop C9
(DRIVER_VERIFIER_IOMANAGER_VIOLATION)
1.2.9 Stop CB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS)
1.2.10 Stop CC
(PAGE_FAULT_IN_FREED_SPECIAL_POOL)
1.2.11 Stop CD
(PAGE_FAULT_BEYOND_END_OF_ALLOCATION)
1.2.12 Stop CE (DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS)
1.2.13 Stop CF (TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE)
1.2.14 Stop D0 (DRIVER_CORRUPTED_MMPOOL)
1.2.15 Stop D1
(DRIVER_IRQL_NOT_LESS_OR_EQUAL)
1.2.16 Stop D3
(DRIVER_PORTION_MUST_BE_NONPAGED)
1.2.17 Stop D4 (SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD)
1.2.18 Stop D5
(DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL)
1.2.19 Stop D6 (DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION)
1.2.20 Stop D8
(DRIVER_USED_EXCESSIVE_PTES)
1.3 Generic Stop Code Processing
1.3.1 Generic Stop Code Classes
1.3.2 Generic Stop Code Analysis And Db
Matching
2. Base Plug-In Types and Method
Interfaces
2.1.1 ExecutiveObject\EventPair
2.1.4 ExecutiveObject\ControllerObject
2.1.5 ExecutiveObject\FileObject
2.1.8 ExecutiveObject\WindowStation
2.2.4 Io\DEVICE_EXTENSION\Class
2.2.5 Io\DEVICE_EXTENSION\Class2
2.2.6 Io\DEVICE_EXTENSION\ScsiPort
2.4.2 KernelObject\DeviceQueue
2.4.3 KernelObject\DeviceQueueEntry
2.4.5 KernelObject\ActiveProfileSource
2.8.3 Root\SystemMappedViewsArea
2.8.4 Root\SystemMappedViewsFreeArea
2.8.7 Root\SystemCacheWorkingSetListArea
2.10.1 Root\NonPagedSystemArea
2.11.1 Root\NonPagedPoolMustSucceedArea
2.11.2 Root\NonPagedPoolInitialArea
2.11.3 Root\NonPagedPoolExpansionArea
2.11.6 MmPool\PagedPool\FreePages
2.11.8 MmPool\NonPagedPool\FreePages
2.11.9 MmPool\NonPagedPool\MappedToKseg0
2.14.2 Module\Code, Module\Data
2.15.1 ObjectTable\ObjectHeader
2.15.2 ObjectTable\ObjectHandleTable
2.15.4 ObjectTable\DirectoryObject
2.15.5 ObjectTable\SymbolicLinkObject
2.16.2 PoolControl\PoolDescriptor
2.17.2 LookasideList\SmallPool
This section describes the analysis that is performed by the stop-code analysis plug-in, including the processing that occurs for each handled stop code.
The stop-code plug-in is dependent upon the stop code of the crash dump in determining how to analyze it. Each stop code type has specific basic steps to follow in gathering data that uniquely identifies the crash dump and data that will assist in determining the cause of the crash. Each stop code may also require some further specialized analysis steps, but for Phase 3, just the general case of each stop code type is handled. The stop-code plug-in divides stop codes into 3 general categories:
1) The specific category
includes certain specific stop code cases that are singled out for special
attention. For phase 3, these are stop 0A, 1E, 49, 50, and 7F.
2) The driver
verifier category includes all the driver-verifier stop code cases.
3)
The generic
category includes stop codes that are not in the specific or driver verifier
category.
The following sections describe the analysis for each of these categories.
Note that in the database and signature id file, all canonicalized stop code parameters are stored as multi-byte strings; all numbers are in hex; and hex numbers such as offsets are separated from other text such as module names by “!” characters.
Table of Contents Ý
For phase 3, stop code analysis focuses on stop 0A, 1E, 49, 50, and 7F. These represent the bulk of reported crashes and therefore focusing on these provides reasonable coverage for phase 3 kanalyze. The sections that follow describe the processing for each of these bugchecks, including
· Steps that are taken at various points in kanalyze’s flow and the analysis performed;
· Canonicalization performed on the bugcheck parameters;
· Data placed into the signature id file.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This
will fill in the SigID CrashClass and Variable data accordingly
SigId CrashClass Item |
Data |
Stop-Code |
0x0A |
Param1 |
Pool Info |
Param2*** |
Module name from KiBugCheckDriver |
Param3 |
Nil |
Param4 |
Relevant Module name & offset |
Keyword1* |
Relevant Routine name & offset |
Keyword2* |
Secondary Module – From call stack, get the Module name & Offset called before the above routine for match purposes |
Keyword3** |
1) Secondary Routine - From call stack, get the Routine name & Offset called before the above routine for match purposes 2) For special 0A case if (Param1 == Param3) && !=0, this will contain the Worker module name and offset. |
Keyword4** |
1) Next Module and offset – From call stack get next Module name that is not the same as the Relevant or Secondary module name for match purposes. If not present, set to Nil. 2) For special 0A case, this will contain the Worker routine address and offset. |
SigId Variable CrashData |
Data |
Call Stack* |
|
* This
data is only available if the correct symbol debug file is present.
** This
only occurs for a Special case where (Param-1 == Param-3) AND ! = ZERO.
*** If
available
KA_DB_BUILD_QUERY
This will build the following KI db query with the
AddClausesCallback function:
(Stop-Code == StopCode) AND (Param4 == ModuleName!Offset)
KA_DB_PROCESS_CLASS
For each CrashClass to be processed from the query result,
it will make the following MatchLevel checks. Because the Module and Module
offset have matched, MatchLevel = MatchWeak to start with.
1. If Relevant Routine Name and Offset equal, set MatchLevel=MatchFair.
2. If Secondary Module Name and Offset equal, set MatchLevel=MatchGood.
3. If Param1 equal, set MatchLevel=MatchGood
4. If Next Module Name and Offset equal, set MatchLevel= MatchAbsolute
5. If Worker Module and offset equals, set MatchLevel=MatchFair**
6. If Secondary routine offset equals, set MatchLevel=MatchGood**
7.
If Param2 equals, set MatchLevel=MatchGood
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly
SigID CrashClass Item |
Data |
Stop-Code |
0x1E |
Param-1 |
Exception code |
Param-2 |
Relevant module name & offset |
Param-3 |
Nil |
Param-4 |
Nil |
Keyword1* |
Relevant Routine name & offset |
Keyword2 |
Secondary Module – From call stack, get the Module name & Offset called before the above routine for match purposes |
Keyword3* |
Secondary Routine - From call stack, get the Routine name & Offset called before the above routine for match purposes. |
Keyword4 |
Next Module and offset – From call stack get next Module name that is not the same as the Relevant or Secondary module name for match purposes. If not present, set to Nil. |
SigId Variable CrashData |
Data |
Call Stack* |
|
* This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query with the AddClausesCallback function:
(Stop-Code = 1E) AND (Param2 = ModuleName!Offset).
KA_DB_PROCESS_CLASS
For each CrashClass to be processed from the query result,
it will make the following MatchLevel checks. Because the Module and Module
offset have matched, MatchLevel = MatchWeak to start with.
1. If Exception code equal, set MatchLevel=MatchFair
2. If Relevant Routine Name and Offset equal, set MatchLevel=MatchFair
3. If Secondary Module Offsets equal, set MatchLevel=MatchGood
4. If Secondary Routine Name and Offset equal, set MatchLevel=MatchGood
5. If Next Module Name and Offset equal, set MatchLevel= MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
Handling for this Windows 2000 and later bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
50 |
Param-1 |
Pool Info |
Param-2 |
Read or Write |
Param-3* |
Relevant Module name & Offset |
Param-4 |
Nil |
Canonical |
TRUE |
Keyword1* |
Routine name & offset where exception occurred |
Keyword2* |
Driver name from KiBugCheckDriver |
Keyword3 |
Nil |
Keyword4 |
Nil |
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == StopCode) AND (Param-3 == ModuleName!Offset)
KA_DB_PROCESS_CLASS
Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash. MatchLevel starts off at MatchFair.
1. Param-2 equal, set MatchLevel= MatchGood
2. If Relevant Routine Name and Offset equal, set MatchLevel= MatchAbsolute
3. If Driver name from KiBugCheckDriver equal, set MatchLevel= MatchAbsolute
* If available
** Routine name can obtain only if the correct symbols are available
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly
SigID CrashClass Item |
Data |
Stop-Code |
0x7F |
Param-1 |
Trap Number |
Param-2 |
Nil |
Param-3 |
Nil |
Param-4 |
Nil |
Keyword1* |
Module Name! Offset |
Keyword2* |
Relevant Routine name! Offset |
Keyword3 |
Nil |
Keyword4 |
Nil |
SigId Variable CrashData |
Data |
Call Stack* |
|
* This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query with the
AddClausesCallback function:
(Stop-Code = 1E) AND (Keyword1 == ModuleName!Offset)
KA_DB_PROCESS_CLASS
For each CrashClass to be processed from the query result,
it will make the following MatchLevel checks. Because the Module and Module
offset have matched, MatchLevel = MatchWeak to start with.
1. If Trap Number equal, set MatchLevel=MatchFair
2. If Relevant Routine Name and Offset equal, set MatchLevel=MatchGood
3. If Call Stack equal, set MatchLevel= MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
Phase 3 kanalyze understands Windows 2000 driver verifier stop codes and their associated bugcheck parameters. Processing is similar to the processing for the specific stop codes. In some cases, a driver verifier bugcheck’s parameters are sufficient to accurately diagnose the problem, meaning that the stop code plug-in will automatically provide solution data.
Table of Contents Ý
Handling for this bugcheck is the same as for Stop CB (DRIVER_LEFT_LOCKED_PAGED_IN_PROCESS).
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
C1 |
Param-1 |
Nil |
Param-2 |
Nil |
Param-3 |
Nil |
Param-4 |
Type of violation |
Keyword1* |
Module name & offset where exception occurred |
Keyword2** |
Routine name & offset where exception occurred |
Keyword3 |
Nil |
Keyword4 |
Nil |
SigId Variable CrashData |
Data |
Call Stack** |
|
*We can get the following data from the stack trace.
**This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query:
(Stop-Code == C1) AND (Keyword-1 == ModuleName & Offset)
KA_DB_PROCESS_CLASS
Since
the error can be determined with this stop code, a solution will also be
entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase.
MatchLevel starts off at MatchWeak
1.
If Relevant
Routine Name and Offset equal, set MatchLevel= MatchFair
2.
Type of violation (Param-4) equal, set MatchLevel= MatchGood
3.
If Call stack
equal, set MatchLevel=MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
C2 |
Param-1 |
Type of violation |
Param-2 |
Nil |
Param-3 |
Nil |
Param-4 |
Nil |
Keyword1* |
Module name & offset where exception occurred |
Keyword2** |
Routine name & offset where exception occurred |
Keyword3 |
Nil |
Keyword4 |
Nil |
SigId Variable CrashData |
Data |
Call Stack** |
|
*We can get the following data from the stack trace.
**This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == Stop Code) AND (Keyword1 == ModuleName & Offset)
KA_DB_PROCESS_CLASS
Since
the error can be determined with this stop code, a solution will also be
entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase.
MatchLevel starts off at MatchWeak
1.
If Relevant
Routine Name and Offset equal, set MatchLevel=MatchFair
2.
If Param-1 (Type of violation) equal, set
MatchLevel=MatchGood
3. If call stack equal, set MatchLevel=MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
Handling for this bugcheck is the same as for Stop C2 (BAD_POOL_CALLER).
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
C5 |
Param-1 |
Pool Info |
Param-2 |
IRQL Level |
Param-3 |
Read or Write |
Param-4 |
Relevant module name and offset |
Keyword1* |
Routine name & offset where exception occurred |
Keyword2 |
Nil |
Keyword3 |
Nil |
Keyword4 |
Nil |
* This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == Stop Code) AND (Param-4 == ModuleName & Offset)
KA_DB_PROCESS_CLASS
Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchWeak.
1. If Param-2 (IRQL) equal, set MatchLevel= MatchFair
2. If Param-3 (Read or Write) equal, set MatchLevel= MatchGood
3. If Relevant Routine Name and Offset equal, set MatchLevel= MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
C6 |
Param-1 |
Pool Info |
Param-2 |
Read or Write |
Param-3 |
Kernel mode or user mode |
Param-4 |
Type |
Keyword1 |
Module name & offset where exception occurred |
Keyword2* |
Routine name & offset where exception occurred |
Keyword3 |
Nil |
Keyword4 |
Nil |
SigId Variable CrashData |
Data |
Call Stack* |
|
* This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == C6 ) AND (Keyword-1 == ModuleName & Offset)
KA_DB_PROCESS_CLASS
Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at. MatchWeak
1. If Param-2, 3 and 4 equal, set MatchLevel= MatchFair
2. If Relevant Routine Name and Offset equal, set MatchLevel= MatchGood
3. If Call Stack equal, set MatchLevel= MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
C7 |
Param-1 |
Timer Object / DPC routine / DPC Object |
Param-2 |
Module Name |
Param-3 |
Nil |
Param-4 |
Nil |
Keyword1 |
Routine Name & Offset |
Keyword2 |
Nil |
Keyword3 |
Nil |
Keyword4 |
Nil |
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == C7 ) AND (Param-2 == Module Name)
KA_DB_PROCESS_CLASS
Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchFair.
1. If Param-1 equal, set MatchLevel=MatchGood
2. If Keyword-1 equal, set MatchLevel=MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
C9 |
Param-1 |
Type |
Param-2 |
Nil |
Param-3 |
Nil |
Param-4 |
Exception Code |
Canonical |
FALSE |
Keyword1* |
Module name & offset where exception occurred |
Keyword2* |
Routine name & offset where exception occurred |
Keyword3 |
Nil |
Keyword4 |
Nil |
SigId Variable CrashData |
Data |
Call Stack* |
|
* This data is only available if the correct symbol debug file is present.
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == C9 ) AND (Keyword1 == ModuleName)
KA_DB_PROCESS_CLASS
Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchWeak.
1. If Param-1 equal, set MatchLevel=MatchFair
2. If Keyword1 equal, set MatchLevel=MatchGood
3. If Call stack equal, set MatchLevel=MatchAbsolute
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.
SigID CrashClass Item |
Data |
Stop-Code |
CB |
Param-1 |
Pool Info If Value is non ZERO |
Param-2 |
Nil |
Param-3 |
Nil |
Param-4 |
Nil |
Canonical |
FALSE |
Keyword1* |
Module Name * |
Keyword2 |
Nil |
Keyword3 |
Nil |
Keyword4 |
Nil |
* If available in KiBugCheckDriver.
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == Stop Code) AND (Keyword1 == ModuleName)
KA_DB_PROCESS_CLASS
Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchFair.
· If Param-1 equal, set MatchLevel=MatchGood
Report MatchLevel back through ReportMatchCallback routine.
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop CB (DRIVER_LEFT_LOCKED_PAGED_IN_PROCESS).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop C5 (DRIVER_CORRUPTED_EXPOOL).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).
Table of Contents Ý
Handling for this bugcheck is the same as for Stop CB (DRIVER_LEFT_LOCKED_PAGED_IN_PROCESS).
Table of Contents Ý
The generic category includes those stop codes that are not included in the other categories, and therefore for which no stop-code specific processing or analysis is performed. Each stop code will be researched to see if a viable solution can be determined from the stop code itself. If so, then the stop code plug-in will add this solution data as a data item so that it can be displayed to the user as part of the kanalyze report.
The generic stop codes are divided into 16 classes, depending on which of the parameters in the stop code are felt to be meaningful. The tables below show the how the stop code classes are organized.
Class |
Param-1 |
Param-2 |
Param-3 |
Param-4 |
0 |
T |
T |
T |
T |
1 |
T |
T |
T |
R |
2 |
T |
T |
R |
T |
3 |
T |
T |
R |
R |
4 |
T |
R |
T |
T |
5 |
T |
R |
T |
R |
6 |
T |
R |
R |
T |
7 |
T |
R |
R |
R |
8 |
R |
T |
T |
T |
9 |
R |
T |
T |
R |
10 |
R |
T |
R |
T |
11 |
R |
T |
R |
R |
12 |
R |
R |
T |
T |
13 |
R |
R |
T |
R |
14 |
R |
R |
R |
T |
15 |
R |
R |
R |
R |
T– unused parameter
R– valid parameter
Class |
Canonical |
STOP Codes |
|||
Param1 |
Param2 |
Param3 |
Param4 |
||
0 |
Nil |
Nil |
Nil |
Nil |
All the stop codes other than those are specified explicitly. |
1 |
|
|
|
|
Nil |
2 |
|
|
Num |
|
BAD_POOL_HEADER (0x19) |
3 |
|
|
|
|
Nil |
4 |
|
Num |
|
|
KERNEL_DATA_INPAGE_ERROR (0x7A) |
|
Num |
|
|
ACPI_DRIVER_INTERNAL (0xA3) |
|
5 |
|
|
|
|
Nil |
6 |
|
Num |
|
Num |
KERNEL_APC_PENDING_DURING_EXIT (0x20) |
7 |
|
|
|
|
Nil |
8 |
Num |
|
|
|
MEMORY_MANAGEMENT (0x1A) |
Num |
|
|
|
FAT_FILE_SYSTEM (0x23) |
|
Num |
|
|
|
NTFS_FILE_SYSTEM (0x24) |
|
Num |
|
|
|
NPFS_FILE_SYSTEM (0x25) |
|
Num |
|
|
|
CDFS_FILE_SYSTEM (0x26) |
|
Num |
|
|
|
RDR_FILE_SYSTEM (0x27) |
|
Num |
|
|
|
UDFS_FILE_SYSTEM (0x9B) |
|
Num |
|
|
|
CNSS_FILE_SYSTEM_FILTER (0xA4) |
|
Num |
|
|
|
SESSION1_INITIALIZATION_FAILED (0x6D) |
|
Num |
|
|
|
SESSION2_INITIALIZATION_FAILED (0x6E) |
|
Num |
|
|
|
SESSION3_INITIALIZATION_FAILED (0x6F) |
|
Num |
|
|
|
SESSION4_INITIALIZATION_FAILED (0x70) |
|
Num |
|
|
|
SESSION5_INITIALIZATION_FAILED (0x71) |
|
9 |
|
|
|
|
Nil |
10 |
|
|
|
|
Nil |
11 |
|
|
|
|
Nil |
12 |
Num |
Num |
|
|
MUTEX_LEVEL_NUMBER_VIOLATION (0x0D) |
Num |
Num |
|
|
PHASE1_INITIALIZATION_FAILED (0x32) |
|
Num |
Num |
|
|
CONFIG_INITIALIZATION_FAILED (0x67) |
|
Num |
Num |
|
|
PROCESS1_INITIALIZATION_FAILED (0x6B) |
|
Num |
Num |
|
|
KERNEL_STACK_INPAGE_ERROR (0x77) |
|
13 |
|
|
|
|
Nil |
14 |
Num |
Num |
Num |
|
MISMATCHED_HAL (0x79) |
15 |
|
|
|
|
Nil |
Num – Same as the parameter in the Stop-code (x) field.
Table of Contents Ý
KA_PERFORM_ANALYSIS
This
will fill in the SigID CrashClass data accordingly
SigId CrashClass Item |
Data |
Stop-Code |
Stop code |
Param1 |
Available for class 8~15 |
Param2 |
Available for class 3~7 and 12~15 |
Param3 |
Available for class 2,3,6,7,10,11,14,15 |
Param4 |
Available for alternate classes starting from 1 |
Keyword1 |
Module Name & Offset |
Keyword2* |
Routine Name & Offset |
Keyword3 |
Next module & Offset |
Keyword4* |
Next module’s Routine & Offset |
SigId Variable CrashData |
Data |
Call Stack * |
|
* This data is only available if the correct symbol debug file is
present.
If the Keyword3 is NULL then CanonicalizationLevel set as CanonLevelMedium.
KA_DB_BUILD_QUERY
This will build the following KI db query.
(Stop-Code == xx) AND (Keyword1 == yy)
KA_DB_PROCESS_CLASS
With some stop codes, some data can be provided on the cause and solution for it and this will be reported back.
For each CrashClass from the query result, it will make the following match checks.
MatchLevel starts off at MatchWeak
If Relevant Next Module Name & Offset equal and
Routine Name & Offset equal, set MatchLevel=MatchFair
If Stop params equal, set MatchLevel=MatchGood
If Call stack matches, set MatchValue=MatchAbsolute
Table of Contents Ý
The base plug-ins supplied with phase 3 kanalyze are as follows.
eobjects.dll — executive objects and object bodies
EXECUTIVEOBJECT — executive object bodies for event pairs, profiles, timers, controllers, files, processes, threads, and window stations.
kaio.dll — I/O system
IO — IRPs, device objects, driver objects, class.sys/class2.sys device extensions, and scsiport.sys device extensions
kobjects.dll — kernel objects and related structures
KERNELPROCTHRD — kernel thread and process objects and related structures
KERNELMISCOBJ — kernel queue, device queue, profile, and interrupt objects and related structures
KERNELAPCDPC — kernel APC and DPC objects and related structures
KERNELSYNC — kernel event, mutant, semaphore, and event pair objects
KERNELTIMER — kernel timer object
memory.dll — kernel-mode memory layout and root containers
VIRTUALMEMORY — top-level kernel-mode virtual memory layout
MMPOOL — top-level paged and non-paged pool areas and free pool pages
MMSYS — non-paged system area
PCR — PCRs and PRCBs
SLIST — Slists
LIST — Lists (LIST_ENTRY)
module.dll — kernel-mode modules
MODULE — loaded modules' headers, and read-only code and data
objtbl.dll — object tables
OBJECTTABLE — object headers, handle tables, types, directories, and symbolic links
pool.dll — pool memory
EXPOOL — pool descriptors and blocks
LOOKASIDE — lookaside lists
The sections that follow describe these plug-ins in detail, including the data item type names and method interfaces offered by each.
Table of Contents Ý
ExecutiveObject\EventPair — executive event pair (EEVENT_PAIR structure)
ExecutiveObject\Profile — executive profile object (EPROFILE structure)
ExecutiveObject\Timer — executive timer object (ETIMER structure)
ExecutiveObject\ControllerObject — IO controller object (CONTROLLER_OBJECT structure)
ExecutiveObject\FileObject — IO file object (FILE_OBJECT structure)
ExecutiveObject\Process — executive process object (EPROCESS structure)
ExecutiveObject\Thread — executive thread object (ETHREAD structure)
ExecutiveObject\WindowStation — window station object
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
Method code M_EOPROCESS_GET_BASIC_INFO
#define MAX_IMAGE_NAME_LENGTH 32
typedef struct _EOBJ_PROCESS_BASIC_INFO {
SIZE_T ProcessId;
SIZE_T ParentProcessId;
UINT_PTR PebAddress;
WCHAR ImageName[MAX_IMAGE_NAME_LENGTH];
} EOBJ_PROCESS_BASIC_INFO, *PEOBJ_PROCESS_BASIC_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT PEOBJ_PROCESS_BASIC_INFO BasicInfo
);
Method code M_EOPROCESS_GET_HANDLE_TABLE_INFO
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT PUINT_PTR HandleTableAddress
);
Method code M_EOPROCESS_GET_PAGE_INFO
typedef struct _EOBJ_PROCESS_PAGE_INFO{
UINT_PTR VadRoot;
UINT_PTR CloneRoot;
UINT_PTR NumberOfPrivatePages;
UINT_PTR ModifiedPageCount;
UINT_PTR NumberOfLockedPages;
} EOBJ_PROCESS_PAGE_INFO, * PEOBJ_PROCESS_PAGE_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_PROCESS_PAGE_INFO PageInfo
);
Method code M_EOPROCESS_GET_MUTANT
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR MutantAddress
);
Method code M_EOPROCESS_GET_LOCKOWNER
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR LockOwnerAddress,
OUT PUINT_PTR LockCount
);
Method code M_EOPROCESS_GET_TIME_INFO
typedef struct _EOBJ_PROCESS_TIME_INFO {
UINT_PTR KernelTime;
UINT_PTR UserTime;
UINT_PTR CreationTime;
} EOBJ_PROCESS_TIME_INFO, * PEOBJ_PROCESS_TIME_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_PROCESS_TIME_INFO TimeInfo
);
Method code M_EOPROCESS_GET_POOL_USAGE_INFO
typedef struct _EOBJ_PROCESS_POOL_USAGE_INFO{
UINT_PTR PagedPool;
UINT_PTR NonpagedPool;
} EOBJ_PROCESS_POOL_USAGE_INFO,
*PEOBJ_PROCESS_POOL_USAGE_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_PROCESS_POOL_USAGE_INFO PoolUsageInfo
);
Method code M_EOPROCESS_GET_WORKINGSET_INFO
typedef struct _EOBJ_PROCESS_WORKINGSET_INFO {
SIZE_T CurrentSize;
SIZE_T MinimumSize;
SIZE_T MaximumSize;
SIZE_T PeakWorkingSetSize;
} EOBJ_PROCESS_WORKINGSET_INFO, *PEOBJ_PROCESS_WORKINGSET_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_PROCESS_WORKINGSET_INFO WorkingSetInfo
);
Method code M_EOPROCESS_GET_VM_INFO
typedef struct _EOBJ_PROCESS_VM_INFO {
SIZE_T VirtualSize;
SIZE_T PeakVirtualSize;
SIZE_T PageFaultCount;
SIZE_T CommitCharge;
} EOBJ_PROCESS_VM_INFO, *PEOBJ_PROCESS_VM_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_PROCESS_VM_INFO VmInfo
);
Method code M_EOPROCESS_GET_ACCESS_TOKEN
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR AccessTokenAddress
);
Table of Contents Ý
Method code M_EOTHREAD_GET_BASIC_INFO
typedef struct _EOBJ_THREAD_BASIC_INFO {
SIZE_T OwnerProcessId;
SIZE_T
ThreadId;
UINT_PTR StartAddress;
UINT_PTR Win32StartAddress;
} EOBJ_THREAD_BASIC_INFO, * PEOBJ_THREAD_BASIC_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_THREAD_BASIC_INFO BasicInfo
);
Method code M_EOTHREAD_GET_LPC_MSG
typedef struct _EOBJ_THREAD_LPC_MSG_INFO {
BOOL ReceivedLpcMsgIdValid;
UINT_PTR ReceivedLpcMsgId;
UINT_PTR ReplyLpcMsg;
UINT_PTR ReplyLpcMsgId;
} EOBJ_THREAD_LPC_MSG_INFO, * PEOBJ_THREAD_LPC_MSG_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_THREAD_LPC_MSG_INFO LpcMsgInfo
);
Method code M_EOTHREAD_GET_IMPERSONATION_INFO
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR ImpersonationInfoAddr
);
Method code M_EOTHREAD_GET_PERFORMANCE_COUNT_INFO
typedef struct _EOBJ_THREAD_PERFORMANCE_COUNT_INFO {
UINT_PTR PerformanceCountHigh;
UINT_PTR PerformanceCountLow;
} EOBJ_THREAD_PERFORMANCE_COUNT_INFO,
*PEOBJ_THREAD_PERFORMANCE_COUNT_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PEOBJ_THREAD_PERFORMANCE_COUNT_INFO Info
);
Method code M_EOTHREAD_ENUM_IRPS
typedef
UINT32
(CALLBACK *PEOBJ_THREAD_ENUM_IRPS_CALLBACK)(
IN UINT_PTR IrpAddress,
PVOID Context
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PEOBJ_THREAD_ENUM_IRPS_CALLBACK CallbackProc,
IN PVOID Context
);
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
Io\IRP — IRPs (IRP structure)
Io\DEVICE_OBJECT — device object (DEVICE_OBJECT structure)
Io\DRIVER_OBJECT — driver object (DRIVER_OBJECT structure)
Io\DEVICE_EXTENSION\Class — device extension for class.sys
Io\DEVICE_EXTENSION\Class2 — device extension for class2.sys
Io\DEVICE_EXTENSION\ScsiPort — device extension for scsiport.sys
Table of Contents Ý
Method code M_IRP_GET_OWNER_THREAD
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR OwnerThread
);
Method code M_IRP_GET_MDL_ADDRESS
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR MdlAddress
);
Method code M_IRP_GET_ASSOCIATED_IRP
#define MASTER_IRP 1
#define SYSTEM_BUFFER 2
#define IRP_COUNT 3
typedef struct _ASSOCIATED_IRP {
USHORT Flags;
union {
KA_ITEM_ID MasterIrp;
UINT_PTR SystemBuffer;
LONG IrpCount;
} Value;
} ASSOCIATED_IRP, *PASSOCIATED_IRP;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PASSOCIATED_IRP AssociatedIrp
);
Method code M_IRP_GET_IO_STACK_STATUS
typedef struct _IRP_IO_STACK_STATUS {
CHAR ActiveStacks;
CHAR CurrentStack;
} IRP_IO_STACK_STATUS, *PIRP_IO_STACK_STATUS;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PIRP_IO_STACK_STATUS IoStackStatus
);
Method code M_IRP_ENUM_IO_STACK_INFO
typedef struct _IRP_STACK_INFO {
CHAR StackNum;
UCHAR MajorFunction;
UCHAR MinorFunction;
UCHAR Flags;
UCHAR Control;
KA_ITEM_ID DeviceObject;
KA_ITEM_ID FileObject;
UINT_PTR CompletionRoutine;
UINT_PTR Context;
struct {
UINT_PTR Argument1;
UINT_PTR Argument2;
UINT_PTR Argument3;
UINT_PTR Argument4;
} Param;
} IRP_STACK_INFO, *PIRP_STACK_INFO;
typedef
BOOL
(CALLBACK * PIRP_ENUM_IO_STACK_INFO)(
IN PIRP_STACK_INFO StackInfo,
IN OUT PVOID MethodContext
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PIRP_ENUM_IO_STACK_INFO Callback,
PVOID Context
);
Table of Contents Ý
Method code M_DEVICE_GET_DEVICE_NAME
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR DeviceName,
OUT SIZE_T *CharsWrittenToBuffer
);
Method code M_DEVICE_GET_DRIVER
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID DriverObject
);
Method code M_DEVICE_GET_NEXT_DEVICE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID NextDeviceObject
);
Method code M_DEVICE_GET_ATTACHED_DEVICE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID AttachedDeviceObject
);
Method code M_DEVICE_GET_CURRENT_IRP
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID CurrentIrp
);
Method code M_DEVICE_GET_REFERENCE_COUNT
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG ReferenceCount
);
Method code M_DEVICE_GET_DEVICE_TYPE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PULONG DeviceType
);
Method code M_DEVICE_GET_VPB
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR Vpb
);
Method code M_DEVICE_GET_DEVICE_EXTENSION
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID DeviceExtension
);
Method code M_DEVICE_ENUM_QUEUED_IRPS
typedef
BOOL
(CALLBACK *PDEVICE_ENUM_QUEUED_IRPS)(
IN KA_ITEM_ID Irp,
PVOID Context
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PDEVICE_ENUM_QUEUED_IRPS Callback,
PVOID Context
);
Table of Contents Ý
Method code M_DRIVER_GET_DRIVER_NAME
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR DriverName,
OUT SIZE_T *CharsWrittenToBuffer
);
Method code M_DRIVER_ENUM_DEVICE
typedef
BOOL
(CALLBACK *PDRIVER_ENUM_DEVICE)(
IN KA_ITEM_ID DeviceObject,
PVOID Context
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PDRIVER_ENUM_DEVICE Callback,
PVOID Context
);
Table of Contents Ý
Method code M_DEVEXT_CLASS_GET_DEVICE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID DeviceObject
);
Table of Contents Ý
Method code M_DEVEXT_CLASS2_GET_DEVICE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID DeviceObject
);
Table of Contents Ý
Method code M_DEVEXT_SCSIPORT_GET_DEVICE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID DeviceObject
);
Method code M_DEVEXT_SCSIPORT_GET_HW_EXTENSION
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKA_ITEM_ID HwDeviceExtension
);
Table of Contents Ý
KernelObject\Thread — kernel thread object (KTHREAD structure)
KernelObject\WaitBlock — kernel thread wait block
KernelObject\Process — kernel process object (KTHREAD structure)
Table of Contents Ý
Method code M_KOTHREAD_GET_BASIC_INFO
typedef enum {
Initialized,
Ready,
Running,
Standby,
Terminated,
Waiting,
Transition
} KTHRED_STATUS;
typedef struct _KTHRED_BASIC_INFO {
KTHRED_STATUS State;
UINT_PTR Win32Thread;
UINT_PTR Teb;
} KTHRED_BASIC_INFO, *PKTHRED_BASIC_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKTHRED_BASIC_INFO BasicInfo
);
Method code M_KOTHREAD_GET_STACK_INFO
typedef enum {
Normal,
StackSwapEnabled,
LargeStackEnabled,
LargeStackAndStackSwapEnabled
} KTHRED_STACK_TYPE;
typedef struct _KTHRED_STACK_INFO {
UINT_PTR StackBase;
UINT_PTR StackLimit;
UINT_PTR KernelStack;
UINT_PTR CallbackStack;
KTHRED_STACK_TYPE StackType;
} KTHRED_STACK_INFO, *PKTHRED_STACK_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKTHRED_STACK_INFO StackInfo
);
Method code M_KOTHREAD_GET_TIME_INFO
typedef struct _KTHRED_TIME_INFO {
ULONG32 KernelTime;
ULONG32 UserTime;
} KTHRED_TIME_INFO, *PKTHRED_TIME_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKTHRED_TIME_INFO TimeInfo
);
Method code M_KOTHREAD_GET_WAIT_STATUS
typedef enum {
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
| WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel,
MaximumWaitReason
} KTHRED_WAIT_REASON;
#define KTHRED_KERNEL_MODE 0x01
#define KTHRED_USER_MODE 0x00
#define KTHRED_ALERTABLE_WAIT 0x10
#define KTHRED_NONALERTABLE_WAIT 0x00
typedef enum {
NonAlertableUserMode =
(KTHRED_USER_MODE | KTHRED_NONALERTABLE_WAIT),
NonAlertableKernelMode
= (KTHRED_KERNEL_MODE | KTHRED_NONALERTABLE_WAIT),
AlertableUserMode =
(KTHRED_USER_MODE | KTHRED_ALERTABLE_WAIT),
AlertableKernelMode =
(KTHRED_KERNEL_MODE | KTHRED_ALERTABLE_WAIT)
} KTHRED_WAIT_MODE;
typedef struct _KTHRED_WAIT_STATUS {
UINT_PTR WaitTime;
UINT_PTR SuspendCount;
UINT_PTR FreezeCount;
KTHRED_WAIT_REASON WaitReason;
KTHRED_WAIT_MODE WaitMode;
} KTHRED_WAIT_STATUS, *PKTHRED_WAIT_STATUS;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKTHRED_WAIT_STATUS WaitStatus
);
Method code M_KOTHREAD_GET_PRIORITY_INFO
typedef struct _KTHRED_PRIORITY_INFO {
UCHAR BasePriority;
UCHAR DecrementCount;
UCHAR PriorityDecrement;
UCHAR Quantum;
} KTHRED_PRIORITY_INFO, *PKTHRED_PRIORITY_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKTHRED_PRIORITY_INFO PriorityInfo
);
Method code M_KOTHREAD_GET_ CONTEXT_INFO
typedef struct _KTHRED_CONTEXT_INFO {
UCHAR NextProcessor;
ULONG ContextSwitches;
} KTHRED_CONTEXT_INFO, *PKTHRED_CONTEXT_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKTHRED_CONTEXT_INFO ContextInfo
);
Method code M_KOTHREAD_IS_ALERTABLE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PBOOL IsAlertable
);
Method code M_KOTHREAD_IS_KERNEL_STACK_RESIDENT
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PBOOL IsResident
);
Method code M_KOTHREAD_ENUM_WAITBLOCK
typedef struct _KTHRED_WAIT_BLOCK {
UINT_PTR Thread;
UINT_PTR Object;
USHORT WaitKey;
USHORT WaitType;
} KTHRED_WAIT_BLOCK, *PKTHRED_WAIT_BLOCK;
typedef
UINT32
(CALLBACK *PKOTHRED_ENUM_WAITBLOCK_CALLBACK)(
IN UINT_PTR WaitBlockItemAddress,
IN PKTHRED_WAIT_BLOCK WaitBlock,
PVOID Context
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PKOTHRED_ENUM_WAITBLOCK_CALLBACK Callback,
PVOID Context
);
Table of Contents Ý
Method code M_KOWBLOCK_GET_WAIT_OBJECT
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR WaitObjectAddr
);
Table of Contents Ý
Method code M_KOPROC_GET_BASIC_INFO
typedef enum {
InMemory,
OutOfMemory,
InTransition
} KPROC_STATE;
typedef struct _KPROC_BASIC_INFO {
UINT32 BasePriority;
KPROC_STATE State;
} KPROC_BASIC_INFO, * PKPROC_BASIC_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKPROC_BASIC_INFO BasicInfo
);
Method code M_KOPROC_GET_OBJECT_DIR
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR ObjectDirAddr
);
Method code M_KOPROC_GET_TIME_INFO
typedef struct _KPROC_TIME_INFO {
ULONG32 KernelTime;
ULONG32 UserTime;
} KPROC_TIME_INFO, *PKPROC_TIME_INFO;
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKPROC_TIME_INFO TimeInfo
);
Method code M_KOPROC_GET_QUANTUM
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR Quantum
);
Method code M_KOPROC_ENUM_THREADS
typedef
UINT32
(CALLBACK * PKOPROC_ENUM_THREAD_CALLBACK)(
IN UINT_PTR ThreadAddress,
PVOID Context
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PKOPROC_ENUM_THREAD_CALLBACK Callback,
PVOID Context
);
Method code M_KOPROC_IS_VDM_PROCESS
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PBOOL IsVdmProcess
);
Table of Contents Ý
KernelObject\Queue — kernel queue objects (KQUEUE structure)
KernelObject\DeviceQueue — kernel device queue object (KDEVICE_QUEUE structure)
KernelObject\DeviceQueueEntry — entry on device queue (KDEVICE_QUEUE_ENTRY structure)
KernelObject\Profile — kernel profile object (KPROFILE structure)
KernelObject\ActiveProfileSource —KACTIVE_PROFILE_SOURCE structure
KernelObject\Interrupt —kernel interrupt object (KINTERRUPT structure)
Table of Contents Ý
Method code M_KOQUEUE_GET_CURRENT_TOP
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR TopObjectAddr
);
Method code M_KOQUEUE_GET_SIGNAL_STATE
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT32 SignalState
);
Table of Contents Ý
Method code M_KODEVQ_GET_CURRENT_TOP
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT32 TopAddr
);
Method code M_KODEVQ_GET_CURRENT_TOP_BY_KEY
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
UINT32 Key,
OUT PBOOL Found,
OUT PUINT_PTR TopAddr
);
Method code M_KODEVQ_IS_BUSY
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PBOOL IsBusy
);
Method code M_KODEVQ_ENUM_ENTRIES
typedef
UINT32
(CALLBACK * PKMISC_ENUM_DEVQENTRY_CALLBACK)(
IN UINT_PTR KDevQEntryAddress,
PVOID Context
);
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PKMISC_ENUM_DEVQENTRY_CALLBACK EnumCallback,
IN OUT PVOID Context
);
Table of Contents Ý
Method code M_KODEVQENTRY_GET_KEY
BOOL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT32 Key
);
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
Method code M_KOINTERRUPT_GET_VECTOR
typedef struct _KMISC_INTERRUPT_VECTOR_INFO {
ULONG32 Vector;
BOOL Shared;
BOOL Connected;
} KMISC_INTERRUPT_VECTOR_INFO, *PKMISC_INTERRUPT_VECTOR_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKMISC_INTERRUPT_VECTOR_INFO VectorInfo
);
Method code M_KOINTERRUPT_GET_SERVICE_ROUTINE
typedef struct _KMISC_SERVICE_ROUTINE_INFO {
UINT_PTR RoutineAddress;
UINT_PTR ContextAddress;
UINT_PTR DispatchAddress;
} KMISC_SERVICE_ROUTINE_INFO, *PKMISC_SERVICE_ROUTINE_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKMISC_SERVICE_ROUTINE_INFO ServiceRoutineInfo
);
Method code M_KOINTERRUPT_GET_IRQL
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT32 Irql,
OUT PUINT32 SyncronizeIrql
);
Method code M_KOINTERRUPT_GET_INTERRUPT_MODE
typedef enum {
LevelSensitive,
Latched
} KMISC_INTERRUPT_MODE;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PKMISC_INTERRUPT_MODE InterruptMode
);
Table of Contents Ý
KernelObject\Apc — kernel APC object (KAPC structure)
KernelObject\KAPC_STATE — kernel KAPC_STATE structure
KernelObject\Dpc — kernel DPC object (KDPC structure)
Table of Contents Ý
Method code M_KOAPC_GET_APCMODE
typedef enum {
KernelMode,
UserMode,
MaximumMode
} KAPCDPC_PROCESSOR_MODE;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
KAPCDPC_PROCESSOR_MODE *ProcessorMode
);
Method code M_KOAPC_GET_KTHREAD
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR KThreadAddr
);
Method code M_KOAPC_GET_KKERNELROUTINE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR KernelRoutineAddr
);
Method code M_KOAPC_GET_KRUNDOWNROUTINE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR RundownRoutineAddr
);
Method code M_KOAPC_GET_KNORMALROUTINE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR NormalRoutineAddr
);
Table of Contents Ý
Method code M_KOAPCSTATE_GET_KPROCESS
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR KProcessAddr
);
Table of Contents Ý
Method code M_KODPC_GET_DEFERREDCONTEXT
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PVOID *DeferredContext
);
Method code M_KODPC_GET_KDEFERREDROUTINE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR DeferredRoutineAddr
);
Table of Contents Ý
KernelObject\Event — kernel event object (KEVENT structure)
KernelObject\Mutant — kernel mutant/mutex object (KMUTANT/KMUTEX structure)
KernelObject\Semaphore — kernel semaphore object (KSEMAPHORE structure)
KernelObject\EventPair — kernel event pair object (KEVENT_PAIR structure)
Table of Contents Ý
Method code M_KOEVENT_GET_SIGNALSTATE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG SignalState
);
Table of Contents Ý
Method code M_KOMUTANT_GET_SIGNALSTATE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG SignalState
);
Method code M_KOMUTANT_GET_OWNER_THREAD
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR OwnerThreadAddr
);
Table of Contents Ý
Method code M_KOSEMAPHORE_GET_SIGNALSTATE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG SignalState
);
Method code M_KOSEMAPHORE_GET_LIMIT
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PULONG32 Limit
);
Table of Contents Ý
Method code M_KOEVENTPAIR_GET_EVENT_LOW
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR EventLowAddr
);
Method code M_KOEVENTPAIR_GET_EVENT_HIGH
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR EventHighAddr
);
Table of Contents Ý
KernelObject\Timer — kernel timer object (KTIMER structure)
Table of Contents Ý
Method code M_KOTIMER_GET_DUETIME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
ULARGE_INTEGER *DueTime
);
Method code M_KOTIMER_GET_DPC
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR DpcAddr
);
Method code M_KOTIMER_GET_SIGNALSTATE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG SignalState
);
Method code M_KOTIMER_GET_PERIOD
This method is not applicable to Windows NT 3.51.
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG Period
);
Table of Contents Ý
Root\UserModeArea —
Root\BootSystemArea —
Root\SystemMappedViewsArea —
Root\SystemMappedViewsFreeArea —
Root\PageTableArea —
Root\HyperSpaceArea —
Root\SystemCacheWorkingSetListArea —
Root\SystemCacheArea —
Root\CrashDumpVaArea —
Root\HalsHeapArea —
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
Processor\ControlRegion — processor control region (PCR)
Processor\ControlBlock — processor control block (PRCB)
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
Root\NonPagedSystemArea —
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
Root\NonPagedPoolMustSucceedArea —
Root\NonPagedPoolInitialArea —
Root\NonPagedPoolExpansionArea —
Root\PagedPoolArea —
MmPool\PagedPool —
MmPool\PagedPool\FreePages —
MmPool\NonPagedPool —
MmPool\NonPagedPool\FreePages —
MmPool\NonPagedPool\MappedToKseg0 —
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
ListEntry\ListHead\* — LIST_ENTRY list head
ListEntry\ListEntry\* — LIST_ENTRY node
Table of Contents Ý
Method code M_LIST_HEAD_GET_BASIC_INFO
typedef struct _LIST_HEAD_BASIC_INFO {
UINT_PTR Flink;
UINT_PTR Blink;
ULONG Hint;
ULONG NumberOfFlink;
ULONG NumberOfBlink;
UINT_PTR Bad1; //Flink
UINT_PTR Bad2; //Flink last
UINT_PTR Bad3; //Blink last
UINT_PTR Bad4; //Blink
} LIST_HEAD_BASIC_INFO, *PLIST_HEAD_BASIC_INFO;
#define LIST_HEAD_HINT_GOOD_LINKS 0
#define LIST_HEAD_HINT_CORRUPT_BAD2_BLINK 1
#define LIST_HEAD_HINT_CORRUPT_BAD1_FLINK 2
#define LIST_HEAD_HINT_CORRUPT_BAD2_FLINK_AND_BLINK 3
#define LIST_HEAD_HINT_CORRUPT_MORE 4
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLIST_HEAD_BASIC_INFO BasicInfo
);
Method code M_LIST_HEAD_GET_LINKED_ENTRIES
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
BOOL IsFLink,
IN ULONG32 NumberOfEntries,
OUT PKA_ITEM_ID EntryIdArray
);
Table of Contents Ý
Method code M_LIST_ENTRY_GET_BASIC_INFO
typedef struct _LIST_ENTRY_BASIC_INFO {
UINT_PTR Flink;
UINT_PTR Blink;
KA_ITEM_ID HeadId;
} LIST_ENTRY_BASIC_INFO, *PLIST_ENTRY_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLIST_ENTRY_BASIC_INFO BasicInfo
);
Table of Contents Ý
SList\SListHead\* — S-List head
SList\SListEntry\* — entry on S-List
Table of Contents Ý
Method code M_SLIST_HEAD_GET_BASIC_INFO
typedef struct _SLIST_HEAD_BASIC_INFO {
UINT_PTR Next;
ULONG Hint;
ULONG NumberOfFlink;
UINT_PTR Bad1; //Flink
UINT_PTR Bad2; //Flink last
} SLIST_HEAD_BASIC_INFO, *PSLIST_HEAD_BASIC_INFO;
#define SLIST_HEAD_HINT_GOOD_LINKS 0
#define SLIST_HEAD_HINT_CORRUPT_LINKS 1
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PSLIST_HEAD_BASIC_INFO BasicInfo
);
Method code M_SLIST_HEAD_GET_LINKED_ENTRIES
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
ULONG32 NumberOfEntries,
OUT PKA_ITEM_ID EntryIdArray
);
Table of Contents Ý
Method code M_SLIST_ENTRY_GET_BASIC_INFO
typedef struct
_SLIST_ENTRY_BASIC_INFO {
UINT_PTR Next;
UINT_PTR Previous;
KA_ITEM_ID HeadId;
} SLIST_ENTRY_BASIC_INFO, *PSLIST_ENTRY_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PSLIST_ENTRY_BASIC_INFO BasicInfo
);
Table of Contents Ý
Module\Header — kernel mode module image header
Module\Code — kernel mode module code section
Module\Data — kernel mode module data section
Loader\LdrDataTable — loaded kernel mode module list
Table of Contents Ý
Method code M_MDHEAD_GET_IMAGE_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR ImageName
);
Method
code M_MDHEAD_GET_BUILD_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR ActualName
);
Method
code M_MDHEAD_GET_IMAGE_SIZE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
SIZE_T *Size
);
Method
code M_MDHEAD_GET_TIME_DATE_STAMP
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
SYSTEMTIME *SystemTime,
OUT PULONG32 TimeDateStamp
);
Method
code M_MDHEAD_GET_CHECKSUM
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG32 Checksum
);
Method
code M_MDHEAD_GET_DOS_HEADER
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PIMAGE_DOS_HEADER DosHeader,
IN SIZE_T DosHeaderBufferSizeBytes,
OUT SIZE_T *DosHeaderSize
);
Method
code M_MDHEAD_GET_NT_HEADERS
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PIMAGE_NT_HEADERS NtHeaders,
IN SIZE_T NtHeadersBufferSizeBytes,
OUT SIZE_T *NtHeaderSize
);
Method
code M_MDHEAD_ENUM_SECTION_HEADERS
typedef
UINT32
(CALLBACK *PMD_ENUM_SECTION_HEADER_CALLBACK)(
IN PIMAGE_SECTION_HEADER SectionHeader,
PVOID Context
);
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
PMD_ENUM_SECTION_HEADER_CALLBACK Callback,
PVOID Context
);
Table of Contents Ý
Method code M_MDSECT_GET_SECTION_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR NameBuffer
);
Method code M_MDSECT_GET_ATTRIBUTE
typedef enum {
InitializedData,
UninitializedData,
Code
} MD_SECT_TYPE;
typedef struct _MD_SECT_ATTRIB {
BOOL Writable;
BOOL Readable;
BOOL Executable;
BOOL Pageable;
MD_SECT_TYPE SectionType;
} MD_SECT_ATTRIB, *PMD_SECT_ATTRIB;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PMD_SECT_ATTRIB Attribute
);
Method code M_MDSECT_GET_MODULE_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR NameBuffer
);
Method code M_MDSECT_GET_SECTION_HEADER
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PIMAGE_SECTION_HEADER ImageSectionHeader
);
Table of Contents Ý
This data item type has no method interfaces.
Table of Contents Ý
ObjectTable\ObjectHeader — object table object header
ObjectTable\ObjectHandleTable — object table handle table
ObjectTable\TypeObject — object in object table
ObjectTable\DirectoryObject — directory object
ObjectTable\SymbolicLinkObject — symbolic link object
Table of Contents Ý
Method code M_OBJECTTABLE_HDR_GET_OBJECT_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR NameBuffer,
OUT SIZE_T *CharsWrittenIntoBuffer
);
Method code M_OBJECTTABLE_HDR_GET_OBJECT_TYPE_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR NameBuffer,
OUT SIZE_T *CharsWrittenIntoBuffer
);
Method code M_OBJECTTABLE_HDR_GET_QUOTA_INFO
typedef struct OBJECTTABLE_HDR_QUOTA_INFO {
ULONG PagedPoolCharge;
ULONG NonPagedPoolCharge;
ULONG SecurityDescriptorCharge;
UINT_PTR
ExclusiveProcessAddr;
} OBJECTTABLE_HDR_QUOTA_INFO, *POBJECTTABLE_HDR_QUOTA_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
POBJECTTABLE_HDR_QUOTA_INFO QuotaInfo
);
Method code M_OBJECTTABLE_HDR_ENUM_OWNER_PROCESSES
typedef
UINT32
(CALLBACK *POBJECTTABLE_HDR_ENUM_OWNER_PROCESSES_PROC)(
IN UINT_PTR OwnerEProcessAddr,
PVOID Context
);
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
POBJECTTABLE_HDR_ENUM_OWNER_PROCESSES_PROC Callback,
PVOID Context
);
Method code M_OBJECTTABLE_HDR_GET_FLAGS
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
UCHAR *Flags
);
Method code M_OBJECTTABLE_HDR_GET_PROBE_MODE
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
CCHAR *Mode
);
Method code M_OBJECTTABLE_HDR_GET_CREATOR_PROCESS
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PHANDLE ProcessHandle
);
Method code M_OBJECTTABLE_HDR_GET_POINTER_COUNT
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG PointerCount
);
Method code M_OBJECTTABLE_HDR_GET_HANDLE_COUNT
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLONG HandleCount
);
Method code M_OBJECTTABLE_HDR_GET_OBJECT_BODY
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR ObjectBodyAddr
);
Method code M_OBJECTTABLE_HDR_GET_PARENT_DIRECTORY
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR ParentDirectoryAddr
);
Table of Contents Ý
Method code M_OBJECTTABLE_HTB_GET_OWNER_PROCESS
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR OwnerEProcessAddr
);
Method code M_OBJECTTABLE_HTB_GET_TABLE_ENTRY_COUNT
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PULONG32 TableEntryCount
);
Method code M_OBJECTTABLE_HTB_ENUM_OBJECTS
typedef
UINT32
(CALLBACK *OBJECTTABLE_HTB_ENUM_OBJECTS_PROC)(
IN UINT_PTR Handle,
IN UINT_PTR ObjectBodyAddr,
PVOID Context
);
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
OBJECTTABLE_HTB_ENUM_OBJECTS_PROC Callback,
PVOID Context
);
Table of Contents Ý
Method code M_OBJECTTABLE_TYP_GET_TYPE_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR NameBuffer,
OUT SIZE_T *CharsWrittenIntoBuffer
);
Method code M_OBJECTTABLE_TYP_GET_STATISTICAL_INFO
typedef struct _OBJECTTABLE_TYP_STATISTICAL_INFO {
ULONG TotalNumberOfObjects;
ULONG TotalNumberOfHandles;
ULONG HighWaterNumberOfObjects;
ULONG HighWaterNumberOfHandles;
} OBJECTTABLE_TYP_STATISTICAL_INFO, *POBJECTTABLE_TYP_STATISTICAL_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
POBJECTTABLE_TYP_STATISTICAL_INFO Statistics
);
Table of Contents Ý
Method code M_OBJECTTABLE_DIR_GET_DIRECTORY_ENTRY_COUNT
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PULONG32 Count
);
Method code M_OBJECTTABLE_DIR_ENUM_OBJECTS
typedef
UINT32
(CALLBACK *OBJECTTABLE_DIR_ENUM_OBJECTS_PROC)(
IN UINT_PTR ObjectBodyAddr,
PVOID Context
);
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
OBJECTTABLE_DIR_ENUM_OBJECTS_PROC Count,
PVOID Context
);
Table of Contents Ý
Method code M_OBJECTTABLE_SYM_GET_LINK_TARGET_NAME
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
SIZE_T BufferSizeChars,
OUT LPWSTR NameBuffer,
OUT SIZE_T *CharsWrittenIntoBuffer
);
Method code M_OBJECTTABLE_SYM_GET_LINK_TARGET_OBJECT
This method is not applicable to Windows NT 3.51.
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PUINT_PTR LinkTargetObjectAddr
);
Table of Contents Ý
PoolBlock\PoolHeader — header for a pool block
PoolBlock\Paged — allocated block of paged pool
PoolBlock\NonPaged — allocated block of non-paged pool
PoolBlock\Paged\FreedBlock — freed block of paged pool
PoolBlock\NonPaged\FreedBlock — freed block of non-paged pool
PoolControl\PoolDescriptor — POOL_DESCRIPTOR structure
The KA_POOL_TYPE enumerated type is common to several data item type method interfaces and so is described here.
typedef enum _KA_POOL_TYPE {
KaNonPagedPool,
KaNonPagedPoolMustSucceed,
KaPagedPool,
KaFreedPool,
KaUnknownPool
} KA_POOL_TYPE;
Table of Contents Ý
Method code M_POOL_HEAD_GET_BASIC_INFO (supported by PoolBlock\PoolHeader):
typedef struct _POOL_HEAD_BASIC_INFO {
KA_POOL_TYPE PoolType;
ULONG32 PoolIndex;
ULONG32 BlockNum;
ULONG32 PreviousBlockNum;
ULONG32 PoolTag;
BOOL ProtectedTag;
BOOL Quota;
UINT_PTR QuotaProcess;
} POOL_HEAD_BASIC_INFO, *PPOOL_HEAD_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PPOOL_HEAD_BASIC_INFO BasicInfo
);
Method code M_POOL_BLOCK_GET_BASIC_INFO (supported by PoolBlock\Paged, PoolBlock\NonPaged, PoolBlock\Paged\FreedBlock, and PoolBlock\NonPaged\FreedBlock):
typedef struct _POOL_BLOCK_BASIC_INFO {
KA_ITEM_ID PoolHead;
} POOL_BLOCK_BASIC_INFO, *PPOOL_BLOCK_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PPOOL_BLOCK_BASIC_INFO BasicInfo
);
Table of Contents Ý
Method code M_POOL_DESCRIPTOR_GET_BASIC_INFO
typedef struct _POOL_DESCRIPTOR_BASIC_INFO {
KA_POOL_TYPE PoolType;
ULONG PoolIndex;
ULONG AllocCounts;
ULONG FreeCounts;
ULONG TotalAllocPages;
ULONG TotalAllocBigPages;
ULONG NumberOfFreeBlockIndex;
} POOL_DESCRIPTOR_BASIC_INFO, *PPOOL_DESCRIPTOR_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PPOOL_DESCRIPTOR_BASIC_INFO BasicInfo
);
Method code M_POOL_DESCRIPTOR_GET_FREE_BLOCK_INFO
typedef struct _POOL_DESCRIPTOR_FREE_BLOCK_INFO {
KA_ITEM_ID FreeListHead;
} POOL_DESCRIPTOR_FREE_BLOCK_INFO, *PPOOL_DESCRIPTOR_FREE_BLOCK_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
IN
ULONG Index,
OUT
PPOOL_DESCRIPTOR_FREE_BLOCK_INFO BlockInfo
);
Table of Contents Ý
LookasideList\General — system memory lookaside lists
LookasideList\SmallPool — lookaside lists for small pool blocks
Table of Contents Ý
Method code M_LOOKASIDE_GENERAL_BASIC_INFO
typedef struct _LOOKASIDE_GENERAL_BASIC_INFO {
KA_POOL_TYPE PoolType;
ULONG PoolTag;
ULONG BlockSize;
ULONG CurrentDepth;
ULONG MaximumDepth;
ULONG TotalAllocates;
ULONG AllocateMisses;
ULONG TotalFrees;
ULONG FreeMisses;
UINT_PTR AllocateFunction;
UINT_PTR FreeFunction;
KA_ITEM_ID SListHead;
} LOOKASIDE_GENERAL_BASIC_INFO, *PLOOKASIDE_GENERAL_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLOOKASIDE_GENERAL_BASIC_INFO BasicInfo
);
Table of Contents Ý
Method code M_LOOKASIDE_SMALLPOOL_BASIC_INFO
typedef struct _LOOKASIDE_SMALLPOOL_BASIC_INFO {
KA_POOL_TYPE PoolType;
ULONG BlockSize;
ULONG CurrentDepth;
ULONG MaximumDepth;
ULONG TotalAllocates;
ULONG AllocateMisses;
ULONG TotalFrees;
ULONG FreeMisses;
KA_ITEM_ID SListHead;
} LOOKASIDE_SMALLPOOL_BASIC_INFO, *PLOOKASIDE_SMALLPOOL_BASIC_INFO;
KANALYZE_CALL_METHOD_ROUTINE(
IN HKAPLUGIN hPlugIn,
IN KA_ITEM_ID ItemId,
IN ULONG32 MethodCode,
OUT
PLOOKASIDE_SMALLPOOL_BASIC_INFO BasicInfo
);
Table of Contents Ý