Kernel Memory Space Analyzer — Plug-In Reference (Phase 3)

 

Last Updated: 12/25/99

 


1.     Stop Code Analysis Plug-In. 3

1.1       Specific Stop Codes. 3

1.1.1        Stop 0A (IRQL_NOT_LESS_OR_EQUAL) 3

1.1.2        Stop 1E (KMODE_EXCEPTION_NOT_HANDLED) 3

1.1.3        Stop 49 (PAGE_FAULT_WITH_INTERRUPTS_OFF) 3

1.1.4        Stop 50 (PAGE_FAULT_IN_NONPAGED_AREA) 3

1.1.5        Stop 7F (UNEXPECTED_KERNEL_MODE_TRAP) 3

1.2       Driver Verifier Stop Codes. 3

1.2.1        Stop BE (ATTEMPTED_WRITE_TO_READONLY_MEMORY) 3

1.2.2        Stop C1 (SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION) 3

1.2.3        Stop C2 (BAD_POOL_CALLER) 3

1.2.4        Stop C4 (DRIVER_VERIFIER_DETECTED_VIOLATION) 3

1.2.5        Stop C5 (DRIVER_CORRUPTED_EXPOOL) 3

1.2.6        Stop C6 (DRIVER_CAUGHT_MODIFYING_FREED_POOL) 3

1.2.7        Stop C7 (TIMER_OR_DPC_INVALID) 3

1.2.8        Stop C9 (DRIVER_VERIFIER_IOMANAGER_VIOLATION) 3

1.2.9        Stop CB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) 3

1.2.10      Stop CC (PAGE_FAULT_IN_FREED_SPECIAL_POOL) 3

1.2.11      Stop CD (PAGE_FAULT_BEYOND_END_OF_ALLOCATION) 3

1.2.12      Stop CE (DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS) 3

1.2.13      Stop CF (TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE) 3

1.2.14      Stop D0 (DRIVER_CORRUPTED_MMPOOL) 3

1.2.15      Stop D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) 3

1.2.16      Stop D3 (DRIVER_PORTION_MUST_BE_NONPAGED) 3

1.2.17      Stop D4 (SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD) 3

1.2.18      Stop D5 (DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL) 3

1.2.19      Stop D6 (DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION) 3

1.2.20      Stop D8 (DRIVER_USED_EXCESSIVE_PTES) 3

1.3       Generic Stop Code Processing. 3

1.3.1        Generic Stop Code Classes. 3

1.3.2        Generic Stop Code Analysis And Db Matching. 3

2.     Base Plug-In Types and Method Interfaces. 3

2.1       EXECUTIVEOBJECT. 3

2.1.1        ExecutiveObject\EventPair 3

2.1.2        ExecutiveObject\Profile. 3

2.1.3        ExecutiveObject\Timer 3

2.1.4        ExecutiveObject\ControllerObject 3

2.1.5        ExecutiveObject\FileObject 3

2.1.6        ExecutiveObject\Process. 3

2.1.7        ExecutiveObject\Thread. 3

2.1.8        ExecutiveObject\WindowStation. 3

2.2       IO.. 3

2.2.1        Io\IRP. 3

2.2.2        Io\DEVICE_OBJECT. 3

2.2.3        Io\DRIVER_OBJECT. 3

2.2.4        Io\DEVICE_EXTENSION\Class. 3

2.2.5        Io\DEVICE_EXTENSION\Class2. 3

2.2.6        Io\DEVICE_EXTENSION\ScsiPort 3

2.3       KERNELPROCTHRD.. 3

2.3.1        KernelObject\Thread. 3

2.3.2        KernelObject\WaitBlock. 3

2.3.3        KernelObject\Process. 3

2.4       KERNELMISCOBJ. 3

2.4.1        KernelObject\Queue. 3

2.4.2        KernelObject\DeviceQueue. 3

2.4.3        KernelObject\DeviceQueueEntry. 3

2.4.4        KernelObject\Profile. 3

2.4.5        KernelObject\ActiveProfileSource. 3

2.4.6        KernelObject\Interrupt 3

2.5       KERNELAPCDPC.. 3

2.5.1        KernelObject\Apc. 3

2.5.2        KernelObject\KAPC_STATE. 3

2.5.3        KernelObject\Dpc. 3

2.6       KERNELSYNC.. 3

2.6.1        KernelObject\Event 3

2.6.2        KernelObject\Mutant 3

2.6.3        KernelObject\Semaphore. 3

2.6.4        KernelObject\EventPair 3

2.7       KERNELTIMER.. 3

2.7.1        KernelObject\Timer 3

2.8       VIRTUALMEMORY.. 3

2.8.1        Root\UserModeArea. 3

2.8.2        Root\BootSystemArea. 3

2.8.3        Root\SystemMappedViewsArea. 3

2.8.4        Root\SystemMappedViewsFreeArea. 3

2.8.5        Root\PageTableArea. 3

2.8.6        Root\HyperSpaceArea. 3

2.8.7        Root\SystemCacheWorkingSetListArea. 3

2.8.8        Root\SystemCacheArea. 3

2.8.9        Root\CrashDumpVaArea. 3

2.8.10      Root\HalsHeapArea. 3

2.9       PCR.. 3

2.9.1        Processor\ControlRegion. 3

2.9.2        Processor\ControlBlock. 3

2.10     MMSYS. 3

2.10.1      Root\NonPagedSystemArea. 3

2.11     MMPOOL. 3

2.11.1      Root\NonPagedPoolMustSucceedArea. 3

2.11.2      Root\NonPagedPoolInitialArea. 3

2.11.3      Root\NonPagedPoolExpansionArea. 3

2.11.4      Root\PagedPoolArea. 3

2.11.5      MmPool\PagedPool 3

2.11.6      MmPool\PagedPool\FreePages. 3

2.11.7      MmPool\NonPagedPool 3

2.11.8      MmPool\NonPagedPool\FreePages. 3

2.11.9      MmPool\NonPagedPool\MappedToKseg0. 3

2.12     LIST. 3

2.12.1      ListEntry\ListHead\*. 3

2.12.2      ListEntry\ListEntry\*. 3

2.13     SLIST. 3

2.13.1      SList\SListHead\*. 3

2.13.2      SList\SListEntry\*. 3

2.14     MODULE. 3

2.14.1      Module\Header 3

2.14.2      Module\Code, Module\Data. 3

2.14.3      Loader\LdrDataTable. 3

2.15     OBJECTTABLE. 3

2.15.1      ObjectTable\ObjectHeader 3

2.15.2      ObjectTable\ObjectHandleTable. 3

2.15.3      ObjectTable\TypeObject 3

2.15.4      ObjectTable\DirectoryObject 3

2.15.5      ObjectTable\SymbolicLinkObject 3

2.16     EXPOOL. 3

2.16.1      PoolBlock Types. 3

2.16.2      PoolControl\PoolDescriptor 3

2.17     LOOKASIDE. 3

2.17.1      LookasideList\General 3

2.17.2      LookasideList\SmallPool 3

 


1.      Stop Code Analysis Plug-In

This section describes the analysis that is performed by the stop-code analysis plug-in, including the processing that occurs for each handled stop code.

 

The stop-code plug-in is dependent upon the stop code of the crash dump in determining how to analyze it. Each stop code type has specific basic steps to follow in gathering data that uniquely identifies the crash dump and data that will assist in determining the cause of the crash. Each stop code may also require some further specialized analysis steps, but for Phase 3, just the general case of each stop code type is handled. The stop-code plug-in divides stop codes into 3 general categories:

 

1)      The specific category includes certain specific stop code cases that are singled out for special attention. For phase 3, these are stop 0A, 1E, 49, 50, and 7F.

2)      The driver verifier category includes all the driver-verifier stop code cases.

3)      The generic category includes stop codes that are not in the specific or driver verifier category.
 

The following sections describe the analysis for each of these categories.

 

Note that in the database and signature id file, all canonicalized  stop code parameters are stored as multi-byte strings; all numbers are in hex; and hex numbers such as offsets are separated from other text such as module names by “!” characters.

 

Table of Contents Ý

 

1.1      Specific Stop Codes

For phase 3, stop code analysis focuses on stop 0A, 1E, 49, 50, and 7F. These represent the bulk of reported crashes and therefore focusing on these provides reasonable coverage for phase 3 kanalyze. The sections that follow describe the processing for each of these bugchecks, including

 

·        Steps that are taken at various points in kanalyze’s flow and the analysis performed;

·        Canonicalization performed on the bugcheck parameters;

·        Data placed into the signature id file.

 

Table of Contents Ý

 

1.1.1    Stop 0A (IRQL_NOT_LESS_OR_EQUAL)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass and Variable data accordingly

 

SigId CrashClass Item

Data

Stop-Code

0x0A

Param1

Pool Info

Param2***

Module name from KiBugCheckDriver

Param3

Nil

Param4

Relevant Module name & offset

Keyword1*

Relevant Routine name & offset

Keyword2*

Secondary Module – From call stack, get the Module name & Offset called before the above routine for match purposes

Keyword3**

1)      Secondary Routine - From call stack, get the Routine name & Offset called before the above routine for match purposes

 

2)      For special 0A case if (Param1 == Param3) && !=0, this will contain the Worker module name and offset.

Keyword4**

1)      Next Module and offset – From call stack get next Module name that is not the same as the Relevant or Secondary module name for match purposes. If not present, set to Nil.

 

2)      For special 0A case, this will contain the Worker routine address and offset.

 

 

SigId Variable CrashData

Data

Call Stack*

 

 

* This data is only available if the correct symbol debug file is present.

** This only occurs for a Special case where (Param-1 == Param-3) AND ! = ZERO.

*** If available

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query with the AddClausesCallback function:

 

            (Stop-Code == StopCode) AND (Param4 == ModuleName!Offset)

 

KA_DB_PROCESS_CLASS

 

For each CrashClass to be processed from the query result, it will make the following MatchLevel checks. Because the Module and Module offset have matched, MatchLevel = MatchWeak to start with.

 

1.      If Relevant Routine Name and Offset equal, set MatchLevel=MatchFair.

2.      If Secondary Module Name and Offset equal, set MatchLevel=MatchGood.

3.      If Param1 equal, set MatchLevel=MatchGood

4.      If Next Module Name and Offset equal, set MatchLevel= MatchAbsolute

5.      If Worker Module and offset equals, set MatchLevel=MatchFair**

6.      If Secondary routine offset equals, set MatchLevel=MatchGood**

7.      If Param2 equals, set MatchLevel=MatchGood

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.1.2    Stop 1E (KMODE_EXCEPTION_NOT_HANDLED)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly

 

SigID CrashClass Item

Data

Stop-Code

0x1E

Param-1

Exception code

Param-2

Relevant module name & offset

Param-3

Nil

Param-4

Nil

Keyword1*

Relevant Routine name & offset

Keyword2

Secondary Module – From call stack, get the Module name & Offset called before the above routine for match purposes

Keyword3*

Secondary Routine - From call stack, get the Routine name & Offset called before the above routine for match purposes.

Keyword4

Next Module and offset – From call stack get next Module name that is not the same as the Relevant or Secondary module name for match purposes.  If not present, set to Nil.

 

SigId Variable CrashData

Data

Call Stack*

 

* This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query with the AddClausesCallback function:

 

            (Stop-Code = 1E) AND (Param2 = ModuleName!Offset).

 

KA_DB_PROCESS_CLASS

 

For each CrashClass to be processed from the query result, it will make the following MatchLevel checks. Because the Module and Module offset have matched, MatchLevel = MatchWeak to start with.

 

1.      If Exception code equal, set MatchLevel=MatchFair

2.      If Relevant Routine Name and Offset equal, set MatchLevel=MatchFair

3.      If Secondary Module Offsets equal, set MatchLevel=MatchGood

4.      If Secondary Routine Name and Offset equal, set MatchLevel=MatchGood

5.      If Next Module Name and Offset equal, set MatchLevel= MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.1.3    Stop 49 (PAGE_FAULT_WITH_INTERRUPTS_OFF)

Handling for this Windows 2000 and later bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).

 

Table of Contents Ý

 

1.1.4    Stop 50 (PAGE_FAULT_IN_NONPAGED_AREA)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

50

Param-1

Pool Info

Param-2

Read or Write

Param-3*

Relevant Module name & Offset

Param-4

Nil

Canonical

TRUE

Keyword1*

Routine name & offset where exception occurred

Keyword2*

Driver name from KiBugCheckDriver

Keyword3

Nil

Keyword4

Nil

 

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == StopCode) AND (Param-3 == ModuleName!Offset)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash. MatchLevel starts off at MatchFair.

 

1.      Param-2 equal, set MatchLevel= MatchGood

2.      If Relevant Routine Name and Offset equal, set MatchLevel= MatchAbsolute

3.      If Driver name from KiBugCheckDriver equal, set MatchLevel= MatchAbsolute

 

* If available

** Routine name can obtain only if the correct symbols are available

 

Table of Contents Ý

 

1.1.5    Stop 7F (UNEXPECTED_KERNEL_MODE_TRAP)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly

 

SigID CrashClass Item

Data

Stop-Code

0x7F

Param-1

Trap Number

Param-2

Nil

Param-3

Nil

Param-4

Nil

Keyword1*

Module Name! Offset

Keyword2*

Relevant Routine name! Offset

Keyword3

Nil

Keyword4

Nil

 

SigId Variable CrashData

Data

Call Stack*

 

* This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query with the AddClausesCallback function:

 

            (Stop-Code = 1E) AND (Keyword1 == ModuleName!Offset)

 

KA_DB_PROCESS_CLASS

 

For each CrashClass to be processed from the query result, it will make the following MatchLevel checks. Because the Module and Module offset have matched, MatchLevel = MatchWeak to start with.

 

1.      If Trap Number equal, set MatchLevel=MatchFair

2.      If Relevant Routine Name and Offset equal, set MatchLevel=MatchGood

3.      If Call Stack  equal, set MatchLevel= MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2      Driver Verifier Stop Codes

Phase 3 kanalyze understands Windows 2000 driver verifier stop codes and their associated bugcheck parameters. Processing is similar to the processing for the specific stop codes. In some cases, a driver verifier bugcheck’s parameters are sufficient to accurately diagnose the problem, meaning that the stop code plug-in will automatically provide solution data.

 

Table of Contents Ý

 

1.2.1    Stop BE (ATTEMPTED_WRITE_TO_READONLY_MEMORY)

Handling for this bugcheck is the same as for Stop CB (DRIVER_LEFT_LOCKED_PAGED_IN_PROCESS).

 

Table of Contents Ý

 

1.2.2    Stop C1 (SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

C1

Param-1

Nil

Param-2

Nil

Param-3

Nil

Param-4

Type of violation

Keyword1*

Module name & offset where exception occurred

Keyword2**

Routine name & offset where exception occurred

Keyword3

Nil

Keyword4

Nil

 

SigId Variable CrashData

Data

Call Stack**

 

*We can get the following data from the stack trace.

**This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query:

 

            (Stop-Code == C1) AND (Keyword-1 == ModuleName & Offset)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchWeak

 

1.      If Relevant Routine Name and Offset equal, set MatchLevel= MatchFair

2.      Type of violation (Param-4) equal, set MatchLevel= MatchGood

3.      If Call stack equal, set MatchLevel=MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.3    Stop C2 (BAD_POOL_CALLER)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

C2

Param-1

Type of violation

Param-2

Nil

Param-3

Nil

Param-4

Nil

Keyword1*

Module name & offset where exception occurred

Keyword2**

Routine name & offset where exception occurred

Keyword3

Nil

Keyword4

Nil

 

SigId Variable CrashData

Data

Call Stack**

 

 

*We can get the following data from the stack trace.

**This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == Stop Code) AND (Keyword1 == ModuleName & Offset)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchWeak

 

1.      If Relevant Routine Name and Offset equal, set MatchLevel=MatchFair

2.      If Param-1 (Type of violation) equal, set MatchLevel=MatchGood

3.      If call stack equal, set MatchLevel=MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.4    Stop C4 (DRIVER_VERIFIER_DETECTED_VIOLATION)

Handling for this bugcheck is the same as for Stop C2 (BAD_POOL_CALLER).

 

Table of Contents Ý

 

1.2.5    Stop C5 (DRIVER_CORRUPTED_EXPOOL)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

C5

Param-1

Pool Info

Param-2

IRQL Level

Param-3

Read or Write

Param-4

Relevant module name and offset

Keyword1*

Routine name & offset where exception occurred

Keyword2

Nil

Keyword3

Nil

Keyword4

Nil

* This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == Stop Code) AND (Param-4 == ModuleName & Offset)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchWeak.

 

1.      If Param-2 (IRQL) equal, set MatchLevel= MatchFair

2.      If Param-3 (Read or Write) equal, set MatchLevel= MatchGood

3.      If Relevant Routine Name and Offset equal, set MatchLevel= MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.6    Stop C6 (DRIVER_CAUGHT_MODIFYING_FREED_POOL)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

C6

Param-1

Pool Info

Param-2

Read or Write

Param-3

Kernel mode or user mode

Param-4

Type

Keyword1

Module name & offset where exception occurred

Keyword2*

Routine name & offset where exception occurred

Keyword3

Nil

Keyword4

Nil

 

SigId Variable CrashData

Data

Call Stack*

 

* This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == C6 ) AND (Keyword-1 == ModuleName & Offset)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at. MatchWeak

 

1.      If Param-2, 3 and 4 equal, set MatchLevel= MatchFair

2.      If Relevant Routine Name and Offset equal, set MatchLevel= MatchGood

3.      If Call Stack equal, set MatchLevel= MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.7    Stop C7 (TIMER_OR_DPC_INVALID)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

C7

Param-1

Timer Object / DPC routine / DPC Object

Param-2

Module Name

Param-3

Nil

Param-4

Nil

Keyword1

Routine Name & Offset

Keyword2

Nil

Keyword3

Nil

Keyword4

Nil

 

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == C7 )  AND (Param-2 == Module Name)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchFair.

 

1.  If Param-1 equal, set MatchLevel=MatchGood

2. If Keyword-1 equal, set MatchLevel=MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.8    Stop C9 (DRIVER_VERIFIER_IOMANAGER_VIOLATION)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

C9

Param-1

Type

Param-2

Nil

Param-3

Nil

Param-4

Exception Code

Canonical

FALSE

Keyword1*

Module name & offset where exception occurred

Keyword2*

Routine name & offset where exception occurred

Keyword3

Nil

Keyword4

Nil

 

SigId Variable CrashData

Data

Call Stack*

 

* This data is only available if the correct symbol debug file is present.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == C9 ) AND (Keyword1 == ModuleName)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchWeak.

 

1.      If Param-1 equal, set MatchLevel=MatchFair

2.      If Keyword1 equal, set MatchLevel=MatchGood

3.      If Call stack equal, set MatchLevel=MatchAbsolute

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.9    Stop CB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS)

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly, so it can match against the KI db for any updated solution data.

 

SigID CrashClass Item

Data

Stop-Code

CB

Param-1

Pool Info If Value is non ZERO

Param-2

Nil

Param-3

Nil

Param-4

Nil

Canonical

FALSE

Keyword1*

Module Name *

Keyword2

Nil

Keyword3

Nil

Keyword4

Nil

 

* If available in KiBugCheckDriver.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == Stop Code) AND (Keyword1 == ModuleName)

 

KA_DB_PROCESS_CLASS

 

Since the error can be determined with this stop code, a solution will also be entered as a data item for this crash in the KA_PROCESS_ANALYSIS phase. MatchLevel starts off at MatchFair.

 

·        If Param-1 equal, set MatchLevel=MatchGood

 

Report MatchLevel back through ReportMatchCallback routine.

 

Table of Contents Ý

 

1.2.10                       Stop CC (PAGE_FAULT_IN_FREED_SPECIAL_POOL)

Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).

 

Table of Contents Ý

 

1.2.11                       Stop CD (PAGE_FAULT_BEYOND_END_OF_ALLOCATION)

Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).

 

Table of Contents Ý

 

1.2.12                       Stop CE (DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS)

Handling for this bugcheck is the same as for Stop CB (DRIVER_LEFT_LOCKED_PAGED_IN_PROCESS).

 

Table of Contents Ý

 

1.2.13                       Stop CF (TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE)

Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).

 

Table of Contents Ý

 

1.2.14                       Stop D0 (DRIVER_CORRUPTED_MMPOOL)

Handling for this bugcheck is the same as for Stop C5 (DRIVER_CORRUPTED_EXPOOL).

 

Table of Contents Ý

 

1.2.15                       Stop D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)

Handling for this bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).

 

Table of Contents Ý

 

1.2.16                       Stop D3 (DRIVER_PORTION_MUST_BE_NONPAGED)

Handling for this bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).

 

Table of Contents Ý

 

1.2.17                       Stop D4 (SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD)

Handling for this bugcheck is the same as for Stop 0A (IRQL_NOT_LESS_OR_EQUAL).

 

Table of Contents Ý

 

1.2.18                       Stop D5 (DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL)

Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).

 

Table of Contents Ý

 

1.2.19                       Stop D6 (DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION)

Handling for this bugcheck is the same as for Stop 50 (PAGE_FAULT_IN_NON_PAGED_AREA).

 

Table of Contents Ý

 

1.2.20                       Stop D8 (DRIVER_USED_EXCESSIVE_PTES)

Handling for this bugcheck is the same as for Stop CB (DRIVER_LEFT_LOCKED_PAGED_IN_PROCESS).

 

Table of Contents Ý

 

1.3      Generic Stop Code Processing

The generic category includes those stop codes that are not included in the other categories, and therefore for which no stop-code specific processing or analysis is performed. Each stop code will be researched to see if a viable solution can be determined from the stop code itself. If so, then the stop code plug-in will add this solution data as a data item so that it can be displayed to the user as part of the kanalyze report.

 

1.3.1    Generic Stop Code Classes

The generic stop codes are divided into 16 classes, depending on which of the parameters in the stop code are felt to be meaningful. The tables below show the how the stop code classes are organized.

 

 

Class

Param-1

Param-2

Param-3

Param-4

0

T

T

T

T

1

T

T

T

R

2

T

T

R

T

3

T

T

R

R

4

T

R

T

T

5

T

R

T

R

6

T

R

R

T

7

T

R

R

R

8

R

T

T

T

9

R

T

T

R

10

R

T

R

T

11

R

T

R

R

12

R

R

T

T

13

R

R

T

R

14

R

R

R

T

15

R

R

R

R

 

 

T– unused parameter

R– valid parameter

 

 

 

Class

Canonical

STOP Codes

Param1

Param2

Param3

Param4

0

Nil

Nil

Nil

Nil

All the stop codes other than those are specified explicitly.

1

 

 

 

 

Nil

2

 

 

Num

 

BAD_POOL_HEADER (0x19)

3

 

 

 

 

Nil

4

 

Num

 

 

KERNEL_DATA_INPAGE_ERROR (0x7A)

 

Num

 

 

ACPI_DRIVER_INTERNAL  (0xA3)

5

 

 

 

 

Nil

6

 

Num

 

Num

KERNEL_APC_PENDING_DURING_EXIT (0x20)

7

 

 

 

 

Nil

8

Num

 

 

 

MEMORY_MANAGEMENT (0x1A)

Num

 

 

 

FAT_FILE_SYSTEM    (0x23)          

Num

 

 

 

NTFS_FILE_SYSTEM  (0x24)

Num

 

 

 

NPFS_FILE_SYSTEM  (0x25)

Num

 

 

 

CDFS_FILE_SYSTEM  (0x26)

Num

 

 

 

RDR_FILE_SYSTEM  (0x27)

Num

 

 

 

UDFS_FILE_SYSTEM (0x9B)

Num

 

 

 

CNSS_FILE_SYSTEM_FILTER (0xA4)

Num

 

 

 

SESSION1_INITIALIZATION_FAILED (0x6D)

Num

 

 

 

SESSION2_INITIALIZATION_FAILED (0x6E)

Num

 

 

 

SESSION3_INITIALIZATION_FAILED (0x6F)

Num

 

 

 

SESSION4_INITIALIZATION_FAILED (0x70)

Num

 

 

 

SESSION5_INITIALIZATION_FAILED (0x71)

9

 

 

 

 

Nil

10

 

 

 

 

Nil

11

 

 

 

 

Nil

12

Num

Num

 

 

MUTEX_LEVEL_NUMBER_VIOLATION (0x0D)

Num

Num

 

 

PHASE1_INITIALIZATION_FAILED (0x32)

Num

Num

 

 

CONFIG_INITIALIZATION_FAILED (0x67)

Num

Num

 

 

PROCESS1_INITIALIZATION_FAILED (0x6B)

Num

Num

 

 

KERNEL_STACK_INPAGE_ERROR (0x77)

13

 

 

 

 

Nil

14

Num

Num

Num

 

MISMATCHED_HAL (0x79)

15

 

 

 

 

Nil

 

Num – Same as the parameter in the Stop-code (x) field.

 

Table of Contents Ý

 

1.3.2    Generic Stop Code Analysis And Db Matching

KA_PERFORM_ANALYSIS

 

This will fill in the SigID CrashClass data accordingly

 

SigId CrashClass Item

Data

Stop-Code

Stop code

Param1

Available for class 8~15

Param2

Available for class 3~7 and 12~15

Param3

Available for class 2,3,6,7,10,11,14,15

Param4

Available for alternate classes starting from 1

Keyword1

Module Name & Offset

Keyword2*

Routine Name & Offset

Keyword3

Next module & Offset

Keyword4*

Next module’s Routine & Offset

 

SigId Variable CrashData

Data

Call Stack *

 

 

* This data is only available if the correct symbol debug file is present.

If the Keyword3 is NULL then CanonicalizationLevel set as CanonLevelMedium.

 

KA_DB_BUILD_QUERY

 

This will build the following KI db query.

 

            (Stop-Code == xx) AND (Keyword1 == yy)

 

KA_DB_PROCESS_CLASS

 

With some stop codes, some data can be provided on the cause and solution for it and this will be reported back.

 

For each CrashClass from the query result, it will make the following match checks.

 

MatchLevel starts off at MatchWeak

 

If Relevant Next Module Name & Offset equal and

       Routine Name & Offset equal, set MatchLevel=MatchFair

If Stop params equal, set MatchLevel=MatchGood

If Call stack matches, set MatchValue=MatchAbsolute

 

Table of Contents Ý

 

2.      Base Plug-In Types and Method Interfaces

The base plug-ins supplied with phase 3 kanalyze are as follows.

 

eobjects.dll — executive objects and object bodies

 

EXECUTIVEOBJECT — executive object bodies for event pairs, profiles, timers, controllers, files, processes, threads, and window stations.

 

kaio.dll — I/O system

 

IO — IRPs, device objects, driver objects, class.sys/class2.sys device extensions, and scsiport.sys device extensions

 

kobjects.dll — kernel objects and related structures

 

KERNELPROCTHRD — kernel thread and process objects and related structures

KERNELMISCOBJ — kernel queue, device queue, profile, and interrupt objects and related structures

KERNELAPCDPC — kernel APC and DPC objects and related structures

KERNELSYNC — kernel event, mutant, semaphore, and event pair objects

KERNELTIMER — kernel timer object

 

memory.dll — kernel-mode memory layout and root containers

 

VIRTUALMEMORY — top-level kernel-mode virtual memory layout

MMPOOL — top-level paged and non-paged pool areas and free pool pages

MMSYS — non-paged system area

PCR — PCRs and PRCBs

SLIST — Slists

LIST — Lists (LIST_ENTRY)

 

module.dll — kernel-mode modules

 

MODULE — loaded modules' headers, and read-only code and data

 

objtbl.dll — object tables

 

OBJECTTABLE — object headers, handle tables, types, directories, and symbolic links

 

pool.dll — pool memory

 

EXPOOL — pool descriptors and blocks

LOOKASIDE — lookaside lists

 

The sections that follow describe these plug-ins in detail, including the data item type names and method interfaces offered by each.

 

Table of Contents Ý

 

2.1      EXECUTIVEOBJECT

ExecutiveObject\EventPair — executive event pair (EEVENT_PAIR structure)

ExecutiveObject\Profile — executive profile object (EPROFILE structure)

ExecutiveObject\Timer — executive timer object (ETIMER structure)

ExecutiveObject\ControllerObject — IO controller object (CONTROLLER_OBJECT structure)

ExecutiveObject\FileObject — IO file object (FILE_OBJECT structure)

ExecutiveObject\Process — executive process object (EPROCESS structure)

ExecutiveObject\Thread — executive thread object (ETHREAD structure)

ExecutiveObject\WindowStation — window station object

 

Table of Contents Ý

 

2.1.1    ExecutiveObject\EventPair

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.1.2    ExecutiveObject\Profile

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.1.3    ExecutiveObject\Timer

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.1.4    ExecutiveObject\ControllerObject

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.1.5    ExecutiveObject\FileObject

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.1.6    ExecutiveObject\Process

Method code M_EOPROCESS_GET_BASIC_INFO

 

#define MAX_IMAGE_NAME_LENGTH 32

typedef struct _EOBJ_PROCESS_BASIC_INFO {
            SIZE_T ProcessId;
            SIZE_T ParentProcessId;
            UINT_PTR PebAddress;
            WCHAR ImageName[MAX_IMAGE_NAME_LENGTH];
} EOBJ_PROCESS_BASIC_INFO, *PEOBJ_PROCESS_BASIC_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_PROCESS_BASIC_INFO BasicInfo
            );

 

 

Method code M_EOPROCESS_GET_HANDLE_TABLE_INFO

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR HandleTableAddress
            );

 

 

Method code M_EOPROCESS_GET_PAGE_INFO

 

typedef struct _EOBJ_PROCESS_PAGE_INFO{
            UINT_PTR VadRoot;
            UINT_PTR CloneRoot;
            UINT_PTR NumberOfPrivatePages;
            UINT_PTR ModifiedPageCount;
            UINT_PTR NumberOfLockedPages;
} EOBJ_PROCESS_PAGE_INFO, * PEOBJ_PROCESS_PAGE_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_PROCESS_PAGE_INFO PageInfo
            );

 

 

Method code M_EOPROCESS_GET_MUTANT

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR MutantAddress
            );

 

 

Method code M_EOPROCESS_GET_LOCKOWNER

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR LockOwnerAddress,
            OUT PUINT_PTR LockCount
            );

 

 

Method code M_EOPROCESS_GET_TIME_INFO

 

typedef struct _EOBJ_PROCESS_TIME_INFO {
            UINT_PTR KernelTime;
            UINT_PTR UserTime;
            UINT_PTR CreationTime;
} EOBJ_PROCESS_TIME_INFO, * PEOBJ_PROCESS_TIME_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_PROCESS_TIME_INFO TimeInfo
            );

 

 

Method code M_EOPROCESS_GET_POOL_USAGE_INFO

 

typedef struct _EOBJ_PROCESS_POOL_USAGE_INFO{
            UINT_PTR PagedPool;
            UINT_PTR NonpagedPool;
} EOBJ_PROCESS_POOL_USAGE_INFO,
*PEOBJ_PROCESS_POOL_USAGE_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_PROCESS_POOL_USAGE_INFO PoolUsageInfo
            );

 

 

Method code M_EOPROCESS_GET_WORKINGSET_INFO

 

typedef struct _EOBJ_PROCESS_WORKINGSET_INFO {
            SIZE_T CurrentSize;
            SIZE_T MinimumSize;
            SIZE_T MaximumSize;
            SIZE_T PeakWorkingSetSize;
} EOBJ_PROCESS_WORKINGSET_INFO, *PEOBJ_PROCESS_WORKINGSET_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_PROCESS_WORKINGSET_INFO WorkingSetInfo
            );

 

 

Method code M_EOPROCESS_GET_VM_INFO

 

typedef struct _EOBJ_PROCESS_VM_INFO {
            SIZE_T VirtualSize;
            SIZE_T PeakVirtualSize;
            SIZE_T PageFaultCount;
            SIZE_T CommitCharge;
} EOBJ_PROCESS_VM_INFO, *PEOBJ_PROCESS_VM_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_PROCESS_VM_INFO VmInfo
            );

 

 

Method code M_EOPROCESS_GET_ACCESS_TOKEN

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR AccessTokenAddress
            );

 

Table of Contents Ý

 

2.1.7    ExecutiveObject\Thread

Method code M_EOTHREAD_GET_BASIC_INFO

 

typedef struct _EOBJ_THREAD_BASIC_INFO {
            SIZE_T OwnerProcessId;
            SIZE_T ThreadId;
            UINT_PTR StartAddress;
            UINT_PTR Win32StartAddress;
} EOBJ_THREAD_BASIC_INFO, * PEOBJ_THREAD_BASIC_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_THREAD_BASIC_INFO BasicInfo
            );

 

 

Method code M_EOTHREAD_GET_LPC_MSG

 

typedef struct _EOBJ_THREAD_LPC_MSG_INFO {
            BOOL ReceivedLpcMsgIdValid;
            UINT_PTR ReceivedLpcMsgId;
            UINT_PTR ReplyLpcMsg;
            UINT_PTR ReplyLpcMsgId;
} EOBJ_THREAD_LPC_MSG_INFO, * PEOBJ_THREAD_LPC_MSG_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_THREAD_LPC_MSG_INFO LpcMsgInfo
            );

 

 

Method code M_EOTHREAD_GET_IMPERSONATION_INFO

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR ImpersonationInfoAddr
            );

 

 

Method code M_EOTHREAD_GET_PERFORMANCE_COUNT_INFO

 

typedef struct _EOBJ_THREAD_PERFORMANCE_COUNT_INFO {
            UINT_PTR PerformanceCountHigh;
            UINT_PTR PerformanceCountLow;
} EOBJ_THREAD_PERFORMANCE_COUNT_INFO,
*PEOBJ_THREAD_PERFORMANCE_COUNT_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PEOBJ_THREAD_PERFORMANCE_COUNT_INFO Info
            );

 

 

Method code M_EOTHREAD_ENUM_IRPS

 

typedef
UINT32
(CALLBACK *PEOBJ_THREAD_ENUM_IRPS_CALLBACK)(
            IN UINT_PTR IrpAddress,
            PVOID Context
            );

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PEOBJ_THREAD_ENUM_IRPS_CALLBACK CallbackProc,
            IN PVOID Context
            );

 

Table of Contents Ý

 

2.1.8    ExecutiveObject\WindowStation

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.2      IO

Io\IRP — IRPs (IRP structure)

Io\DEVICE_OBJECT — device object (DEVICE_OBJECT structure)

Io\DRIVER_OBJECT — driver object (DRIVER_OBJECT structure)

Io\DEVICE_EXTENSION\Class — device extension for class.sys

Io\DEVICE_EXTENSION\Class2 — device extension for class2.sys

Io\DEVICE_EXTENSION\ScsiPort — device extension for scsiport.sys

 

Table of Contents Ý

 

2.2.1    Io\IRP

Method code M_IRP_GET_OWNER_THREAD

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR OwnerThread
            );

 

 

Method code M_IRP_GET_MDL_ADDRESS

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR MdlAddress
            );

 

 

Method code M_IRP_GET_ASSOCIATED_IRP

 

#define MASTER_IRP             1
#define SYSTEM_BUFFER    2
#define IRP_COUNT              3

 

typedef struct _ASSOCIATED_IRP {
            USHORT Flags;
            union {
                        KA_ITEM_ID MasterIrp;
                        UINT_PTR SystemBuffer;
                        LONG IrpCount;
            } Value;
} ASSOCIATED_IRP, *PASSOCIATED_IRP;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PASSOCIATED_IRP AssociatedIrp
            );

 

 

Method code M_IRP_GET_IO_STACK_STATUS

 

typedef struct _IRP_IO_STACK_STATUS {
            CHAR ActiveStacks;
            CHAR CurrentStack;
} IRP_IO_STACK_STATUS, *PIRP_IO_STACK_STATUS;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PIRP_IO_STACK_STATUS IoStackStatus
            );

 

 

Method code M_IRP_ENUM_IO_STACK_INFO

 

typedef struct _IRP_STACK_INFO {
            CHAR StackNum;
            UCHAR MajorFunction;
            UCHAR MinorFunction;
            UCHAR Flags;
            UCHAR Control;
            KA_ITEM_ID DeviceObject;
            KA_ITEM_ID FileObject;
            UINT_PTR CompletionRoutine;
            UINT_PTR Context;
            struct {
                        UINT_PTR Argument1;
                        UINT_PTR Argument2;
                        UINT_PTR Argument3;
                        UINT_PTR Argument4;
            } Param;
} IRP_STACK_INFO, *PIRP_STACK_INFO;

 

typedef
BOOL
(CALLBACK * PIRP_ENUM_IO_STACK_INFO)(
        IN PIRP_STACK_INFO StackInfo,
        IN OUT PVOID MethodContext
        );

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PIRP_ENUM_IO_STACK_INFO Callback,
            PVOID Context
            );

 

Table of Contents Ý

 

2.2.2    Io\DEVICE_OBJECT

Method code M_DEVICE_GET_DEVICE_NAME

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR DeviceName,
            OUT SIZE_T *CharsWrittenToBuffer
            );

 

 

Method code M_DEVICE_GET_DRIVER

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID DriverObject
            );

 

 

Method code M_DEVICE_GET_NEXT_DEVICE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID NextDeviceObject
            );

 

 

Method code M_DEVICE_GET_ATTACHED_DEVICE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID AttachedDeviceObject
            );

 

 

Method code M_DEVICE_GET_CURRENT_IRP

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID CurrentIrp
            );

 

 

Method code M_DEVICE_GET_REFERENCE_COUNT

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG ReferenceCount
            );

 

 

Method code M_DEVICE_GET_DEVICE_TYPE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PULONG DeviceType
            );

 

 

Method code M_DEVICE_GET_VPB

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR Vpb
            );

 

 

Method code M_DEVICE_GET_DEVICE_EXTENSION

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID DeviceExtension
            );

 

 

Method code M_DEVICE_ENUM_QUEUED_IRPS

 

typedef
BOOL
(CALLBACK *PDEVICE_ENUM_QUEUED_IRPS)(
            IN KA_ITEM_ID Irp,
            PVOID Context
            );

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PDEVICE_ENUM_QUEUED_IRPS Callback,
            PVOID Context
            );

 

Table of Contents Ý

 

2.2.3    Io\DRIVER_OBJECT

Method code M_DRIVER_GET_DRIVER_NAME

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR DriverName,
            OUT SIZE_T *CharsWrittenToBuffer
            );

 

 

Method code M_DRIVER_ENUM_DEVICE

 

typedef
BOOL
(CALLBACK *PDRIVER_ENUM_DEVICE)(
            IN KA_ITEM_ID DeviceObject,
            PVOID Context
            );

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PDRIVER_ENUM_DEVICE Callback,
            PVOID Context
            );

 

Table of Contents Ý

 

2.2.4    Io\DEVICE_EXTENSION\Class

Method code M_DEVEXT_CLASS_GET_DEVICE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID DeviceObject
            );

 

Table of Contents Ý

 

2.2.5    Io\DEVICE_EXTENSION\Class2

Method code M_DEVEXT_CLASS2_GET_DEVICE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID DeviceObject
            );

 

Table of Contents Ý

 

2.2.6    Io\DEVICE_EXTENSION\ScsiPort

Method code M_DEVEXT_SCSIPORT_GET_DEVICE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID DeviceObject
            );

 

 

Method code M_DEVEXT_SCSIPORT_GET_HW_EXTENSION

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKA_ITEM_ID HwDeviceExtension
            );

 

Table of Contents Ý

 

2.3      KERNELPROCTHRD

KernelObject\Thread — kernel thread object (KTHREAD structure)

KernelObject\WaitBlock — kernel thread wait block

KernelObject\Process — kernel process object (KTHREAD structure)

 

Table of Contents Ý

 

2.3.1    KernelObject\Thread

Method code M_KOTHREAD_GET_BASIC_INFO

 

typedef enum {
            Initialized,
            Ready,
            Running,
            Standby,
            Terminated,
            Waiting,
            Transition
} KTHRED_STATUS;

 

typedef struct _KTHRED_BASIC_INFO {
            KTHRED_STATUS State;
            UINT_PTR Win32Thread;
            UINT_PTR Teb;
} KTHRED_BASIC_INFO, *PKTHRED_BASIC_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKTHRED_BASIC_INFO BasicInfo
            );

 

 

Method code M_KOTHREAD_GET_STACK_INFO

 

typedef enum {
            Normal,
            StackSwapEnabled,
            LargeStackEnabled,
            LargeStackAndStackSwapEnabled
} KTHRED_STACK_TYPE;

 

typedef struct _KTHRED_STACK_INFO {
            UINT_PTR StackBase;
            UINT_PTR StackLimit;
            UINT_PTR KernelStack;
            UINT_PTR CallbackStack;
            KTHRED_STACK_TYPE StackType;
} KTHRED_STACK_INFO, *PKTHRED_STACK_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKTHRED_STACK_INFO StackInfo
            );

 

 

Method code M_KOTHREAD_GET_TIME_INFO

 

typedef struct _KTHRED_TIME_INFO {
            ULONG32 KernelTime;
            ULONG32 UserTime;
} KTHRED_TIME_INFO, *PKTHRED_TIME_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKTHRED_TIME_INFO TimeInfo
            );

 

 

Method code M_KOTHREAD_GET_WAIT_STATUS

 

typedef enum {
            Executive,
            FreePage,
            PageIn,
            PoolAllocation,
            DelayExecution,
            Suspended,
            UserRequest,
            WrExecutive,
|           WrFreePage,
            WrPageIn,
            WrPoolAllocation,
            WrDelayExecution,
            WrSuspended,
            WrUserRequest,
            WrEventPair,
            WrQueue,
            WrLpcReceive,
            WrLpcReply,
            WrVirtualMemory,
            WrPageOut,
            WrRendezvous,
            Spare2,
            Spare3,
            Spare4,
            Spare5,
            Spare6,
            WrKernel,
            MaximumWaitReason
} KTHRED_WAIT_REASON;

 

#define KTHRED_KERNEL_MODE              0x01
#define KTHRED_USER_MODE                               0x00
#define KTHRED_ALERTABLE_WAIT                     0x10
#define KTHRED_NONALERTABLE_WAIT            0x00

typedef enum {
                NonAlertableUserMode = (KTHRED_USER_MODE | KTHRED_NONALERTABLE_WAIT),
                NonAlertableKernelMode = (KTHRED_KERNEL_MODE | KTHRED_NONALERTABLE_WAIT),
                AlertableUserMode = (KTHRED_USER_MODE | KTHRED_ALERTABLE_WAIT),
                AlertableKernelMode = (KTHRED_KERNEL_MODE | KTHRED_ALERTABLE_WAIT)
} KTHRED_WAIT_MODE;

 

typedef struct _KTHRED_WAIT_STATUS {
            UINT_PTR WaitTime;
            UINT_PTR SuspendCount;
            UINT_PTR FreezeCount;
            KTHRED_WAIT_REASON WaitReason;
            KTHRED_WAIT_MODE WaitMode;
} KTHRED_WAIT_STATUS, *PKTHRED_WAIT_STATUS;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKTHRED_WAIT_STATUS WaitStatus
            );

 

 

Method code M_KOTHREAD_GET_PRIORITY_INFO

 

typedef struct _KTHRED_PRIORITY_INFO {
            UCHAR BasePriority;
            UCHAR DecrementCount;
            UCHAR PriorityDecrement;
            UCHAR Quantum;
} KTHRED_PRIORITY_INFO, *PKTHRED_PRIORITY_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKTHRED_PRIORITY_INFO PriorityInfo
            );

 

 

Method code M_KOTHREAD_GET_ CONTEXT_INFO

 

typedef struct _KTHRED_CONTEXT_INFO {
            UCHAR NextProcessor;
            ULONG ContextSwitches;
} KTHRED_CONTEXT_INFO, *PKTHRED_CONTEXT_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKTHRED_CONTEXT_INFO ContextInfo
            );

 

 

Method code M_KOTHREAD_IS_ALERTABLE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PBOOL IsAlertable
            );

 

 

Method code M_KOTHREAD_IS_KERNEL_STACK_RESIDENT

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PBOOL IsResident
            );

 

 

Method code M_KOTHREAD_ENUM_WAITBLOCK

 

typedef struct _KTHRED_WAIT_BLOCK {
            UINT_PTR Thread;
            UINT_PTR Object;
            USHORT WaitKey;
            USHORT WaitType;
} KTHRED_WAIT_BLOCK, *PKTHRED_WAIT_BLOCK;

 

typedef
UINT32
(CALLBACK *PKOTHRED_ENUM_WAITBLOCK_CALLBACK)(
            IN UINT_PTR WaitBlockItemAddress,
            IN PKTHRED_WAIT_BLOCK WaitBlock,
            PVOID Context
);

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PKOTHRED_ENUM_WAITBLOCK_CALLBACK Callback,
            PVOID Context
            );

 

Table of Contents Ý

 

2.3.2    KernelObject\WaitBlock

Method code M_KOWBLOCK_GET_WAIT_OBJECT

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR WaitObjectAddr
            );

 

Table of Contents Ý

 

2.3.3    KernelObject\Process

Method code M_KOPROC_GET_BASIC_INFO

 

typedef enum {
            InMemory,
            OutOfMemory,
            InTransition
} KPROC_STATE;

 

typedef struct _KPROC_BASIC_INFO {
            UINT32 BasePriority;
            KPROC_STATE State;
} KPROC_BASIC_INFO, * PKPROC_BASIC_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKPROC_BASIC_INFO BasicInfo
            );

 

 

Method code M_KOPROC_GET_OBJECT_DIR

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR ObjectDirAddr
            );

 

 

Method code M_KOPROC_GET_TIME_INFO

 

typedef struct _KPROC_TIME_INFO {
            ULONG32 KernelTime;
            ULONG32 UserTime;
} KPROC_TIME_INFO, *PKPROC_TIME_INFO;

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKPROC_TIME_INFO TimeInfo
            );

 

 

Method code M_KOPROC_GET_QUANTUM

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR Quantum
            );

 

 

Method code M_KOPROC_ENUM_THREADS

 

typedef
UINT32
(CALLBACK * PKOPROC_ENUM_THREAD_CALLBACK)(
            IN UINT_PTR ThreadAddress,
            PVOID Context
            );

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PKOPROC_ENUM_THREAD_CALLBACK Callback,
            PVOID Context
            );

 

 

Method code M_KOPROC_IS_VDM_PROCESS

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PBOOL IsVdmProcess
            );

 

Table of Contents Ý

 

2.4      KERNELMISCOBJ

KernelObject\Queue — kernel queue objects (KQUEUE structure)

KernelObject\DeviceQueue — kernel device queue object (KDEVICE_QUEUE structure)

KernelObject\DeviceQueueEntry — entry on device queue (KDEVICE_QUEUE_ENTRY structure)

KernelObject\Profile — kernel profile object (KPROFILE structure)

KernelObject\ActiveProfileSource —KACTIVE_PROFILE_SOURCE structure

KernelObject\Interrupt —kernel interrupt object (KINTERRUPT structure)

 

Table of Contents Ý

 

2.4.1    KernelObject\Queue

Method code M_KOQUEUE_GET_CURRENT_TOP

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR TopObjectAddr
            );

 

 

Method code M_KOQUEUE_GET_SIGNAL_STATE

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT32 SignalState
            );

 

Table of Contents Ý

 

2.4.2    KernelObject\DeviceQueue

Method code M_KODEVQ_GET_CURRENT_TOP

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT32 TopAddr
            );

 

 

Method code M_KODEVQ_GET_CURRENT_TOP_BY_KEY

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN UINT32 Key,
            OUT PBOOL Found,
            OUT PUINT_PTR TopAddr
            );

 

 

Method code M_KODEVQ_IS_BUSY

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PBOOL IsBusy
            );

 

 

Method code M_KODEVQ_ENUM_ENTRIES

 

typedef
UINT32
(CALLBACK * PKMISC_ENUM_DEVQENTRY_CALLBACK)(
            IN UINT_PTR KDevQEntryAddress,
            PVOID Context
            );

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PKMISC_ENUM_DEVQENTRY_CALLBACK EnumCallback,
            IN OUT PVOID Context
            );

 

Table of Contents Ý

 

2.4.3    KernelObject\DeviceQueueEntry

Method code M_KODEVQENTRY_GET_KEY

 

BOOL
KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT32 Key
            );

 

Table of Contents Ý

 

2.4.4    KernelObject\Profile

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.4.5    KernelObject\ActiveProfileSource

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.4.6    KernelObject\Interrupt

Method code M_KOINTERRUPT_GET_VECTOR

 

typedef struct _KMISC_INTERRUPT_VECTOR_INFO {
            ULONG32 Vector;
            BOOL Shared;
            BOOL Connected;
} KMISC_INTERRUPT_VECTOR_INFO, *PKMISC_INTERRUPT_VECTOR_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKMISC_INTERRUPT_VECTOR_INFO VectorInfo
            );

 

 

Method code M_KOINTERRUPT_GET_SERVICE_ROUTINE

 

typedef struct _KMISC_SERVICE_ROUTINE_INFO {
            UINT_PTR RoutineAddress;
            UINT_PTR ContextAddress;
            UINT_PTR DispatchAddress;
} KMISC_SERVICE_ROUTINE_INFO, *PKMISC_SERVICE_ROUTINE_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKMISC_SERVICE_ROUTINE_INFO ServiceRoutineInfo
            );

 

 

Method code M_KOINTERRUPT_GET_IRQL

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT32 Irql,
            OUT PUINT32 SyncronizeIrql
            );

 

 

Method code M_KOINTERRUPT_GET_INTERRUPT_MODE

 

typedef enum {
            LevelSensitive,
            Latched
} KMISC_INTERRUPT_MODE;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PKMISC_INTERRUPT_MODE InterruptMode
            );

 

Table of Contents Ý

 

2.5      KERNELAPCDPC

KernelObject\Apc — kernel APC object (KAPC structure)

KernelObject\KAPC_STATE — kernel KAPC_STATE structure

KernelObject\Dpc — kernel DPC object (KDPC structure)

 

Table of Contents Ý

 

2.5.1    KernelObject\Apc

Method code M_KOAPC_GET_APCMODE

 

typedef enum {
            KernelMode,
            UserMode,
            MaximumMode
} KAPCDPC_PROCESSOR_MODE;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT KAPCDPC_PROCESSOR_MODE *ProcessorMode
            );

 

 

Method code M_KOAPC_GET_KTHREAD

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR KThreadAddr
            );

 

 

Method code M_KOAPC_GET_KKERNELROUTINE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR KernelRoutineAddr
            );

 

 

Method code M_KOAPC_GET_KRUNDOWNROUTINE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR RundownRoutineAddr
            );

 

 

Method code M_KOAPC_GET_KNORMALROUTINE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR NormalRoutineAddr
            );

 

Table of Contents Ý

 

2.5.2    KernelObject\KAPC_STATE

Method code M_KOAPCSTATE_GET_KPROCESS

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR KProcessAddr
            );

 

Table of Contents Ý

 

2.5.3    KernelObject\Dpc

Method code M_KODPC_GET_DEFERREDCONTEXT

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PVOID *DeferredContext
            );

 

 

Method code M_KODPC_GET_KDEFERREDROUTINE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR DeferredRoutineAddr
            );

 

Table of Contents Ý

 

2.6      KERNELSYNC

KernelObject\Event — kernel event object (KEVENT structure)

KernelObject\Mutant — kernel mutant/mutex object (KMUTANT/KMUTEX structure)

KernelObject\Semaphore — kernel semaphore object (KSEMAPHORE structure)

KernelObject\EventPair — kernel event pair object (KEVENT_PAIR structure)

 

Table of Contents Ý

 

2.6.1    KernelObject\Event

Method code M_KOEVENT_GET_SIGNALSTATE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG SignalState
            );

 

Table of Contents Ý

 

2.6.2    KernelObject\Mutant

Method code M_KOMUTANT_GET_SIGNALSTATE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG SignalState
            );

 

 

Method code M_KOMUTANT_GET_OWNER_THREAD

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR OwnerThreadAddr
            );

 

Table of Contents Ý

 

2.6.3    KernelObject\Semaphore

Method code M_KOSEMAPHORE_GET_SIGNALSTATE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG SignalState
            );

 

 

Method code M_KOSEMAPHORE_GET_LIMIT

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PULONG32 Limit
            );

 

Table of Contents Ý

 

2.6.4    KernelObject\EventPair

Method code M_KOEVENTPAIR_GET_EVENT_LOW

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR EventLowAddr
            );

 

 

Method code M_KOEVENTPAIR_GET_EVENT_HIGH

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR EventHighAddr
            );

 

Table of Contents Ý

 

2.7      KERNELTIMER

KernelObject\Timer — kernel timer object (KTIMER structure)

 

Table of Contents Ý

 

2.7.1    KernelObject\Timer

Method code M_KOTIMER_GET_DUETIME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT ULARGE_INTEGER *DueTime
            );

 

 

Method code M_KOTIMER_GET_DPC

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR DpcAddr
            );

 

 

Method code M_KOTIMER_GET_SIGNALSTATE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG SignalState
            );

 

 

Method code M_KOTIMER_GET_PERIOD

 

            This method is not applicable to Windows NT 3.51.

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG Period
            );

 

Table of Contents Ý

 

2.8      VIRTUALMEMORY

Root\UserModeArea —

Root\BootSystemArea —

Root\SystemMappedViewsArea —

Root\SystemMappedViewsFreeArea —

Root\PageTableArea —

Root\HyperSpaceArea —

Root\SystemCacheWorkingSetListArea —

Root\SystemCacheArea —

Root\CrashDumpVaArea —

Root\HalsHeapArea —

 

Table of Contents Ý

 

2.8.1    Root\UserModeArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.2    Root\BootSystemArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.3    Root\SystemMappedViewsArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.4    Root\SystemMappedViewsFreeArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.5    Root\PageTableArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.6    Root\HyperSpaceArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.7    Root\SystemCacheWorkingSetListArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.8    Root\SystemCacheArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.9    Root\CrashDumpVaArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.8.10                       Root\HalsHeapArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.9      PCR

Processor\ControlRegion — processor control region (PCR)

Processor\ControlBlock — processor control block (PRCB)

 

Table of Contents Ý

 

2.9.1    Processor\ControlRegion

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.9.2    Processor\ControlBlock

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.10MMSYS

            Root\NonPagedSystemArea

 

Table of Contents Ý

 

2.10.1                       Root\NonPagedSystemArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11MMPOOL

Root\NonPagedPoolMustSucceedArea

Root\NonPagedPoolInitialArea

Root\NonPagedPoolExpansionArea

Root\PagedPoolArea

MmPool\PagedPool

MmPool\PagedPool\FreePages

MmPool\NonPagedPool

MmPool\NonPagedPool\FreePages

MmPool\NonPagedPool\MappedToKseg0

 

Table of Contents Ý

 

2.11.1                       Root\NonPagedPoolMustSucceedArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.2                       Root\NonPagedPoolInitialArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.3                       Root\NonPagedPoolExpansionArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.4                       Root\PagedPoolArea

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.5                       MmPool\PagedPool

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.6                       MmPool\PagedPool\FreePages

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.7                       MmPool\NonPagedPool

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.8                       MmPool\NonPagedPool\FreePages

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.11.9                       MmPool\NonPagedPool\MappedToKseg0

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.12LIST

ListEntry\ListHead\* — LIST_ENTRY list head

ListEntry\ListEntry\* — LIST_ENTRY node

 

Table of Contents Ý

 

2.12.1                       ListEntry\ListHead\*

Method code M_LIST_HEAD_GET_BASIC_INFO

 

typedef struct _LIST_HEAD_BASIC_INFO {
            UINT_PTR Flink;
            UINT_PTR Blink;
            ULONG Hint;
            ULONG NumberOfFlink;
            ULONG NumberOfBlink;
            UINT_PTR Bad1;    //Flink
            UINT_PTR Bad2;    //Flink last
            UINT_PTR Bad3;    //Blink last
            UINT_PTR Bad4;    //Blink
} LIST_HEAD_BASIC_INFO, *PLIST_HEAD_BASIC_INFO;

#define LIST_HEAD_HINT_GOOD_LINKS                                                 0
#define LIST_HEAD_HINT_CORRUPT_BAD2_BLINK                              1
#define LIST_HEAD_HINT_CORRUPT_BAD1_FLINK                               2
#define LIST_HEAD_HINT_CORRUPT_BAD2_FLINK_AND_BLINK      3
#define LIST_HEAD_HINT_CORRUPT_MORE                                           4

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLIST_HEAD_BASIC_INFO BasicInfo
            );

 

 

Method code M_LIST_HEAD_GET_LINKED_ENTRIES

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN BOOL IsFLink,
            IN ULONG32 NumberOfEntries,
            OUT PKA_ITEM_ID EntryIdArray
            );

 

 

Table of Contents Ý

 

2.12.2                       ListEntry\ListEntry\*

Method code M_LIST_ENTRY_GET_BASIC_INFO

 

typedef struct _LIST_ENTRY_BASIC_INFO {
            UINT_PTR Flink;
            UINT_PTR Blink;
            KA_ITEM_ID HeadId;
} LIST_ENTRY_BASIC_INFO, *PLIST_ENTRY_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLIST_ENTRY_BASIC_INFO BasicInfo
            );

 

Table of Contents Ý

 

2.13SLIST

SList\SListHead\* — S-List head

SList\SListEntry\* — entry on S-List

 

Table of Contents Ý

 

2.13.1                       SList\SListHead\*

Method code M_SLIST_HEAD_GET_BASIC_INFO

 

typedef struct _SLIST_HEAD_BASIC_INFO {
            UINT_PTR Next;
            ULONG Hint;
            ULONG NumberOfFlink;
            UINT_PTR Bad1;    //Flink
            UINT_PTR Bad2;    //Flink last
} SLIST_HEAD_BASIC_INFO, *PSLIST_HEAD_BASIC_INFO;

#define SLIST_HEAD_HINT_GOOD_LINKS           0
#define SLIST_HEAD_HINT_CORRUPT_LINKS    1

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PSLIST_HEAD_BASIC_INFO BasicInfo
            );

 

 

Method code M_SLIST_HEAD_GET_LINKED_ENTRIES

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN ULONG32 NumberOfEntries,
            OUT PKA_ITEM_ID EntryIdArray
            );

 

Table of Contents Ý

 

2.13.2                       SList\SListEntry\*

Method code M_SLIST_ENTRY_GET_BASIC_INFO

 

typedef struct _SLIST_ENTRY_BASIC_INFO {
            UINT_PTR Next;
            UINT_PTR Previous;
            KA_ITEM_ID HeadId;
} SLIST_ENTRY_BASIC_INFO, *PSLIST_ENTRY_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PSLIST_ENTRY_BASIC_INFO BasicInfo
            );

 

Table of Contents Ý

 

2.14MODULE

Module\Header — kernel mode module image header

Module\Code — kernel mode module code section

Module\Data — kernel mode module data section

Loader\LdrDataTable — loaded kernel mode module list

 

Table of Contents Ý

 

2.14.1                       Module\Header

Method code M_MDHEAD_GET_IMAGE_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR ImageName
            );

 

 

Method code M_MDHEAD_GET_BUILD_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR ActualName
            );

 

 

Method code M_MDHEAD_GET_IMAGE_SIZE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT SIZE_T *Size
            );

 

 

Method code M_MDHEAD_GET_TIME_DATE_STAMP

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT SYSTEMTIME *SystemTime,
            OUT PULONG32 TimeDateStamp
            );

 

 

Method code M_MDHEAD_GET_CHECKSUM

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG32 Checksum
            );

 

 

Method code M_MDHEAD_GET_DOS_HEADER

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PIMAGE_DOS_HEADER DosHeader,
            IN SIZE_T DosHeaderBufferSizeBytes,
            OUT SIZE_T *DosHeaderSize
            );

 

 

Method code M_MDHEAD_GET_NT_HEADERS

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PIMAGE_NT_HEADERS NtHeaders,
            IN SIZE_T NtHeadersBufferSizeBytes,
            OUT SIZE_T *NtHeaderSize
            );

 

 

Method code M_MDHEAD_ENUM_SECTION_HEADERS

 

typedef
UINT32
(CALLBACK *PMD_ENUM_SECTION_HEADER_CALLBACK)(
            IN PIMAGE_SECTION_HEADER SectionHeader,
            PVOID Context
            );

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN PMD_ENUM_SECTION_HEADER_CALLBACK Callback,
            PVOID Context
            );

 

Table of Contents Ý

 

2.14.2                       Module\Code, Module\Data

Method code M_MDSECT_GET_SECTION_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR NameBuffer
            );

 

 

Method code M_MDSECT_GET_ATTRIBUTE

 

typedef enum {
            InitializedData,
            UninitializedData,
            Code

} MD_SECT_TYPE;

 

typedef struct _MD_SECT_ATTRIB {
            BOOL Writable;
            BOOL Readable;
            BOOL Executable;
            BOOL Pageable;
            MD_SECT_TYPE SectionType;
} MD_SECT_ATTRIB, *PMD_SECT_ATTRIB;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PMD_SECT_ATTRIB Attribute
            );

 

 

Method code M_MDSECT_GET_MODULE_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR NameBuffer
            );

 

 

Method code M_MDSECT_GET_SECTION_HEADER

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PIMAGE_SECTION_HEADER ImageSectionHeader
            );

 

Table of Contents Ý

 

2.14.3                       Loader\LdrDataTable

This data item type has no method interfaces.

 

Table of Contents Ý

 

2.15OBJECTTABLE

ObjectTable\ObjectHeader — object table object header

ObjectTable\ObjectHandleTable — object table handle table

ObjectTable\TypeObject — object in object table

ObjectTable\DirectoryObject — directory object

ObjectTable\SymbolicLinkObject — symbolic link object

 

Table of Contents Ý

 

2.15.1                       ObjectTable\ObjectHeader

Method code M_OBJECTTABLE_HDR_GET_OBJECT_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR NameBuffer,
            OUT SIZE_T *CharsWrittenIntoBuffer
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_OBJECT_TYPE_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR NameBuffer,
            OUT SIZE_T *CharsWrittenIntoBuffer
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_QUOTA_INFO

 

typedef struct OBJECTTABLE_HDR_QUOTA_INFO {
            ULONG PagedPoolCharge;
            ULONG NonPagedPoolCharge;
            ULONG SecurityDescriptorCharge;
            UINT_PTR ExclusiveProcessAddr;
} OBJECTTABLE_HDR_QUOTA_INFO, *POBJECTTABLE_HDR_QUOTA_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT POBJECTTABLE_HDR_QUOTA_INFO QuotaInfo
            );

 

 

Method code M_OBJECTTABLE_HDR_ENUM_OWNER_PROCESSES

 

typedef
UINT32
(CALLBACK *POBJECTTABLE_HDR_ENUM_OWNER_PROCESSES_PROC)(
            IN  UINT_PTR OwnerEProcessAddr,
            PVOID Context
            );

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN POBJECTTABLE_HDR_ENUM_OWNER_PROCESSES_PROC Callback,
            PVOID Context
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_FLAGS

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT UCHAR *Flags
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_PROBE_MODE

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT CCHAR *Mode
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_CREATOR_PROCESS

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PHANDLE ProcessHandle
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_POINTER_COUNT

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG PointerCount
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_HANDLE_COUNT

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLONG HandleCount
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_OBJECT_BODY

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR ObjectBodyAddr
            );

 

 

Method code M_OBJECTTABLE_HDR_GET_PARENT_DIRECTORY

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR ParentDirectoryAddr
            );

 

Table of Contents Ý

 

2.15.2                       ObjectTable\ObjectHandleTable

Method code M_OBJECTTABLE_HTB_GET_OWNER_PROCESS

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR OwnerEProcessAddr
            );

 

 

Method code M_OBJECTTABLE_HTB_GET_TABLE_ENTRY_COUNT

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PULONG32 TableEntryCount
            );

 

 

Method code M_OBJECTTABLE_HTB_ENUM_OBJECTS

 

typedef
UINT32
(CALLBACK *OBJECTTABLE_HTB_ENUM_OBJECTS_PROC)(
            IN UINT_PTR Handle,
            IN UINT_PTR ObjectBodyAddr,
            PVOID Context
            );

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN OBJECTTABLE_HTB_ENUM_OBJECTS_PROC Callback,
            PVOID Context
            );

 

Table of Contents Ý

 

2.15.3                       ObjectTable\TypeObject

Method code M_OBJECTTABLE_TYP_GET_TYPE_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR NameBuffer
,
            OUT SIZE_T *CharsWrittenIntoBuffer
            );

 

 

Method code M_OBJECTTABLE_TYP_GET_STATISTICAL_INFO

 

typedef struct _OBJECTTABLE_TYP_STATISTICAL_INFO {
            ULONG TotalNumberOfObjects;
            ULONG TotalNumberOfHandles;
            ULONG HighWaterNumberOfObjects;
            ULONG HighWaterNumberOfHandles;
} OBJECTTABLE_TYP_STATISTICAL_INFO, *POBJECTTABLE_TYP_STATISTICAL_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT POBJECTTABLE_TYP_STATISTICAL_INFO Statistics
            );

 

Table of Contents Ý

 

2.15.4                       ObjectTable\DirectoryObject

Method code M_OBJECTTABLE_DIR_GET_DIRECTORY_ENTRY_COUNT

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PULONG32 Count
            );

 

 

Method code M_OBJECTTABLE_DIR_ENUM_OBJECTS

 

typedef
UINT32
(CALLBACK *OBJECTTABLE_DIR_ENUM_OBJECTS_PROC)(
            IN  UINT_PTR ObjectBodyAddr,
            PVOID Context
            );

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN OBJECTTABLE_DIR_ENUM_OBJECTS_PROC Count,
            PVOID Context
            );

 

Table of Contents Ý

 

2.15.5                       ObjectTable\SymbolicLinkObject

Method code M_OBJECTTABLE_SYM_GET_LINK_TARGET_NAME

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN SIZE_T BufferSizeChars,
            OUT LPWSTR NameBuffer,
            OUT SIZE_T *CharsWrittenIntoBuffer
            );

 

 

Method code M_OBJECTTABLE_SYM_GET_LINK_TARGET_OBJECT

 

            This method is not applicable to Windows NT 3.51.

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PUINT_PTR LinkTargetObjectAddr
            );

 

Table of Contents Ý

 

2.16EXPOOL

PoolBlock\PoolHeader — header for a pool block

PoolBlock\Paged — allocated block of paged pool

PoolBlock\NonPaged — allocated block of non-paged pool

PoolBlock\Paged\FreedBlock — freed block of paged pool

PoolBlock\NonPaged\FreedBlock — freed block of non-paged pool

PoolControl\PoolDescriptor — POOL_DESCRIPTOR structure

 

The KA_POOL_TYPE enumerated type is common to several data item type method interfaces and so is described here.

 

typedef enum _KA_POOL_TYPE {
            KaNonPagedPool,
            KaNonPagedPoolMustSucceed,
            KaPagedPool,
            KaFreedPool,
            KaUnknownPool
} KA_POOL_TYPE;

 

Table of Contents Ý

 

2.16.1                       PoolBlock Types

Method code M_POOL_HEAD_GET_BASIC_INFO (supported by PoolBlock\PoolHeader):

 

typedef struct _POOL_HEAD_BASIC_INFO {
            KA_POOL_TYPE PoolType;
            ULONG32 PoolIndex;
            ULONG32 BlockNum;
            ULONG32 PreviousBlockNum;
            ULONG32 PoolTag;
            BOOL ProtectedTag;
            BOOL Quota;
            UINT_PTR QuotaProcess;
} POOL_HEAD_BASIC_INFO, *PPOOL_HEAD_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PPOOL_HEAD_BASIC_INFO BasicInfo
            );

 

 

Method code M_POOL_BLOCK_GET_BASIC_INFO (supported by PoolBlock\Paged, PoolBlock\NonPaged, PoolBlock\Paged\FreedBlock, and PoolBlock\NonPaged\FreedBlock):

 

typedef struct _POOL_BLOCK_BASIC_INFO {
            KA_ITEM_ID PoolHead;
} POOL_BLOCK_BASIC_INFO, *PPOOL_BLOCK_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PPOOL_BLOCK_BASIC_INFO BasicInfo
            );

 

Table of Contents Ý

 

2.16.2                       PoolControl\PoolDescriptor

Method code M_POOL_DESCRIPTOR_GET_BASIC_INFO

 

typedef struct _POOL_DESCRIPTOR_BASIC_INFO {
            KA_POOL_TYPE PoolType;
            ULONG PoolIndex;
            ULONG AllocCounts;
            ULONG FreeCounts;
            ULONG TotalAllocPages;
            ULONG TotalAllocBigPages;
            ULONG NumberOfFreeBlockIndex;
} POOL_DESCRIPTOR_BASIC_INFO, *PPOOL_DESCRIPTOR_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PPOOL_DESCRIPTOR_BASIC_INFO BasicInfo
            );

 

 

Method code M_POOL_DESCRIPTOR_GET_FREE_BLOCK_INFO

 

typedef struct _POOL_DESCRIPTOR_FREE_BLOCK_INFO {
            KA_ITEM_ID FreeListHead;
} POOL_DESCRIPTOR_FREE_BLOCK_INFO, *PPOOL_DESCRIPTOR_FREE_BLOCK_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            IN ULONG Index,
            OUT PPOOL_DESCRIPTOR_FREE_BLOCK_INFO BlockInfo
            );

 

Table of Contents Ý

 

2.17LOOKASIDE

LookasideList\General — system memory lookaside lists

LookasideList\SmallPool — lookaside lists for small pool blocks

 

Table of Contents Ý

 

2.17.1                       LookasideList\General

Method code M_LOOKASIDE_GENERAL_BASIC_INFO

 

typedef struct _LOOKASIDE_GENERAL_BASIC_INFO {
            KA_POOL_TYPE PoolType;
            ULONG PoolTag;
            ULONG BlockSize;
            ULONG CurrentDepth;
            ULONG MaximumDepth;
            ULONG TotalAllocates;
            ULONG AllocateMisses;
            ULONG TotalFrees;
            ULONG FreeMisses;
            UINT_PTR AllocateFunction;
            UINT_PTR FreeFunction;
            KA_ITEM_ID SListHead;
} LOOKASIDE_GENERAL_BASIC_INFO, *PLOOKASIDE_GENERAL_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLOOKASIDE_GENERAL_BASIC_INFO BasicInfo
            );

 

Table of Contents Ý

 

2.17.2                       LookasideList\SmallPool

Method code M_LOOKASIDE_SMALLPOOL_BASIC_INFO

 

typedef struct _LOOKASIDE_SMALLPOOL_BASIC_INFO {
            KA_POOL_TYPE PoolType;
            ULONG BlockSize;
            ULONG CurrentDepth;
            ULONG MaximumDepth;
            ULONG TotalAllocates;
            ULONG AllocateMisses;
            ULONG TotalFrees;
            ULONG FreeMisses;
            KA_ITEM_ID SListHead;
} LOOKASIDE_SMALLPOOL_BASIC_INFO, *PLOOKASIDE_SMALLPOOL_BASIC_INFO;

 

KANALYZE_CALL_METHOD_ROUTINE(
            IN HKAPLUGIN hPlugIn,
            IN KA_ITEM_ID ItemId,
            IN ULONG32 MethodCode,
            OUT PLOOKASIDE_SMALLPOOL_BASIC_INFO BasicInfo
            );

 

Table of Contents Ý