Objects and I/O

!devnode

Display a PnP device node and optionally its subtree.

!devnode [node|0] [-r]

Also: devnode

Shows the instance path, service, state and state history, flags, problem code, and pending IRP. With no node (or 0), displays the root device node. -r and the trailing WinDbg-style 1 walk the node’s subtree, one node per line.

!devobj

Inspect a DEVICE_OBJECT and its attached stack.

!devobj <device-object-expression>

Also: devobj

!devstack

Display the device stack for a DEVICE_OBJECT or device node.

!devstack <device-object|devnode>

Also: devstack

The argument may be any DEVICE_OBJECT in the stack or its DEVICE_NODE; the stack is shown from the top filter down to the PDO, each device with its !DevObj, !DrvObj, !DevExt, and object name, the argument marked >, followed by the PDO’s device node.

!drvobj

Inspect a DRIVER_OBJECT, its device chain and dispatch table.

!drvobj <driver-object-expression-or-name>

Also: drvobj

!fileobj

Decode a FILE_OBJECT and its device/name relationships.

!fileobj <address-expression>

!handle

List bounded handles for the selected process, or inspect one handle.

!handle [handle-expression]

Without an argument, scans at most 256 handle-table slots. The detail form reports the object, type, name, access mask, and attributes when decodable.

!irp

Inspect an IRP and its current IO_STACK_LOCATION.

!irp <address-expression>

Also: irp

!list

Run commands for every element of a typed LIST_ENTRY chain.

!list -t [module!]<type>.<field> -x "<commands>" <address>

The element address is available as $extret, @extret, or @$extret in each command. Walks stop at the head, repeated links, or 4096 elements. The address given is the first element, like WinDbg, so the walk emits every node up to the return to that address. A list head and a record link are indistinguishable in memory, so starting at a list head (rather than poi(ListHead)) treats the head as one pseudo-record instead of dropping a real record; an empty list, whose link points at itself, runs nothing. The walk keeps whatever it collected and reports null links, cycles, unreadable links, and reaching the entry bound.

!locks

Inspect one ERESOURCE, or enumerate the symbol-backed resource list.

!locks [resource-address-expression]

The no-argument form uses ExpSystemResourcesList and is bounded to 256 entries. It never scans memory; if the symbol/list metadata is absent, enumeration is unavailable.

!object

Inspect an executive object header and body.

!object <object-expression>

Also: object

!pnptriage

Report PnP device nodes with problems, pending IRPs, or incomplete starts.

!pnptriage

Also: pnptriage

callbacks

Enumerate process/thread/image notification callbacks.

callbacks [symbol-filter]

irps

Discover in-flight IRPs from thread IrpLists and device CurrentIrp.

irps [process-filter|driver-filter]

ssdt

Dump the SSDT and shadow SSDT.

ssdt