Windows debugging 11th

I/O Data Structure

============

Data Structure

There are four main data structures that represent I/O requests: file objects (file object), driver objects (driver object), device objects (device object ), i/O request packets (IRPs) (IO request packet)

Each of these data structures is defined in the header file ntddk. h In the DDK document library. You can use the kernel debugger command! File ,! Mongobj ,! Drvobj, and! IRP to view them.

File object-file object
This is an object that represents open files, devices, directories, volumes, and so on. A file object can be accessed through a file handle, which is returned by a protected subsystem function, and this subfunction calls the System Service of the file object downward. the caller of the IO System Service is waiting for the file handle. at any given moment, several file objects can be associated with a single shared file, but each such file has a unique handle, and the value of the pointer to the current file of an objcet-specific.

File objects are sometimes called "persistent objects" because the background object of the file object set is saved after the system starts.

Driver object
Is a kernel-only object that represents the driver's image loading. It is used by iomanager to locate certain entry points in the driver.

 

Device object-device object
The kernel state object defined by Io manager represents physical, logical, and virtual devices. all drivers call the iocreatedevice method to create and initialize a device object for physical, logical, and virtual devices. The driver serves this object. the PnP driver creates three Device objects: The bus driver creates PDO, the function driver creates fdo, and the filter driver creates do. as a named file object, the device is visible to the end user, and the user-state code is visible through a named device interface. (protected subsystem ).