windbg查看设备栈设备树学习总结

用windbg寻找设备树根节点

http://blog.csdn.net/lixiangminghate/article/details/51729945

    用ReactOS上明确说过，Pnp管理器对每种设备都会创建一个虚拟root device用于构建设备树；同时这个新创建的root device又作为一个设备栈的栈底，往上形成完整的设备栈。用windbg调试时，可以看到这个虚拟设备属于/driver/pnpmanager驱动。

    昨天出于好奇想看下设备树，结果发现只有虚拟设备attach在/driver/pnpmanger创建的设备上，而类似pci/usb设备的设备栈栈底根本不是/driver/pnpmanager设备，这让我很是怀疑，M$到底怎样形成以root为根节点的设备树。

如mssmbios.sys位于设备管理器system设备类下，注册表路径为:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\SYSTEM\0002

用windbg查看设备堆栈，可以看到这个设备attach在/driver/pnpmanger根节点上:

kd> !drvobj mssmbios  
Driver object (81f81da0) is for:  
 \Driver\mssmbios  
Driver Extension List: (id , addr)  
  
Device Object list:  
81c8e408    
kd> !devstack 81c8e408    
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 81c8e408  \Driver\mssmbios   81c8e4c0    
  821e73d0  \Driver\PnpManager 821e7488  00000034   
!DevNode 821e7288 :  
  DeviceInst is "Root\SYSTEM\0002"  
  ServiceName is "mssmbios"  

又如DDK样例toaster的虚拟总线设备busenum同样位于system设备类下，注册表路径为:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\SYSTEM\0003
其设备栈为:,亦可看到栈底pnpmanager设备

[cpp] view plain copy
kd> !drvobj busenum  
Driver object (81f81030) is for:  
 \Driver\busenum  
Driver Extension List: (id , addr)  
  
Device Object list:  
81ff3030    
kd> !devstack 81ff3030    
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 81ff3030  \Driver\busenum    81ff30e8    
  821e7190  \Driver\PnpManager 821e7248  00000035  
!DevNode 821a0008 :  
  DeviceInst is "Root\SYSTEM\0003"  
  ServiceName is "busenum"  
    然而，对于一些总线设备根本找不到pnpmanager,如PCI总线和USB总线:
[cpp] view plain copy
kd> !drvobj pci  
Driver object (82189218) is for:  
 \Driver\PCI  
Driver Extension List: (id , addr)  
  
Device Object list:  
82127c70  82127e50  82127030  821e03a0  
...  
8219cb98  821e5370  821ba160    
kd> !devstack 82127c70    
  !DevObj   !DrvObj            !DevExt   ObjectName  
  81d34028  \Driver\usbehci    81d340e0  USBFDO-1  
  82127790  \Driver\ACPI       82187810  00000064  
> 82127c70  \Driver\PCI        82127d28  NTPNP_PCI0043  
!DevNode 821272e8 :  
  DeviceInst is "PCI\VEN_15AD&DEV_0770&SUBSYS_077015AD&REV_00\4&47b7341&0&1888"  
  ServiceName is "usbehci"  

[cpp] view plain copy
kd> !drvobj usbhub  
Driver object (820de2c0) is for:  
 \Driver\usbhub  
Driver Extension List: (id , addr)  
  
Device Object list:  
81c74c98  81d542f0  820f1b70  81fcac98  
81c7ac98    
kd> !devstack  81c74c98    
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 81c74c98  \Driver\usbhub     81c74d50  00000079  
  81d542f0  \Driver\usbhub     81d543a8  USBPDO-3  
!DevNode 81c82c48 :  
  DeviceInst is "USB\Vid_0e0f&Pid_0002\6&2edefd9b&0&2"  
  ServiceName is "usbhub"  
    对此，我百思不得解，pnpmanager去哪了？经过周AM指点，搞明白一件事:用!drvobj PCI列出pci设备中，除了最后一个是Fdo，其他都是Pdo(这里Fdo设备的意思是由PCI总线驱动AddDevice函数创建的设备，附加在底层的ACPI总线上，而Pdo设备是PCI总线探测到总线上接入了新设备，从而为这个新设备创建了一个Pdo以形成设备栈)。这些Fdo本身是由PCI总线创建，因此并不会attach在pnpmanager上，而通过查找Fdo设备的设备栈，才能找出栈底Pnpmanager。
    顺着周AM的思路，我重新调试了一遍，的确找到了PCI总线所在的Pnpmanager，以上面的环境为例，

[cpp] view plain copy
kd> !drvobj pci  
Driver object (82189218) is for:  
 \Driver\PCI  
Driver Extension List: (id , addr)  
  
Device Object list:  
82127c70  82127e50  82127030  821e03a0  
...  
8219cb98  821e5370  821ba160   
Pci总线驱动创建的设备0x821ba160就是Fdo(为什么Fdo位于最后?因为这是PCI!AddDevice创建的第一个设备对象，之后创建的设备对象都通过InsertListTail插入到设备队列头部，因此遍历设备队列时，Fdo是最后被遍历到的)，查看它的设备栈:
[cpp] view plain copy
kd> !devstack 821ba160  
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 821ba160  \Driver\PCI        821ba218    
  821731a8  \Driver\ACPI       821e2940  00000038  
!DevNode 821de178 :  
  DeviceInst is "ACPI\PNP0A03\2&daba3ff&0"  
  ServiceName is "pci"  
    PCI设备堆叠在ACPI的Pdo上，怪不得找不到在PCI的设备栈中找不到Pnpmanager。继续寻祖,查找ACPI驱动创建的Fdo:
[cpp] view plain copy
kd> !drvobj ACPI  
Driver object (8219ca10) is for:  
 \Driver\ACPI  
Driver Extension List: (id , addr)  
  
Device Object list:  
8212c628  8212c740  8212c858  82126538  
...  
821731a8  8219c8f8    
kd> !devstack 8219c8f8    
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 8219c8f8  \Driver\ACPI       821e2ea0    
  821a0aa8  \Driver\ACPI_HAL   821a0b60  00000037  
!DevNode 8219cd50 :  
  DeviceInst is "ACPI_HAL\PNP0C08\0"  
  ServiceName is "ACPI"  
    同样ACPI的Fdo堆叠在ACPI_HAL驱动的Pdo上，继续寻祖，这次找ACPI_HAL的堆叠情况:
[cpp] view plain copy
kd> !drvobj ACPI_HAL  
Driver object (821a0f38) is for:  
 \Driver\ACPI_HAL  
Driver Extension List: (id , addr)  
  
Device Object list:  
821a0aa8  821a0bc8    
kd> !devstack 821a0bc8    
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 821a0bc8  \Driver\ACPI_HAL   821a0c80    
  821a4c68  \Driver\PnpManager 821a4d20  00000001  
!DevNode 821a4b20 :  
  DeviceInst is "Root\ACPI_HAL\0000"  
    终于在ACPI_HAL驱动的Fdo设备栈中找到了Pnpmanager。这和Windows内核原理与实现书中提供的设备树的结构完全相似
    如果此时再深究一下PnpManager驱动创建的设备对象，会发现系统中果真只有一个根设备节点，而其他的PnpManager设备对象都是为了扩展设备树一点一点生长出来的:

[cpp] view plain copy
kd> !drvobj PnpManager  
Driver object (821eb2e8) is for:  
 \Driver\PnpManager  
Driver Extension List: (id , addr)  
  
Device Object list:  
821e7190  821e73d0  821e7610  821e7850  
...  
821a4c68  821a4020    
kd> !devstack  821a4020    
  !DevObj   !DrvObj            !DevExt   ObjectName  
> 821a4020  \Driver\PnpManager 821a40d8    
!DevNode 821a4ee8 :  
  DeviceInst is "HTREE\ROOT\0" <----从名字能感觉出这是根设备节点  
kd> !devstack 821a4c68    
  !DevObj   !DrvObj            !DevExt   ObjectName  
  821a0bc8  \Driver\ACPI_HAL   821a0c80    
> 821a4c68  \Driver\PnpManager 821a4d20  00000001  <----名字看着这么没个性，肯定不是根设备节点了  
!DevNode 821a4b20 :  
  DeviceInst is "Root\ACPI_HAL\0000"   
========

windbg 查看设备信息

http://blog.csdn.net/wjcsharp/article/details/11169349


1. 相关命令
!devobj 查看设备对象信息
!drvobj 查看驱动对象信息
!devstack 查看设备栈
2. 系统设备树
!devnode 0 1
[cpp] view plain copy
kd> !devnode 0 1  
Dumping IopRootDeviceNode (= 0x865b1ee8)  
DevNode 0x865b1ee8 for PDO 0x865b1020  
  InstancePath is "HTREE\ROOT\0"  
  State = DeviceNodeStarted (0x308)  
  Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b1ae0 for PDO 0x865b1c28  
    InstancePath is "Root\ACPI_HAL\0000"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
    DevNode 0x865e1630 for PDO 0x865adf00  
      InstancePath is "ACPI_HAL\PNP0C08\0"  
      ServiceName is "ACPI"  
      State = DeviceNodeStarted (0x308)  
      Previous State = DeviceNodeEnumerateCompletion (0x30d)  
      DevNode 0x864c7118 for PDO 0x865691a8  
        InstancePath is "ACPI\PNP0A03\2&daba3ff&0"  
        ServiceName is "pci"  
        State = DeviceNodeStarted (0x308)  
        Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b8c0 for PDO 0x865e46a0  
          InstancePath is "PCI\VEN_8086&DEV_7190&SUBSYS_00000000&REV_01\3&61aaa01&0&00"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b7a0 for PDO 0x8653aba8  
          InstancePath is "PCI\VEN_8086&DEV_7191&SUBSYS_00000000&REV_01\3&61aaa01&0&08"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b680 for PDO 0x865a8e50  
          InstancePath is "PCI\VEN_8086&DEV_7110&SUBSYS_00000000&REV_08\3&61aaa01&0&38"  
          ServiceName is "isapnp"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x864ae3f0 for PDO 0x864aef10  
            InstancePath is "ISAPNP\ReadDataPort\0"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x864ae2d0 for PDO 0x864aedf8  
            InstancePath is "ACPI\PNP0C02\1f"  
            State = DeviceNodeInitialized (0x302)  
            Previous State = DeviceNodeUninitialized (0x301)  
          DevNode 0x864ae1b0 for PDO 0x864aece0  
            InstancePath is "ACPI\PNP0200\4&5289e18&0"  
            State = DeviceNodeInitialized (0x302)  
            Previous State = DeviceNodeUninitialized (0x301)  
          DevNode 0x860a8008 for PDO 0x864aebc8  
            InstancePath is "ACPI\PNP0001\4&5289e18&0"  
            State = DeviceNodeInitialized (0x302)  
            Previous State = DeviceNodeUninitialized (0x301)  
          DevNode 0x860a8ee8 for PDO 0x864aeab0  
            InstancePath is "ACPI\PNP0100\4&5289e18&0"  
            State = DeviceNodeInitialized (0x302)  
            Previous State = DeviceNodeUninitialized (0x301)  
          DevNode 0x860a8dc8 for PDO 0x864ae998  
            InstancePath is "ACPI\PNP0B00\4&5289e18&0"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x860a8ca8 for PDO 0x864ae880  
            InstancePath is "ACPI\PNP0800\4&5289e18&0"  
            State = DeviceNodeInitialized (0x302)  
            Previous State = DeviceNodeUninitialized (0x301)  
          DevNode 0x860a8b88 for PDO 0x864ae768  
            InstancePath is "ACPI\PNP0303\4&5289e18&0"  
            ServiceName is "i8042prt"  
            TargetDeviceNotify List - f 0xe16b4780  b 0xe16b4780  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x860a8a68 for PDO 0x864ae650  
            InstancePath is "ACPI\PNP0F13\4&5289e18&0"  
            ServiceName is "i8042prt"  
            TargetDeviceNotify List - f 0xe16ab3b8  b 0xe16ab3b8  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x860a8948 for PDO 0x864ae538  
            InstancePath is "ACPI\PNP0A05\4&5289e18&0"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x860a83c8 for PDO 0x860a8858  
              InstancePath is "ACPI\PNP0400\5&324d5432&0"  
              ServiceName is "Parport"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
              DevNode 0x864cf548 for PDO 0x862f6040  
                InstancePath is "LPTENUM\MicrosoftRawPort\6&16ccfde1&0&LPT1"  
                State = DeviceNodeStarted (0x308)  
                Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x860a82a8 for PDO 0x860a8740  
              InstancePath is "ACPI\PNP0501\1"  
              ServiceName is "Serial"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x860a8188 for PDO 0x860a8628  
              InstancePath is "ACPI\PNP0501\2"  
              ServiceName is "Serial"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x864b4008 for PDO 0x860a8510  
              InstancePath is "ACPI\PNP0700\5&324d5432&0"  
              ServiceName is "fdc"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
              DevNode 0x860a64d0 for PDO 0x862c4840  
                InstancePath is "FDC\GENERIC_FLOPPY_DRIVE\6&1435b2e2&0&0"  
                ServiceName is "flpydisk"  
                TargetDeviceNotify List - f 0xe171a430  b 0xe171a430  
                State = DeviceNodeStarted (0x308)  
                Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b560 for PDO 0x860a0e50  
          InstancePath is "PCI\VEN_8086&DEV_7111&SUBSYS_197615AD&REV_01\3&61aaa01&0&39"  
          ServiceName is "intelide"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x864b4148 for PDO 0x864b4460  
            InstancePath is "PCIIDE\IDEChannel\4&23686003&0&0"  
            ServiceName is "atapi"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x864b3008 for PDO 0x864b4290  
            InstancePath is "PCIIDE\IDEChannel\4&23686003&0&1"  
            ServiceName is "atapi"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x86463a78 for PDO 0x86431b00  
              InstancePath is "IDE\CdRomNECVMWar_VMware_IDE_CDR10_______________1.00____\3031303030303030303030303030303030303130"  
              ServiceName is "cdrom"  
              TargetDeviceNotify List - f 0xe1615440  b 0xe16b74f0  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b440 for PDO 0x864636f0  
          InstancePath is "PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61aaa01&0&3F"  
          ServiceName is "vmci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b320 for PDO 0x865e4c80  
          InstancePath is "PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61aaa01&0&78"  
          ServiceName is "vmx_svga"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8641b200 for PDO 0x865e3380  
          InstancePath is "PCI\VEN_104B&DEV_1040&SUBSYS_1040104B&REV_01\3&61aaa01&0&80"  
          ServiceName is "vmscsi"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x8643d8e8 for PDO 0x8647ca38  
            InstancePath is "SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S&Rev_1.0\4&5fcaafc&0&000"  
            ServiceName is "disk"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a008 for PDO 0x8643e8f8  
          InstancePath is "PCI\VEN_15AD&DEV_0790&SUBSYS_00000000&REV_02\3&61aaa01&0&88"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x86470648 for PDO 0x865173a0  
            InstancePath is "PCI\VEN_8086&DEV_7112&SUBSYS_197615AD&REV_00\4&47b7341&0&0088"  
            ServiceName is "usbuhci"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x862534d0 for PDO 0x86253618  
              InstancePath is "USB\ROOT_HUB\5&1dc927ff&0"  
              ServiceName is "usbhub"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
              DevNode 0x864511f0 for PDO 0x8631e168  
                InstancePath is "USB\Vid_0e0f&Pid_0003\6&2edefd9b&0&1"  
                ServiceName is "usbccgp"  
                State = DeviceNodeStarted (0x308)  
                Previous State = DeviceNodeEnumerateCompletion (0x30d)  
                DevNode 0x8632fcd0 for PDO 0x8632f030  
                  InstancePath is "USB\Vid_0e0f&Pid_0003&MI_00\7&2cbb743&0&0000"  
                  ServiceName is "HidUsb"  
                  State = DeviceNodeStarted (0x308)  
                  Previous State = DeviceNodeEnumerateCompletion (0x30d)  
                  DevNode 0x860ab008 for PDO 0x86500d28  
                    InstancePath is "HID\Vid_0e0f&Pid_0003&MI_00\8&3460d90f&0&0000"  
                    ServiceName is "mouhid"  
                    TargetDeviceNotify List - f 0xe16ab418  b 0xe16ab418  
                    State = DeviceNodeStarted (0x308)  
                    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
                DevNode 0x8632fbb0 for PDO 0x8632fe18  
                  InstancePath is "USB\Vid_0e0f&Pid_0003&MI_01\7&2cbb743&0&0001"  
                  ServiceName is "HidUsb"  
                  State = DeviceNodeStarted (0x308)  
                  Previous State = DeviceNodeEnumerateCompletion (0x30d)  
                  DevNode 0x8631d108 for PDO 0x85f53630  
                    InstancePath is "HID\Vid_0e0f&Pid_0003&MI_01\8&bf62b46&0&0000"  
                    ServiceName is "mouhid"  
                    TargetDeviceNotify List - f 0xe16ab478  b 0xe16ab478  
                    State = DeviceNodeStarted (0x308)  
                    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
              DevNode 0x86423198 for PDO 0x85fa6de8  
                InstancePath is "USB\Vid_0e0f&Pid_0002\6&2edefd9b&0&2"  
                ServiceName is "usbhub"  
                State = DeviceNodeStarted (0x308)  
                Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x86470528 for PDO 0x86470030  
            InstancePath is "PCI\VEN_1022&DEV_2000&SUBSYS_20001022&REV_10\4&47b7341&0&0888"  
            ServiceName is "vmxnet"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x86470408 for PDO 0x86470e50  
            InstancePath is "PCI\VEN_1274&DEV_1371&SUBSYS_13711274&REV_02\4&47b7341&0&1088"  
            ServiceName is "es1371"  
            TargetDeviceNotify List - f 0xe1ea4458  b 0xe1ea4458  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x8607b660 for PDO 0x86473040  
              InstancePath is "LEGACY\JOYSTICK\5&24c8a7aa&0&ENUM&"  
              ServiceName is "gameenum"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
          DevNode 0x864702e8 for PDO 0x86470c70  
            InstancePath is "PCI\VEN_15AD&DEV_0770&SUBSYS_077015AD&REV_00\4&47b7341&0&1888"  
            ServiceName is "usbehci"  
            State = DeviceNodeStarted (0x308)  
            Previous State = DeviceNodeEnumerateCompletion (0x30d)  
            DevNode 0x8645c1e0 for PDO 0x86412030  
              InstancePath is "USB\ROOT_HUB20\5&2f792170&0"  
              ServiceName is "usbhub"  
              State = DeviceNodeStarted (0x308)  
              Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626aee8 for PDO 0x860bb1e0  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&A8"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626adc8 for PDO 0x86463288  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&A9"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626aca8 for PDO 0x865e4370  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AA"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626ab88 for PDO 0x865acc90  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AB"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626aa68 for PDO 0x865ac958  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AC"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a948 for PDO 0x865ad748  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AD"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a828 for PDO 0x86524e50  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AE"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a708 for PDO 0x86524c70  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&AF"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a5e8 for PDO 0x865e1e50  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B0"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a4c8 for PDO 0x865e1b18  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B1"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a3a8 for PDO 0x865abe50  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B2"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a288 for PDO 0x865abb18  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B3"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x8626a168 for PDO 0x8653a030  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B4"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe008 for PDO 0x8653a5a8  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B5"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbeee8 for PDO 0x8653a270  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B6"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbedc8 for PDO 0x865e2c58  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B7"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbeca8 for PDO 0x865e2920  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B8"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbeb88 for PDO 0x865aae50  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&B9"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbea68 for PDO 0x865aac70  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BA"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe948 for PDO 0x865aa938  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BB"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe828 for PDO 0x865e3e50  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BC"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe708 for PDO 0x865e3c70  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BD"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe5e8 for PDO 0x865e3938  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BE"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe4c8 for PDO 0x86164030  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&BF"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe3a8 for PDO 0x861648a8  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C0"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe288 for PDO 0x86164570  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C1"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x85fbe168 for PDO 0x86164238  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C2"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x86155008 for PDO 0x860bbcf8  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C3"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x86155ee8 for PDO 0x860bb9c0  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C4"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x86155dc8 for PDO 0x860bb688  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C5"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x86155ca8 for PDO 0x865e9e50  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C6"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x86155b88 for PDO 0x865e9b18  
          InstancePath is "PCI\VEN_15AD&DEV_07A0&SUBSYS_00000000&REV_01\3&61aaa01&0&C7"  
          ServiceName is "pci"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x86155a68 for PDO 0x865e3268  
          InstancePath is "ACPI\PNP0C02\4"  
          State = DeviceNodeInitialized (0x302)  
          Previous State = DeviceNodeUninitialized (0x301)  
      DevNode 0x865681c8 for PDO 0x8654f1a8  
        InstancePath is "ACPI\ACPI0003\1"  
        ServiceName is "CmBatt"  
        State = DeviceNodeStarted (0x308)  
        Previous State = DeviceNodeEnumerateCompletion (0x30d)  
      DevNode 0x8657d1c8 for PDO 0x865ca1f8  
        InstancePath is "ACPI\GenuineIntel_-_x86_Family_6_Model_58\_0"  
        ServiceName is "intelppm"  
        State = DeviceNodeStarted (0x308)  
        Previous State = DeviceNodeEnumerateCompletion (0x30d)  
      DevNode 0x865531c8 for PDO 0x865cd200  
        InstancePath is "ACPI\PNP0A05\10"  
        State = DeviceNodeStarted (0x308)  
        Previous State = DeviceNodeEnumerateCompletion (0x30d)  
        DevNode 0x865ace48 for PDO 0x86164a88  
          InstancePath is "ACPI\PNP0A05\20"  
          State = DeviceNodeStarted (0x308)  
          Previous State = DeviceNodeEnumerateCompletion (0x30d)  
      DevNode 0x8653e1c8 for PDO 0x86463f18  
        InstancePath is "ACPI\FixedButton\2&daba3ff&0"  
        State = DeviceNodeStarted (0x308)  
        Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b1780 for PDO 0x865b18c8  
    InstancePath is "Root\COMPOSITE_BATTERY\0000"  
    ServiceName is "Compbatt"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b1540 for PDO 0x865b1688  
    InstancePath is "Root\dmio\0000"  
    ServiceName is "dmio"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b1300 for PDO 0x865b1448  
    InstancePath is "Root\ftdisk\0000"  
    ServiceName is "ftdisk"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
    DevNode 0x864629b8 for PDO 0x86431900  
      InstancePath is "STORAGE\Volume\1&30a96598&0&Signature99639963Offset7000Length9FF662000"  
      ServiceName is "VolSnap"  
      TargetDeviceNotify List - f 0xe14f3868  b 0xe167d340  
      State = DeviceNodeStarted (0x308)  
      Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e8008 for PDO 0x865b1208  
    InstancePath is "Root\LEGACY_AFD\0000"  
    ServiceName is "AFD"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e8dc8 for PDO 0x865e8f10  
    InstancePath is "Root\LEGACY_BEEP\0000"  
    ServiceName is "Beep"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e8b88 for PDO 0x865e8cd0  
    InstancePath is "Root\LEGACY_DMBOOT\0000"  
    ServiceName is "dmboot"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e8948 for PDO 0x865e8a90  
    InstancePath is "Root\LEGACY_DMLOAD\0000"  
    ServiceName is "dmload"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e8628 for PDO 0x865e8770  
    InstancePath is "Root\LEGACY_FIPS\0000"  
    ServiceName is "Fips"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e83e8 for PDO 0x865e8530  
    InstancePath is "Root\LEGACY_GPC\0000"  
    ServiceName is "Gpc"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e81a8 for PDO 0x865e82f0  
    InstancePath is "Root\LEGACY_HTTP\0000"  
    ServiceName is "HTTP"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b0ee8 for PDO 0x865b0030  
    InstancePath is "Root\LEGACY_IPNAT\0000"  
    ServiceName is "IpNat"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b0ca8 for PDO 0x865b0df0  
    InstancePath is "Root\LEGACY_IPSEC\0000"  
    ServiceName is "IPSec"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b0a68 for PDO 0x865b0bb0  
    InstancePath is "Root\LEGACY_KSECDD\0000"  
    ServiceName is "ksecdd"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b0828 for PDO 0x865b0970  
    InstancePath is "Root\LEGACY_MNMDD\0000"  
    ServiceName is "mnmdd"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b05e8 for PDO 0x865b0730  
    InstancePath is "Root\LEGACY_MOUNTMGR\0000"  
    ServiceName is "mountmgr"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b03a8 for PDO 0x865b04f0  
    InstancePath is "Root\LEGACY_NDIS\0000"  
    ServiceName is "NDIS"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865b0168 for PDO 0x865b02b0  
    InstancePath is "Root\LEGACY_NDISTAPI\0000"  
    ServiceName is "NdisTapi"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e7ee8 for PDO 0x865e7030  
    InstancePath is "Root\LEGACY_NDISUIO\0000"  
    ServiceName is "Ndisuio"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e7ca8 for PDO 0x865e7df0  
    InstancePath is "Root\LEGACY_NDPROXY\0000"  
    ServiceName is "NDProxy"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e7a68 for PDO 0x865e7bb0  
    InstancePath is "Root\LEGACY_NETBT\0000"  
    ServiceName is "NetBT"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e7828 for PDO 0x865e7970  
    InstancePath is "Root\LEGACY_NULL\0000"  
    ServiceName is "Null"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e75e8 for PDO 0x865e7730  
    InstancePath is "Root\LEGACY_PARTMGR\0000"  
    ServiceName is "PartMgr"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e73a8 for PDO 0x865e74f0  
    InstancePath is "Root\LEGACY_PARVDM\0000"  
    ServiceName is "ParVdm"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e7168 for PDO 0x865e72b0  
    InstancePath is "Root\LEGACY_RASACD\0000"  
    ServiceName is "RasAcd"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865afee8 for PDO 0x865af030  
    InstancePath is "Root\LEGACY_RDPCDD\0000"  
    ServiceName is "RDPCDD"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865afca8 for PDO 0x865afdf0  
    InstancePath is "Root\LEGACY_TCPIP\0000"  
    ServiceName is "Tcpip"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865afa68 for PDO 0x865afbb0  
    InstancePath is "Root\LEGACY_VGASAVE\0000"  
    ServiceName is "VgaSave"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865af828 for PDO 0x865af970  
    InstancePath is "Root\LEGACY_VMMEMCTL\0000"  
    ServiceName is "VMMEMCTL"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865af4f8 for PDO 0x865af640  
    InstancePath is "Root\LEGACY_VOLSNAP\0000"  
    ServiceName is "VolSnap"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865af2b8 for PDO 0x865af400  
    InstancePath is "Root\LEGACY_WANARP\0000"  
    ServiceName is "Wanarp"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e6008 for PDO 0x865af1c0  
    InstancePath is "Root\LEGACY_WS2IFSL\0000"  
    ServiceName is "WS2IFSL"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e6dc8 for PDO 0x865e6f10  
    InstancePath is "Root\MEDIA\MS_MMACM"  
    ServiceName is "audstub"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e6b88 for PDO 0x865e6cd0  
    InstancePath is "Root\MEDIA\MS_MMDRV"  
    ServiceName is "audstub"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e6948 for PDO 0x865e6a90  
    InstancePath is "Root\MEDIA\MS_MMMCI"  
    ServiceName is "audstub"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e6708 for PDO 0x865e6850  
    InstancePath is "Root\MEDIA\MS_MMVCD"  
    ServiceName is "audstub"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e64c8 for PDO 0x865e6610  
    InstancePath is "Root\MEDIA\MS_MMVID"  
    ServiceName is "audstub"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e6288 for PDO 0x865e63d0  
    InstancePath is "Root\MS_L2TPMINIPORT\0000"  
    ServiceName is "Ras"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865ae008 for PDO 0x865e6190  
    InstancePath is "Root\MS_NDISWANIP\0000"  
    ServiceName is "NdisWan"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865aedc8 for PDO 0x865aef10  
    InstancePath is "Root\MS_PPPOEMINIPORT\0000"  
    ServiceName is "RasPppoe"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865aeb88 for PDO 0x865aecd0  
    InstancePath is "Root\MS_PPTPMINIPORT\0000"  
    ServiceName is "PptpMiniport"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865ae948 for PDO 0x865aea90  
    InstancePath is "Root\MS_PSCHEDMP\0000"  
    ServiceName is "PSched"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865ae708 for PDO 0x865ae850  
    InstancePath is "Root\MS_PSCHEDMP\0001"  
    ServiceName is "PSched"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865ae4c8 for PDO 0x865ae610  
    InstancePath is "Root\MS_PTIMINIPORT\0000"  
    ServiceName is "Raspti"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865ae288 for PDO 0x865ae3d0  
    InstancePath is "Root\RDPDR\0000"  
    ServiceName is "rdpdr"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e5008 for PDO 0x865ae190  
    InstancePath is "Root\RDP_KBD\0000"  
    ServiceName is "TermDD"  
    TargetDeviceNotify List - f 0xe16b4b20  b 0xe16b4b20  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e5dc8 for PDO 0x865e5f10  
    InstancePath is "Root\RDP_MOU\0000"  
    ServiceName is "TermDD"  
    TargetDeviceNotify List - f 0xe16a1aa0  b 0xe16a1aa0  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e5b88 for PDO 0x865e5cd0  
    InstancePath is "Root\SYSTEM\0000"  
    ServiceName is "swenum"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
    DevNode 0x85f7cee8 for PDO 0x86418f10  
      InstancePath is "SW\{cd171de3-69e5-11d2-b56d-0000f8754380}\{9B365890-165F-11D0-A195-0020AFD156E4}"  
      ServiceName is "wdmaud"  
      State = DeviceNodeStarted (0x308)  
      Previous State = DeviceNodeEnumerateCompletion (0x30d)  
    DevNode 0x862e7008 for PDO 0x862e7d80  
      InstancePath is "SW\{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}\{9B365890-165F-11D0-A195-0020AFD156E4}"  
      ServiceName is "sysaudio"  
      State = DeviceNodeStarted (0x308)  
      Previous State = DeviceNodeEnumerateCompletion (0x30d)  
    DevNode 0x8648a930 for PDO 0x8627c6b0  
      InstancePath is "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}"  
      ServiceName is "kmixer"  
      State = DeviceNodeStarted (0x308)  
      Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e5948 for PDO 0x865e5a90  
    InstancePath is "Root\SYSTEM\0001"  
    ServiceName is "update"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e5708 for PDO 0x865e5850  
    InstancePath is "Root\SYSTEM\0002"  
    ServiceName is "mssmbios"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
  DevNode 0x865e54c8 for PDO 0x865e5610  
    InstancePath is "Root\VMWVMCIHOSTDEV\0000"  
    ServiceName is "vmci"  
    State = DeviceNodeStarted (0x308)  
    Previous State = DeviceNodeEnumerateCompletion (0x30d)  
========

windows内核编程 白话设备栈

http://www.cnblogs.com/UnMovedMover/p/4195063.html
在ntddk.h中定义了该函数原型：

#if (NTDDI_VERSION >= NTDDI_WINXP)

NTKERNELAPI

NTSTATUS

IoAttachDeviceToDeviceStackSafe(

    __in  PDEVICE_OBJECT SourceDevice,

    __in  PDEVICE_OBJECT TargetDevice,

    __deref_out PDEVICE_OBJECT *AttachedToDeviceObject

    );

#endif
 
我们加载微软的sfilter源码进行分析

1 创建sfilter的CDO

图1

驱动Sfilter.sys等待 文件系统驱动的加载 SfFsNotification

图2

我们可以看到 Ntfs.sys驱动的CDO地址是0x862c8270

这时候 我们的Sfilter即将创建一个FiDO附着在Ntfs的CDO上面  

图3

新创建的FiDO的地址是0x86337998

而newDeviceObject->DriverObject的驱动地址正是我们的Sfilter的驱动地址

另外newDeviceObject->NextDevice是Sfilter!CDO的地址

这说明，IoCreateDevice的时候，新建的DeviceObject在会插在以往的DO之前 如图4

图4

下面的任务便是附着FiDO于Ntfs驱动的CDO之上 

IoAttachDeviceToDeviceStackSafe(

　　newDeviceObject,

   　DeviceObject,

     &devExt->AttachedToDeviceObject );

继续用winDBG查看

图5

FiDO的地址是0x86337998

FiDO->AttachedDevice的地址是0x00000000 此时FiDO在设备栈的最顶层

现在明了了 DeviceObject->AttachedDevice指向的是上层的设备
图6 

图7

我们用winDBG验证一下

图8
========