IRP和IO_STACK_LOCATION的内存分布

画这个图的目的主要是为了反编译驱动之后的地址计算

 

0

            

15

   

31

DS:0x0000

Type

Size

DS:0x0004

MdlAddress

DS:0x0008

Flags

DS:0x000C

AssociatedIrp

DS:0x0010

ThreadListEntry.Flink

DS:0x0014

ThreadListEntry.Blink

DS:0x0018

IoStatus

DS:0x001C

IoStatus

DS:0x0020

RequestorMode

PendingReturned

StackCount

CurrentLocation

DS:0x0024

Cancel

CancelIrql

ApcEnvironment

AllocationFlags

DS:0x0028

UserIosb

DS:0x002C

UserIosb

DS:0x0030

UserEvent

DS:0x0034

Overlay

DS:0x0038

Overlay

DS:0x003C

CancelRoutine

DS:0x0040

UserBuffer

DS:0x0044

Tail. Overlay. DriverContext[0]

DS:0x0048

Tail. Overlay. DriverContext[1]

DS:0x004C

Tail. Overlay. DriverContext[2]

DS:0x0050

Tail. Overlay. DriverContext[3]

DS:0x0054

Tail.Overlay.Thread

DS:0x0058

Tail.Overlay.AuxiliaryBuffer

DS:0x005C

Tail.Overlay.ListEntry.Flink

DS:0x0060

Tail.Overlay.ListEntry.Blink

DS:0x0064

Tail.Overlay.PIO_STACK_LOCATION

DS:0x0068

Tail.Overlay.OriginalFileObject

DS:0x006C

Apc

DS:0x0070

CompletionKey

 

 

 

 

 

 

0

            

15

   

31

DS:0x0000

MajorFunction  

MinorFunction  

Flags         

Control

DS:0x0004

Parameters

DS:0x0008

Parameters

DS:0x000C

Parameters

DS:0x0010

Parameters

DS:0x0014

DeviceObject

DS:0x0018

FileObject

DS:0x001C

CompletionRoutine

DS:0x0020

Context

 


你可能感兴趣的:(IRP和IO_STACK_LOCATION的内存分布)