Crash Dump Analysis Patterns (Part 25e)
Device Stack Trace analysis pattern is about the analysis of a hierarchy of devices based on the current location of IRP Stack Trace:
0: kd> !irp ffffffa80095e6c10
Irp is active with 7 stacks 6 is current (= 0xfffffa80095e6e48)
No Mdl: System buffer=fffffa8007b52380: Thread fffffa8007486060: Irp stack trace.
cmd flg cl Device File Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 fffffa8008b045f0 00000000 00000000
>[IRP_MJ_DEVICE_CONTROL(e), N/A(0)]
5 0 fffffa80095e6060 fffffa8009883b60 00000000-00000000
\Driver\usbscan
Args: 00000000 00000010 80002010 00000000
[IRP_MJ_DEVICE_CONTROL(e), N/A(0)]
5 0 fffffa8007ee4bd0 fffffa8009883b60 00000000-00000000
\Driver\ksthunk
Args: 00000000 00000010 80002010 00000000
0: kd> !devstack fffffa80095e6060
!DevObj !DrvObj !DevExt ObjectName
fffffa8007ee4bd0 \Driver\ksthunk fffffa8007ee4d20 00000098
> fffffa80095e6060 \Driver\usbscan fffffa80095e61b0 Usbscan0
fffffa80073a3060 \Driver\DriverA fffffa8007e767e0 00000097
[…]
0: kd> !devobj fffffa8007ee4bd0
Device object (fffffa8007ee4bd0) is for:
00000098 \Driver\ksthunk DriverObject fffffa8006396c60
Current Irp 00000000 RefCount 0 Type 00000019 Flags 00002050
Dacl fffff9a100099e11 DevExt fffffa8007ee4d20 DevObjExt fffffa8007ee4d28
ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
Characteristics (0000000000)
AttachedTo (Lower) fffffa80095e6060 \Driver\usbscan
Device queue is not busy.
0: kd> !devobj fffffa80095e6060
Device object (fffffa80095e6060) is for:
Usbscan0 \Driver\usbscan DriverObject fffffa8007943570
Current Irp 00000000 RefCount 3 Type 00000019 Flags 00002050
Dacl fffff9a100099e11 DevExt fffffa80095e61b0 DevObjExt fffffa80095e6530
ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
Characteristics (0000000000)
AttachedDevice (Upper) fffffa8007ee4bd0 \Driver\ksthunk
AttachedTo (Lower) fffffa80073a3060 \Driver\DriverA
Device queue is not busy.
0: kd> !devobj fffffa80073a3060
Device object (fffffa80073a3060) is for:
00000097 \Driver\DriverA DriverObject fffffa80063bd540
Current Irp 00000000 RefCount 1 Type 00000022 Flags 00003044
Dacl fffff9a100099e11 DevExt fffffa8007e767e0 DevObjExt fffffa80073a31d8 DevNode fffffa80086e1cb0
ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
Characteristics (0x00000080) FILE_AUTOGENERATED_DEVICE_NAME
AttachedDevice (Upper) fffffa80095e6060 \Driver\usbscan
Device queue is not busy.
The direction of device Stack Trace is from top to bottom, opposite to I/O Request Stack Trace which is from bottom to top.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -