news 2026/4/3 6:23:49

从nt!PipEnumerateDevice到ACPI!ACPIRootIrpQueryDeviceRelations--重要

作者头像

张小明

前端开发工程师

1.2k 24
文章封面图
从nt!PipEnumerateDevice到ACPI!ACPIRootIrpQueryDeviceRelations--重要

从nt!PipEnumerateDevice到ACPI!ACPIRootIrpQueryDeviceRelations
0: kd> p
Breakpoint 96 hit
eax=00000000 ebx=00000000 ecx=899c1de0 edx=80b18978 esi=00000000 edi=899c1008
eip=80a2ec74 esp=f789a330 ebp=f789a38c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!PipSetDevNodeState:
80a2ec74 55 push ebp
0: kd> dv
DeviceNode = 0x899c1008
State = DeviceNodeStarted (0n776)
OldState = 0x00000000
oldIrql = 0x89 ''
0: kd> gu
eax=00000000 ebx=00000000 ecx=80ae0dfa edx=80b18978 esi=00000000 edi=899c1008
eip=80c926f1 esp=f789a340 ebp=f789a38c iopl=0 nv up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000283
nt!PipProcessStartPhase3+0x3cb:
80c926f1 33c0 xor eax,eax
0: kd> !DeviceNode 0x899c1008
No export DeviceNode found
0: kd> !DevNode 0x899c1008
DevNode 0x899c1008 for PDO 0x899c1de0
Parent 0x89986008 Sibling 0000000000 Child 0000000000
InstancePath is "ACPI_HAL\PNP0C08\0"
ServiceName is "ACPI"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeStartPostWork (0x307)
StateHistory[05] = DeviceNodeStartPostWork (0x307)
StateHistory[04] = DeviceNodeStartCompletion (0x306)
StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
StateHistory[02] = DeviceNodeDriversAdded (0x303)
StateHistory[01] = DeviceNodeInitialized (0x302)
StateHistory[00] = DeviceNodeUninitialized (0x301)
StateHistory[19] = Unknown State (0x0)
StateHistory[18] = Unknown State (0x0)
StateHistory[17] = Unknown State (0x0)
StateHistory[16] = Unknown State (0x0)
StateHistory[15] = Unknown State (0x0)
StateHistory[14] = Unknown State (0x0)
StateHistory[13] = Unknown State (0x0)
StateHistory[12] = Unknown State (0x0)
StateHistory[11] = Unknown State (0x0)
StateHistory[10] = Unknown State (0x0)
StateHistory[09] = Unknown State (0x0)
StateHistory[08] = Unknown State (0x0)
StateHistory[07] = Unknown State (0x0)
StateHistory[06] = Unknown State (0x0)
Flags (0x000000f8) DNF_REENUMERATE, DNF_ENUMERATED,
DNF_IDS_QUERIED, DNF_HAS_BOOT_CONFIG,
DNF_BOOT_CONFIG_RESERVED
CapabilityFlags (0x000000c0) UniqueID, SilentInstall

case DeviceNodeStarted:

nextNode = ChildNode;
if (!ProcessOnlyIntermediateStates) {

if ((currentNode->Flags & DNF_REENUMERATE)) {

status = PipEnumerateDevice(currentNode, Synchronous);
if (NT_SUCCESS(status)) {

//
// Remember the bus we just enumerated.
//

enumeratedBus = currentNode;
nextNode = SameNode;

} else if (status == STATUS_PENDING) {

nextNode = SiblingNode;
}
}
}
break;


0: kd> kc
#
00 nt!PipEnumerateDevice
01 nt!PipProcessDevNodeTree
02 nt!PipDeviceActionWorker
03 nt!PipRequestDeviceAction
04 nt!IopInitializeBootDrivers
05 nt!IoInitSystem
06 nt!Phase1Initialization
07 nt!PspSystemThreadStartup
08 nt!KiThreadStartup
0: kd> dv
DeviceNode = 0x899c1008
Synchronous = 0x00 ''
0: kd> !DevNode 0x899c1008
DevNode 0x899c1008 for PDO 0x899c1de0
Parent 0x89986008 Sibling 0000000000 Child 0000000000
InstancePath is "ACPI_HAL\PNP0C08\0"
ServiceName is "ACPI"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeStartPostWork (0x307)
StateHistory[05] = DeviceNodeStartPostWork (0x307)
StateHistory[04] = DeviceNodeStartCompletion (0x306)
StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
StateHistory[02] = DeviceNodeDriversAdded (0x303)
StateHistory[01] = DeviceNodeInitialized (0x302)
StateHistory[00] = DeviceNodeUninitialized (0x301)
StateHistory[19] = Unknown State (0x0)
StateHistory[18] = Unknown State (0x0)
StateHistory[17] = Unknown State (0x0)
StateHistory[16] = Unknown State (0x0)
StateHistory[15] = Unknown State (0x0)
StateHistory[14] = Unknown State (0x0)
StateHistory[13] = Unknown State (0x0)
StateHistory[12] = Unknown State (0x0)
StateHistory[11] = Unknown State (0x0)
StateHistory[10] = Unknown State (0x0)
StateHistory[09] = Unknown State (0x0)
StateHistory[08] = Unknown State (0x0)
StateHistory[07] = Unknown State (0x0)
StateHistory[06] = Unknown State (0x0)
Flags (0x000000f8) DNF_REENUMERATE, DNF_ENUMERATED,
DNF_IDS_QUERIED, DNF_HAS_BOOT_CONFIG,
DNF_BOOT_CONFIG_RESERVED
CapabilityFlags (0x000000c0) UniqueID, SilentInstall


0: kd> kc
#
00 nt!IopQueryDeviceRelations
01 nt!PipEnumerateDevice
02 nt!PipProcessDevNodeTree
03 nt!PipDeviceActionWorker
04 nt!PipRequestDeviceAction
05 nt!IopInitializeBootDrivers
06 nt!IoInitSystem
07 nt!Phase1Initialization
08 nt!PspSystemThreadStartup
09 nt!KiThreadStartup
0: kd> dv
Relations = BusRelations (0n0)
DeviceObject = 0x899c1de0 Device for "\Driver\ACPI_HAL"
Synchronous = 0x00 ''
DeviceRelations = 0x899c10e8
irpSp = struct _IO_STACK_LOCATION
0: kd> dx -r1 ((ntkrnlmp!_DEVICE_RELATIONS * *)0x899c10e8)
((ntkrnlmp!_DEVICE_RELATIONS * *)0x899c10e8) : 0x899c10e8 [Type: _DEVICE_RELATIONS * *]
0x0 [Type: _DEVICE_RELATIONS *]


irpSp.Parameters.QueryDeviceRelations.Type = Relations;

//
// Make the call and return.
//
status = IopSynchronousCall(DeviceObject, &irpSp, (PULONG_PTR)DeviceRelations);

if (Relations == BusRelations) {

deviceNode->CompletionStatus = status;

PipSetDevNodeState( deviceNode, DeviceNodeEnumerateCompletion, NULL );

status = STATUS_SUCCESS;
}

return status;
}
0: kd> kc
#
00 nt!IopSynchronousCall
01 nt!IopQueryDeviceRelations
02 nt!PipEnumerateDevice
03 nt!PipProcessDevNodeTree
04 nt!PipDeviceActionWorker
05 nt!PipRequestDeviceAction
06 nt!IopInitializeBootDrivers
07 nt!IoInitSystem
08 nt!Phase1Initialization
09 nt!PspSystemThreadStartup
0a nt!KiThreadStartup
0: kd> d
@$debuggerRootNamespace
Debugger
Sessions
Settings
State
Utility
0: kd> dv
DeviceObject = 0x899c1de0 Device for "\Driver\ACPI_HAL"
TopStackLocation = 0xf789a348 IRP_MJ_PNP / IRP_MN_QUERY_DEVICE_RELATIONS for {...}
Information = 0x899c10e8
event = struct _KEVENT
statusBlock = struct _IO_STATUS_BLOCK
deviceObject = 0x00000008

0: kd> g
Breakpoint 81 hit
eax=0000001b ebx=00000000 ecx=89981f38 edx=899bf5b0 esi=899bf5b0 edi=89981b98
eip=f7403f70 esp=f789a2e4 ebp=f789a2fc iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
ACPI!ACPIDispatchIrp:
f7403f70 55 push ebp
0: kd> kc
#
00 ACPI!ACPIDispatchIrp
01 nt!IofCallDriver
02 nt!IopSynchronousCall
03 nt!IopQueryDeviceRelations
04 nt!PipEnumerateDevice
05 nt!PipProcessDevNodeTree
06 nt!PipDeviceActionWorker
07 nt!PipRequestDeviceAction
08 nt!IopInitializeBootDrivers
09 nt!IoInitSystem
0a nt!Phase1Initialization
0b nt!PspSystemThreadStartup
0c nt!KiThreadStartup

//
// Reference the device
//
InterlockedIncrement(&deviceExtension->OutstandingIrpCount);

//
// Dispatch to handler, then remove our reference
//
status = dispatch (DeviceObject, Irp);

0: kd> kc
#
00 ACPI!ACPIRootIrpQueryDeviceRelations
01 ACPI!ACPIDispatchIrp
02 nt!IofCallDriver
03 nt!IopSynchronousCall
04 nt!IopQueryDeviceRelations
05 nt!PipEnumerateDevice
06 nt!PipProcessDevNodeTree
07 nt!PipDeviceActionWorker
08 nt!PipRequestDeviceAction
09 nt!IopInitializeBootDrivers
0a nt!IoInitSystem
0b nt!Phase1Initialization
0c nt!PspSystemThreadStartup
0d nt!KiThreadStartup
0: kd> dv
DeviceObject = 0x89981b98 Device for "\Driver\ACPI"
Irp = 0x899bf5b0
deviceExtension = 0x00000000
deviceRelations = 0xf744edca
minorFunction = 0xb0 ''
queryEvent = struct _KEVENT
checkForFilters = 0x00 ''


参考:
0: kd> kc
#
00 ACPI!InternalOpRegionHandler
01 ACPI!AccessBaseField
02 ACPI!AccessFieldData
03 ACPI!ReadFieldObj
04 ACPI!RunContext
05 ACPI!InsertReadyQueue
06 ACPI!RestartContext
07 ACPI!SyncEvalObject
08 ACPI!AMLIEvalNameSpaceObject
09 ACPI!ACPIGet
0a ACPI!ACPIDetectPdoDevices
0b ACPI!ACPIRootIrpQueryBusRelations
0c ACPI!ACPIRootIrpQueryDeviceRelations
0d ACPI!ACPIDispatchIrp
0e nt!IofCallDriver
0f nt!IopSynchronousCall
10 nt!IopQueryDeviceRelations
11 nt!PipEnumerateDevice
12 nt!PipProcessDevNodeTree
13 nt!PipDeviceActionWorker
14 nt!PipRequestDeviceAction
15 nt!IopInitializeBootDrivers
16 nt!IoInitSystem
17 nt!Phase1Initialization
18 nt!PspSystemThreadStartup
19 nt!KiThreadStartup
参考:

版权声明: 本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若内容造成侵权/违法违规/事实不符,请联系邮箱:809451989@qq.com进行投诉反馈,一经查实,立即删除!
网站建设 2026/4/1 16:51:19

指纹浏览器的 “安全密码”:从内核定制到场景落地

在多账号运营、数据采集的场景中,指纹浏览器的核心价值在于通过环境隔离与特征模拟,规避平台风控检测,实现账号的安全运行。其技术架构围绕内核定制、指纹模拟、网络优化三大核心模块展开,各模块协同作用,构建独立的运…

作者头像 李华
网站建设 2026/4/2 3:25:11

AI解码金银历史级暴跌“密码”:沃什提名,是巧合还是另有隐情?

摘要:本文通过运用AI数据挖掘模型对金融市场历史数据与实时舆情数据进行深度剖析,结合美联储主席提名事件、宏观经济指标预期以及市场交易行为等多维度因素,分析黄金白银价格历史级暴跌现象及其背后成因。 上周五黄金白银市场遭遇了一场“惊涛…

作者头像 李华
网站建设 2026/3/28 19:12:04

清单来了:8个AI论文平台深度测评,自考毕业论文+格式规范全攻略

在当前学术写作日益依赖智能化工具的背景下,无论是高校师生还是自考学生,都面临着选题困难、文献检索繁琐、格式规范不熟悉等普遍问题。尤其对于自考群体而言,时间有限且缺乏系统指导,更需要高效、可靠的辅助工具来完成毕业论文的…

作者头像 李华