kd> !idt
Dumping IDT:
37: 80a6e030 hal!PicSpuriousService37
3d: 80a6f2d4 hal!HalpApcInterrupt
41: 80a6f128 hal!HalpDispatchInterrupt
50: 80a6e108 hal!HalpApicRebootService
51: 810ecdd4 serial!SerialCIsrSw (KINTERRUPT 810ecd98)
52: 810f6544 i8042prt!I8042MouseInterruptService (KINTERRUPT 810f6508)
72: 81216bcc atapi!IdePortInterrupt (KINTERRUPT 81216b90)
83: 8110f2ac USBPORT!USBPORT_InterruptService (KINTERRUPT 8110f270)
92: 81276dd4 atapi!IdePortInterrupt (KINTERRUPT 81276d98)
93: 81152044 NDIS!ndisMIsr (KINTERRUPT 81152008)
a3: 8126b044 SCSIPORT!ScsiPortInterrupt (KINTERRUPT 8126b008)
b1: 81231044 ACPI!ACPIInterruptServiceRoutine (KINTERRUPT 81231008)
b3: 810f79ac i8042prt!I8042KeyboardInterruptService (KINTERRUPT 810f7970)
c1: 80a6e290 hal!HalpBroadcastCallService
d1: 80a6d624 hal!HalpClockInterrupt
e1: 80a6e6a0 hal!HalpIpiHandler
e3: 80a6e4c8 hal!HalpLocalApicErrorService
fd: 80a6ec0c hal!HalpProfileInterrupt
ndis!ndisMIsr 是ndis driver的universal ISR, 且看它如何dispatch ndis interrupt.
kd> bp ndis!ndisMIsr
kd> g
Breakpoint 0 hit
NDIS!ndisMIsr:
fc6db0aa mov edi,edi
kd> dds @esp L10
fc0f4730 8081f170 nt!KiInterruptDispatch+0x40
fc0f4734 81152008 ; _KINTERRUPT
fc0f4738 810d45dc ; _KINTERRUPT.ServiceContext
fc0f473c 00010008 ; it seems 1 is SharedVector, 8 is Irql, but i'm not sure...
fc0f4740 00000193 ; interrupt vector
fc0f4744 00000000
fc0f4748 81152002
fc0f474c 00000193
fc0f4750 fc0f47dc
fc0f4754 80a6ea8a hal!KfLowerIrql+0x12
fc0f4758 badb0d00
fc0f475c 00001090
fc0f4760 00000000
fc0f4764 00000000
fc0f4768 00000000
fc0f476c 00000000
kd> dt nt!_KINTERRUPT 81152008
+0x000 Type : 22
+0x002 Size : 484
+0x004 InterruptListEntry : _LIST_ENTRY [ 0x8115200c - 0x8115200c ]
+0x00c ServiceRoutine : 0xfc6db0aa NDIS!ndisMIsr+0
+0x010 ServiceContext : 0x810d45dc ; here, the ServiceContext is actually a
; ndis!_NDIS_MINIPORT_INTERRUPT structure
+0x014 SpinLock : 0
+0x018 TickCount : 0xffffffff
+0x01c ActualLock : 0x8115226c -> 0
+0x020 DispatchAddress : 0x8081f130 nt!KiInterruptDispatch+0
+0x024 Vector : 0x193
+0x028 Irql : 0x8 ''
+0x029 SynchronizeIrql : 0x8 ''
+0x02a FloatingSave : 0 ''
+0x02b Connected : 0x1 ''
+0x02c Number : 0 ''
+0x02d ShareVector : 0x1 ''
+0x030 Mode : 0 ( LevelSensitive )
+0x034 ServiceCount : 0
+0x038 DispatchCount : 0xffffffff
+0x03c DispatchCode : [106] 0x56535554
kd> dt 0x810d45dc ndis!_NDIS_MINIPORT_INTERRUPT
+0x000 InterruptObject : 0x81152008
+0x004 DpcCountLock : 0
+0x008 Reserved : 0x810d4500
+0x00c MiniportIsr : 0xfca576c6 pcntpci5!LanceISR+0
+0x010 MiniportDpc : 0xfca57e8a pcntpci5!LanceHandleInterruptWithLock+0
+0x014 InterruptDpc : _KDPC
+0x034 Miniport : 0x810ee838
+0x038 DpcCount : 0 ''
+0x039 Filler1 : 0 ''
+0x03c DpcsCompletedEvent : _KEVENT
+0x04c SharedInterrupt : 0x1 ''
+0x04d IsrRequested : 0 ''
let's take a look at what ndis!ndisMIsr does...
kd> uf NDIS!ndisMIsr
NDIS!ndisMIsr:
fc6db0aa mov edi,edi
fc6db0ac push ebp
fc6db0ad mov ebp,esp
fc6db0af push ecx
fc6db0b0 push esi
fc6db0b1 mov esi,[ebp+0xc] ;_KINTERRUPT.ServiceContext
fc6db0b4 mov eax,[esi+0x34] ;@eax should be _NDIS_MINIPORT_INTERRUPT.Miniport,
;just dt _NDIS_MINIPORT_INTERRUPT can get this fact,
;which is _NDIS_MINIPORT_BLOCK type
;let's abbreviate this block as NMB)
;abbreviate _NDIS_MINIPORT_INTERRUPT as NMI
fc6db0b7 push edi
fc6db0b8 push dword ptr [esi+0x8]
fc6db0bb mov byte ptr [ebp+0xf],0x0
fc6db0bf test byte ptr [eax+0x3c],0x1 ; 0
fc6db0c3 jne NDIS!ndisMIsr+0x1b (fc6dd5ee) ; no jmp
NDIS!ndisMIsr+0x1b:
fc6dd5ee mov eax,[eax+0x8]
fc6dd5f1 call dword ptr [eax+0x2c]
fc6dd5f4 mov byte ptr [ebp+0xf],0x1
fc6dd5f8 mov byte ptr [ebp-0x1],0x1
fc6dd5fc jmp NDIS!ndisMIsr+0x3c (fc6db0da)
NDIS!ndisMIsr+0x2b:
fc6db0c9 lea eax,[ebp+0xf]
fc6db0cc push eax ; QueueMiniportHandleInterrupt
fc6db0cd lea eax,[ebp-0x1]
fc6db0d0 push eax ; InterruptRecognized
fc6db0d1 call dword ptr [esi+0xc] ; call pcntpci5!LanceISR+0, NMI.MiniportIsr
fc6db0d4 cmp byte ptr [ebp+0xf],0x0 ; QueueMiniportHandleInterrupt == TRUE ?
fc6db0d8 jz NDIS!ndisMIsr+0x5f (fc6db0fa) ; QueueMiniportHandleInterrupt == FALSE
; jmp to exit ndisMIsr
;
; QueueMiniportHandleInterrupt == TRUE, according to DDK, NDIS will
; queue a DPC (in term of NDIS, it's NdisHandleInterrupt routine,
; which is set in NDIS_MINIPORT_CHARACTERISTICS.HandleInterruptHandler)
;
NDIS!ndisMIsr+0x3c:
fc6db0da xor eax,eax
fc6db0dc lea edi,[esi+0x38]
fc6db0df inc eax
fc6db0e0 lock xadd [edi],eax ; increase DPC count
fc6db0e4 push 0x0
fc6db0e6 push 0x0
fc6db0e8 add esi,0x14
fc6db0eb push esi ; NDIS!ndisMDpcX
fc6db0ec call dword ptr [NDIS!_imp__KeInsertQueueDpc (fc6c5198)] ; Queue DPC routine
fc6db0f2 test al,al
fc6db0f4 je NDIS!ndisMIsr+0x58 (fc6dd601)
NDIS!ndisMIsr+0x58:
fc6dd601 or eax,0xffffffff ; DPC is already in DPC Queue, so decrease DPC count
; return FALSE
fc6dd604 lock xadd [edi],eax
fc6dd608 jmp NDIS!ndisMIsr+0x5f (fc6db0fa)
NDIS!ndisMIsr+0x5f:
fc6db0fa mov al,[ebp-0x1]
fc6db0fd pop edi
fc6db0fe pop esi
fc6db0ff leave
fc6db100 ret 0x8
kd> dt ndis!_NDIS_MINIPORT_INTERRUPT @esi -r1
+0x000 InterruptObject : 0x81152008
+0x004 DpcCountLock : 0
+0x008 Reserved : 0x810d4500
+0x00c MiniportIsr : 0xfca576c6 pcntpci5!LanceISR+0
+0x010 MiniportDpc : 0xfca57e8a pcntpci5!LanceHandleInterruptWithLock+0
+0x014 InterruptDpc : _KDPC
+0x000 Type : 0x13 ''
+0x001 Importance : 0 ''
+0x002 Number : 0 ''
+0x003 Expedite : 0 ''
+0x004 DpcListEntry : _LIST_ENTRY [ 0x810f2234 - 0xffdffa40 ]
+0x00c DeferredRoutine : 0xfc6db108 NDIS!ndisMDpcX+0
+0x010 DeferredContext : 0x810d45dc
+0x014 SystemArgument1 : (null)
+0x018 SystemArgument2 : (null)
+0x01c DpcData : (null)
+0x034 Miniport : 0x810ee838
+0x000 Signature : 0x504d444e
+0x004 NextMiniport : (null)
+0x008 DriverHandle : 0x8111c708
+0x00c MiniportAdapterContext : 0x810d4500
+0x010 MiniportName : _UNICODE_STRING "/DEVICE/{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x018 BindPaths : 0x81114a78
+0x01c OpenQueue : 0xffa298d8
+0x020 ShortRef : _REFERENCE
+0x028 DeviceContext : (null)
+0x02c Padding1 : 0 ''
+0x02d LockAcquired : 0 ''
+0x02e PmodeOpens : 0 ''
+0x02f AssignedProcessor : 0 ''
+0x030 Lock : 0
+0x034 MediaRequest : (null)
+0x038 Interrupt : 0x810d45dc
+0x03c Flags : 0x2c452008
+0x040 PnPFlags : 0x210000
+0x044 PacketList : _LIST_ENTRY [ 0x810ee87c - 0x810ee87c ]
+0x04c FirstPendingPacket : (null)
+0x050 ReturnPacketsQueue : (null)
+0x054 RequestBuffer : 0xb
+0x058 SetMCastBuffer : (null)
+0x05c PrimaryMiniport : 0x810ee838
+0x060 WrapperContext : 0x810ee7f0
+0x064 BusDataContext : 0x81218898
+0x068 PnPCapabilities : 0x30
+0x06c Resources : (null)
+0x070 WakeUpDpcTimer : _NDIS_TIMER
+0x0b8 BaseName : _UNICODE_STRING "{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x0c0 SymbolicLinkName : _UNICODE_STRING "/??/PCI#VEN_1022&DEV_2000&SUBSYS_20001022&REV_10#3&61aaa01&0&88#{ad498944-762f-11d0-8dcb-00c04fc3358c}/{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x0c8 CheckForHangSeconds : 2
+0x0cc CFHangTicks : 1
+0x0ce CFHangCurrentTick : 1
+0x0d0 ResetStatus : 0
+0x0d4 ResetOpen : (null)
+0x0d8 EthDB : 0x810dca68
+0x0d8 NullDB : 0x810dca68
+0x0dc TrDB : (null)
+0x0e0 FddiDB : (null)
+0x0e4 ArcDB : (null)
+0x0e8 PacketIndicateHandler : 0xfc6e6005 NDIS!ethFilterDprIndicateReceivePacket+0
+0x0ec SendCompleteHandler : 0xfc6d7180 NDIS!ndisMSendCompleteX+0
+0x0f0 SendResourcesHandler : 0xfc6dd86d NDIS!NdisMSendResourcesAvailable+0
+0x0f4 ResetCompleteHandler : 0xfc6dff74 NDIS!NdisMResetComplete+0
+0x0f8 MediaType : 0 ( NdisMedium802_3 )
+0x0fc BusNumber : 0
+0x100 BusType : 5 ( NdisInterfacePci )
+0x104 AdapterType : 5 ( NdisInterfacePci )
+0x108 DeviceObject : 0x810ee738
+0x10c PhysicalDeviceObject : 0x812187e0
+0x110 NextDeviceObject : 0x812187e0
+0x114 MapRegisters : 0x811414e8
+0x118 CallMgrAfList : (null)
+0x11c MiniportThread : (null)
+0x120 SetInfoBuf : (null)
+0x124 SetInfoBufLen : 0
+0x126 MaxSendPackets : 4
+0x128 FakeStatus : 0
+0x12c LockHandler : 0xfc6dc9fd
+0x130 pAdapterInstanceName : 0x81117268 "AMD PCNET Family PCI Ethernet Adapter"
+0x134 TimerQueue : (null)
+0x138 MacOptions : 0x8f
+0x13c PendingRequest : (null)
+0x140 MaximumLongAddresses : 0x20
+0x144 MaximumShortAddresses : 0
+0x148 CurrentLookahead : 0x80
+0x14c MaximumLookahead : 0x200
+0x150 HandleInterruptHandler : 0xfca57e8a pcntpci5!LanceHandleInterruptWithLock+0
+0x154 DisableInterruptHandler : 0xfca57676 pcntpci5!LanceDisableInterrupt+0
+0x158 EnableInterruptHandler : 0xfca57626 pcntpci5!LanceEnableInterrupt+0
+0x15c SendPacketsHandler : 0xfc6d764c NDIS!ndisMSendPacketsX+0
+0x160 DeferredSendHandler : 0xfc6d789a NDIS!ndisMStartSendPackets+0
+0x164 EthRxIndicateHandler : 0xfc6e6ef1 NDIS!EthFilterDprIndicateReceive+0
+0x168 TrRxIndicateHandler : 0xfc6e853f NDIS!TrFilterDprIndicateReceive+0
+0x16c FddiRxIndicateHandler : 0xfc6e5044 NDIS!FddiFilterDprIndicateReceive+0
+0x170 EthRxCompleteHandler : 0xfc6e646d NDIS!EthFilterDprIndicateReceiveComplete+0
+0x174 TrRxCompleteHandler : 0xfc6e83eb NDIS!TrFilterDprIndicateReceiveComplete+0
+0x178 FddiRxCompleteHandler : 0xfc6e45f8 NDIS!FddiFilterDprIndicateReceiveComplete+0
+0x17c StatusHandler : 0xfc6dc3c2 NDIS!NdisMIndicateStatus+0
+0x180 StatusCompleteHandler : 0xfc6dd270 NDIS!NdisMIndicateStatusComplete+0
+0x184 TDCompleteHandler : 0xfc6d8715 NDIS!NdisMTransferDataComplete+0
+0x188 QueryCompleteHandler : 0xfc6de0f3 NDIS!NdisMQueryInformationComplete+0
+0x18c SetCompleteHandler : 0xfc6deda3 NDIS!NdisMSetInformationComplete+0
+0x190 WanSendCompleteHandler : 0xfc6d7e92 NDIS!NdisMWanSendComplete+0
+0x194 WanRcvHandler : 0xfc6dc1e8 NDIS!NdisMWanIndicateReceive+0
+0x198 WanRcvCompleteHandler : 0xfc6dc18f NDIS!NdisMWanIndicateReceiveComplete+0
+0x19c NextGlobalMiniport : (null)
+0x1a0 WorkQueue : [7] _SINGLE_LIST_ENTRY
+0x1bc SingleWorkItems : [6] _SINGLE_LIST_ENTRY
+0x1d4 SendFlags : 0x1 ''
+0x1d5 TrResetRing : 0 ''
+0x1d6 ArcnetAddress : 0 ''
+0x1d7 XState : 0 ''
+0x1d8 ArcBuf : (null)
+0x1d8 BusInterface : (null)
+0x1dc Log : (null)
+0x1e0 SlotNumber : 0xffffffff
+0x1e4 AllocatedResources : 0x810e75a0
+0x1e8 AllocatedResourcesTranslated : 0x810e75e4
+0x1ec PatternList : _SINGLE_LIST_ENTRY
+0x1f0 PMCapabilities : _NDIS_PNP_CAPABILITIES
+0x200 DeviceCaps : _DEVICE_CAPABILITIES
+0x240 WakeUpEnable : 0
+0x244 CurrentDevicePowerState : 1 ( PowerDeviceD0 )
+0x248 pIrpWaitWake : (null)
+0x24c WaitWakeSystemState : 0 ( PowerSystemUnspecified )
+0x250 VcIndex : _LARGE_INTEGER 0x0
+0x258 VcCountLock : 0
+0x25c WmiEnabledVcs : _LIST_ENTRY [ 0x810eea94 - 0x810eea94 ]
+0x264 pNdisGuidMap : 0xffa6d870
+0x268 pCustomGuidMap : 0xffa6df70
+0x26c VcCount : 0
+0x26e cNdisGuidMap : 0x45
+0x270 cCustomGuidMap : 5
+0x272 CurrentMapRegister : 0
+0x274 AllocationEvent : 0xfcd6e58c
+0x278 BaseMapRegistersNeeded : 0x40
+0x27a SGMapRegistersNeeded : 0x10
+0x27c MaximumPhysicalMapping : 0x600
+0x280 MediaDisconnectTimer : _NDIS_TIMER
+0x2c8 MediaDisconnectTimeOut : 0xffff
+0x2ca InstanceNumber : 1
+0x2cc OpenReadyEvent : _NDIS_EVENT
+0x2dc PnPDeviceState : 1 ( NdisPnPDeviceStarted )
+0x2e0 OldPnPDeviceState : 0 ( NdisPnPDeviceAdded )
+0x2e4 SetBusData : 0xfc89e030 pci!PciPnpWriteConfig+0
+0x2e8 GetBusData : 0xfc89e006 pci!PciPnpReadConfig+0
+0x2ec DeferredDpc : _KDPC
+0x310 NdisStats : _NDIS_STATS
+0x328 IndicatedPacket : [32] (null)
+0x3a8 RemoveReadyEvent : (null)
+0x3ac AllOpensClosedEvent : (null)
+0x3b0 AllRequestsCompletedEvent : (null)
+0x3b4 InitTimeMs : 0xda
+0x3b8 WorkItemBuffer : [6] _NDIS_MINIPORT_WORK_ITEM
+0x400 SystemAdapterObject : 0x810d4490
+0x404 DriverVerifyFlags : 0
+0x408 OidList : 0xffa0a008
+0x40c InternalResetCount : 0
+0x40e MiniportResetCount : 0
+0x410 MediaSenseConnectCount : 1
+0x412 MediaSenseDisconnectCount : 0
+0x414 xPackets : (null)
+0x418 UserModeOpenReferences : 0
+0x41c SavedSendHandler : 0xfc6bf2b6
+0x41c SavedWanSendHandler : 0xfc6bf2b6
+0x420 SavedSendPacketsHandler : 0xfc6d764c NDIS!ndisMSendPacketsX+0
+0x424 SavedCancelSendPacketsHandler : (null)
+0x428 WSendPacketsHandler : 0xfca5a332 pcntpci5!LanceSendPackets+0
+0x42c MiniportAttributes : 0x28
+0x430 SavedSystemAdapterObject : (null)
+0x434 NumOpens : 2
+0x436 CFHangXTicks : 0
+0x438 RequestCount : 0
+0x43c IndicatedPacketsCount : 0
+0x440 PhysicalMediumType : 0
+0x444 LastRequest : 0xff837cd0
+0x448 DmaAdapterRefCount : 3
+0x44c FakeMac : 0x810cda30
+0x450 LockDbg : 0
+0x454 LockDbgX : 0
+0x458 LockThread : (null)
+0x45c InfoFlags : 0xa010a11
+0x460 TimerQueueLock : 0
+0x464 ResetCompletedEvent : (null)
+0x468 QueuedBindingCompletedEvent : (null)
+0x46c DmaResourcesReleasedEvent : (null)
+0x470 SavedPacketIndicateHandler : 0xfc6e6005 NDIS!ethFilterDprIndicateReceivePacket+0
+0x474 RegisteredInterrupts : 1
+0x478 SGListLookasideList : (null)
+0x47c ScatterGatherListSize : 0
+0x480 WakeUpTimerEvent : (null)
+0x484 SecurityDescriptor : 0x81137e90
+0x488 NumUserOpens : 0
+0x48c NumAdminOpens : 0
+0x490 Ref : _ULONG_REFERENCE
+0x038 DpcCount : 0 ''
+0x039 Filler1 : 0 ''
+0x03c DpcsCompletedEvent : _KEVENT
+0x000 Header : _DISPATCHER_HEADER
+0x04c SharedInterrupt : 0x1 ''
+0x04d IsrRequested : 0 ''
windbg/kd has a ndis extension called ndiskd.dll, let's use it to
dump some shit...
kd> !ndiskd.miniports
Miniport Driver Block: 8111c708, Version 0.1024
Miniport: 810ee838, NetLuidIndex: 0, IfIndex: 0, AMD PCNET Family PCI Ethernet Adapter
it's easy to know that 810ee838 is _NDIS_MINIPORT_BLOCK, coz we ever saw the number
in the above analysis:
dt ndis!_NDIS_MINIPORT_BLOCK 810ee838
+0x000 Signature : 0x504d444e
+0x004 NextMiniport : (null)
+0x008 DriverHandle : 0x8111c708
+0x00c MiniportAdapterContext : 0x810d4500
+0x010 MiniportName : _UNICODE_STRING "/DEVICE/{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x018 BindPaths : 0x81114a78
+0x01c OpenQueue : 0xffa298d8
+0x020 ShortRef : _REFERENCE
+0x028 DeviceContext : (null)
+0x02c Padding1 : 0 ''
+0x02d LockAcquired : 0 ''
+0x02e PmodeOpens : 0 ''
+0x02f AssignedProcessor : 0 ''
+0x030 Lock : 0
+0x034 MediaRequest : (null)
+0x038 Interrupt : 0x810d45dc
+0x03c Flags : 0x2c452008
+0x040 PnPFlags : 0x210000
+0x044 PacketList : _LIST_ENTRY [ 0x810ee87c - 0x810ee87c ]
+0x04c FirstPendingPacket : (null)
+0x050 ReturnPacketsQueue : (null)
+0x054 RequestBuffer : 0xb
+0x058 SetMCastBuffer : (null)
+0x05c PrimaryMiniport : 0x810ee838
+0x060 WrapperContext : 0x810ee7f0
+0x064 BusDataContext : 0x81218898
+0x068 PnPCapabilities : 0x30
+0x06c Resources : (null)
+0x070 WakeUpDpcTimer : _NDIS_TIMER
+0x0b8 BaseName : _UNICODE_STRING "{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x0c0 SymbolicLinkName : _UNICODE_STRING "/??/PCI#VEN_1022&DEV_2000&SUBSYS_20001022&REV_10#3&61aaa01&0&88#{ad498944-762f-11d0-8dcb-00c04fc3358c}/{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x0c8 CheckForHangSeconds : 2
+0x0cc CFHangTicks : 1
+0x0ce CFHangCurrentTick : 1
+0x0d0 ResetStatus : 0
+0x0d4 ResetOpen : (null)
+0x0d8 EthDB : 0x810dca68
+0x0d8 NullDB : 0x810dca68
+0x0dc TrDB : (null)
+0x0e0 FddiDB : (null)
+0x0e4 ArcDB : (null)
+0x0e8 PacketIndicateHandler : 0xfc6e6005 NDIS!ethFilterDprIndicateReceivePacket+0
+0x0ec SendCompleteHandler : 0xfc6d7180 NDIS!ndisMSendCompleteX+0
+0x0f0 SendResourcesHandler : 0xfc6dd86d NDIS!NdisMSendResourcesAvailable+0
+0x0f4 ResetCompleteHandler : 0xfc6dff74 NDIS!NdisMResetComplete+0
+0x0f8 MediaType : 0 ( NdisMedium802_3 )
+0x0fc BusNumber : 0
+0x100 BusType : 5 ( NdisInterfacePci )
+0x104 AdapterType : 5 ( NdisInterfacePci )
+0x108 DeviceObject : 0x810ee738
+0x10c PhysicalDeviceObject : 0x812187e0
+0x110 NextDeviceObject : 0x812187e0
+0x114 MapRegisters : 0x811414e8
+0x118 CallMgrAfList : (null)
+0x11c MiniportThread : (null)
+0x120 SetInfoBuf : (null)
+0x124 SetInfoBufLen : 0
+0x126 MaxSendPackets : 4
+0x128 FakeStatus : 0
+0x12c LockHandler : 0xfc6dc9fd
+0x130 pAdapterInstanceName : 0x81117268 "AMD PCNET Family PCI Ethernet Adapter"
+0x134 TimerQueue : (null)
+0x138 MacOptions : 0x8f
+0x13c PendingRequest : (null)
+0x140 MaximumLongAddresses : 0x20
+0x144 MaximumShortAddresses : 0
+0x148 CurrentLookahead : 0x80
+0x14c MaximumLookahead : 0x200
+0x150 HandleInterruptHandler : 0xfca57e8a pcntpci5!LanceHandleInterruptWithLock+0
+0x154 DisableInterruptHandler : 0xfca57676 pcntpci5!LanceDisableInterrupt+0
+0x158 EnableInterruptHandler : 0xfca57626 pcntpci5!LanceEnableInterrupt+0
+0x15c SendPacketsHandler : 0xfc6d764c NDIS!ndisMSendPacketsX+0
+0x160 DeferredSendHandler : 0xfc6d789a NDIS!ndisMStartSendPackets+0
+0x164 EthRxIndicateHandler : 0xfc6e6ef1 NDIS!EthFilterDprIndicateReceive+0
+0x168 TrRxIndicateHandler : 0xfc6e853f NDIS!TrFilterDprIndicateReceive+0
+0x16c FddiRxIndicateHandler : 0xfc6e5044 NDIS!FddiFilterDprIndicateReceive+0
+0x170 EthRxCompleteHandler : 0xfc6e646d NDIS!EthFilterDprIndicateReceiveComplete+0
+0x174 TrRxCompleteHandler : 0xfc6e83eb NDIS!TrFilterDprIndicateReceiveComplete+0
+0x178 FddiRxCompleteHandler : 0xfc6e45f8 NDIS!FddiFilterDprIndicateReceiveComplete+0
+0x17c StatusHandler : 0xfc6dc3c2 NDIS!NdisMIndicateStatus+0
+0x180 StatusCompleteHandler : 0xfc6dd270 NDIS!NdisMIndicateStatusComplete+0
+0x184 TDCompleteHandler : 0xfc6d8715 NDIS!NdisMTransferDataComplete+0
+0x188 QueryCompleteHandler : 0xfc6de0f3 NDIS!NdisMQueryInformationComplete+0
+0x18c SetCompleteHandler : 0xfc6deda3 NDIS!NdisMSetInformationComplete+0
+0x190 WanSendCompleteHandler : 0xfc6d7e92 NDIS!NdisMWanSendComplete+0
+0x194 WanRcvHandler : 0xfc6dc1e8 NDIS!NdisMWanIndicateReceive+0
+0x198 WanRcvCompleteHandler : 0xfc6dc18f NDIS!NdisMWanIndicateReceiveComplete+0
+0x19c NextGlobalMiniport : (null)
+0x1a0 WorkQueue : [7] _SINGLE_LIST_ENTRY
+0x1bc SingleWorkItems : [6] _SINGLE_LIST_ENTRY
+0x1d4 SendFlags : 0x1 ''
+0x1d5 TrResetRing : 0 ''
+0x1d6 ArcnetAddress : 0 ''
+0x1d7 XState : 0 ''
+0x1d8 ArcBuf : (null)
+0x1d8 BusInterface : (null)
+0x1dc Log : (null)
+0x1e0 SlotNumber : 0xffffffff
+0x1e4 AllocatedResources : 0x810e75a0
+0x1e8 AllocatedResourcesTranslated : 0x810e75e4
+0x1ec PatternList : _SINGLE_LIST_ENTRY
+0x1f0 PMCapabilities : _NDIS_PNP_CAPABILITIES
+0x200 DeviceCaps : _DEVICE_CAPABILITIES
+0x240 WakeUpEnable : 0
+0x244 CurrentDevicePowerState : 1 ( PowerDeviceD0 )
+0x248 pIrpWaitWake : (null)
+0x24c WaitWakeSystemState : 0 ( PowerSystemUnspecified )
+0x250 VcIndex : _LARGE_INTEGER 0x0
+0x258 VcCountLock : 0
+0x25c WmiEnabledVcs : _LIST_ENTRY [ 0x810eea94 - 0x810eea94 ]
+0x264 pNdisGuidMap : 0xffa6d870
+0x268 pCustomGuidMap : 0xffa6df70
+0x26c VcCount : 0
+0x26e cNdisGuidMap : 0x45
+0x270 cCustomGuidMap : 5
+0x272 CurrentMapRegister : 0
+0x274 AllocationEvent : 0xfcd6e58c
+0x278 BaseMapRegistersNeeded : 0x40
+0x27a SGMapRegistersNeeded : 0x10
+0x27c MaximumPhysicalMapping : 0x600
+0x280 MediaDisconnectTimer : _NDIS_TIMER
+0x2c8 MediaDisconnectTimeOut : 0xffff
+0x2ca InstanceNumber : 1
+0x2cc OpenReadyEvent : _NDIS_EVENT
+0x2dc PnPDeviceState : 1 ( NdisPnPDeviceStarted )
+0x2e0 OldPnPDeviceState : 0 ( NdisPnPDeviceAdded )
+0x2e4 SetBusData : 0xfc89e030 pci!PciPnpWriteConfig+0
+0x2e8 GetBusData : 0xfc89e006 pci!PciPnpReadConfig+0
+0x2ec DeferredDpc : _KDPC
+0x310 NdisStats : _NDIS_STATS
+0x328 IndicatedPacket : [32] (null)
+0x3a8 RemoveReadyEvent : (null)
+0x3ac AllOpensClosedEvent : (null)
+0x3b0 AllRequestsCompletedEvent : (null)
+0x3b4 InitTimeMs : 0xda
+0x3b8 WorkItemBuffer : [6] _NDIS_MINIPORT_WORK_ITEM
+0x400 SystemAdapterObject : 0x810d4490
+0x404 DriverVerifyFlags : 0
+0x408 OidList : 0xffa0a008
+0x40c InternalResetCount : 0
+0x40e MiniportResetCount : 0
+0x410 MediaSenseConnectCount : 1
+0x412 MediaSenseDisconnectCount : 0
+0x414 xPackets : (null)
+0x418 UserModeOpenReferences : 0
+0x41c SavedSendHandler : 0xfc6bf2b6
+0x41c SavedWanSendHandler : 0xfc6bf2b6
+0x420 SavedSendPacketsHandler : 0xfc6d764c NDIS!ndisMSendPacketsX+0
+0x424 SavedCancelSendPacketsHandler : (null)
+0x428 WSendPacketsHandler : 0xfca5a332 pcntpci5!LanceSendPackets+0
+0x42c MiniportAttributes : 0x28
+0x430 SavedSystemAdapterObject : (null)
+0x434 NumOpens : 2
+0x436 CFHangXTicks : 0
+0x438 RequestCount : 0
+0x43c IndicatedPacketsCount : 0
+0x440 PhysicalMediumType : 0
+0x444 LastRequest : 0xff837cd0
+0x448 DmaAdapterRefCount : 3
+0x44c FakeMac : 0x810cda30
+0x450 LockDbg : 0
+0x454 LockDbgX : 0
+0x458 LockThread : (null)
+0x45c InfoFlags : 0xa010a11
+0x460 TimerQueueLock : 0
+0x464 ResetCompletedEvent : (null)
+0x468 QueuedBindingCompletedEvent : (null)
+0x46c DmaResourcesReleasedEvent : (null)
+0x470 SavedPacketIndicateHandler : 0xfc6e6005 NDIS!ethFilterDprIndicateReceivePacket+0
+0x474 RegisteredInterrupts : 1
+0x478 SGListLookasideList : (null)
+0x47c ScatterGatherListSize : 0
+0x480 WakeUpTimerEvent : (null)
+0x484 SecurityDescriptor : 0x81137e90
+0x488 NumUserOpens : 0
+0x48c NumAdminOpens : 0
+0x490 Ref : _ULONG_REFERENCE
but what the heck is 8111c708 ??? the shit ndiskd calls it as
`Miniport Driver Block`, after checking with !object cmd, it proved
that this address is NOT any valid system standard object type, the
debugger will always give u junk values, okay, it's NOT nt!_DRIVER_OBJECT,
then what's it? ON EARTH? it should be some type defined by ndis?
let's kick out the invaluable `dt` cmd to scan ndis.sys, here u are ...
kd> dt ndis!_*driver*
ndis!_NDIS_M_DRIVER_BLOCK
ndis!_DRIVER_OBJECT
ndis!_NDIS_M_DRIVER_BLOCK
ndis!_DRIVER_EXTENSION
ndis!_DRIVER_OBJECT
ndis!_DRIVER_EXTENSION
ndis!_NDIS_M_DRIVER_BLOCK should be most likely to be the target we wanna shoot at...
kd> dt 8111c708 ndis!_NDIS_M_DRIVER_BLOCK -r1
+0x000 NextDriver : (null)
+0x004 MiniportQueue : 0x810ee838
+0x000 Signature : 0x504d444e
+0x004 NextMiniport : (null)
+0x008 DriverHandle : 0x8111c708
+0x00c MiniportAdapterContext : 0x810d4500
+0x010 MiniportName : _UNICODE_STRING "/DEVICE/{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x018 BindPaths : 0x81114a78
+0x01c OpenQueue : 0xffa298d8
+0x020 ShortRef : _REFERENCE
+0x028 DeviceContext : (null)
+0x02c Padding1 : 0 ''
+0x02d LockAcquired : 0 ''
+0x02e PmodeOpens : 0 ''
+0x02f AssignedProcessor : 0 ''
+0x030 Lock : 0
+0x034 MediaRequest : (null)
+0x038 Interrupt : 0x810d45dc
+0x03c Flags : 0x2c452008
+0x040 PnPFlags : 0x210000
+0x044 PacketList : _LIST_ENTRY [ 0x810ee87c - 0x810ee87c ]
+0x04c FirstPendingPacket : (null)
+0x050 ReturnPacketsQueue : (null)
+0x054 RequestBuffer : 0xb
+0x058 SetMCastBuffer : (null)
+0x05c PrimaryMiniport : 0x810ee838
+0x060 WrapperContext : 0x810ee7f0
+0x064 BusDataContext : 0x81218898
+0x068 PnPCapabilities : 0x30
+0x06c Resources : (null)
+0x070 WakeUpDpcTimer : _NDIS_TIMER
+0x0b8 BaseName : _UNICODE_STRING "{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x0c0 SymbolicLinkName : _UNICODE_STRING "/??/PCI#VEN_1022&DEV_2000&SUBSYS_20001022&REV_10#3&61aaa01&0&88#{ad498944-762f-11d0-8dcb-00c04fc3358c}/{D0F0BDEF-43D7-4DED-BF6F-FA040B787796}"
+0x0c8 CheckForHangSeconds : 2
+0x0cc CFHangTicks : 1
+0x0ce CFHangCurrentTick : 1
+0x0d0 ResetStatus : 0
+0x0d4 ResetOpen : (null)
+0x0d8 EthDB : 0x810dca68
+0x0d8 NullDB : 0x810dca68
+0x0dc TrDB : (null)
+0x0e0 FddiDB : (null)
+0x0e4 ArcDB : (null)
+0x0e8 PacketIndicateHandler : 0xfc6e6005 NDIS!ethFilterDprIndicateReceivePacket+0
+0x0ec SendCompleteHandler : 0xfc6d7180 NDIS!ndisMSendCompleteX+0
+0x0f0 SendResourcesHandler : 0xfc6dd86d NDIS!NdisMSendResourcesAvailable+0
+0x0f4 ResetCompleteHandler : 0xfc6dff74 NDIS!NdisMResetComplete+0
+0x0f8 MediaType : 0 ( NdisMedium802_3 )
+0x0fc BusNumber : 0
+0x100 BusType : 5 ( NdisInterfacePci )
+0x104 AdapterType : 5 ( NdisInterfacePci )
+0x108 DeviceObject : 0x810ee738
+0x10c PhysicalDeviceObject : 0x812187e0
+0x110 NextDeviceObject : 0x812187e0
+0x114 MapRegisters : 0x811414e8
+0x118 CallMgrAfList : (null)
+0x11c MiniportThread : (null)
+0x120 SetInfoBuf : (null)
+0x124 SetInfoBufLen : 0
+0x126 MaxSendPackets : 4
+0x128 FakeStatus : 0
+0x12c LockHandler : 0xfc6dc9fd
+0x130 pAdapterInstanceName : 0x81117268 "AMD PCNET Family PCI Ethernet Adapter"
+0x134 TimerQueue : (null)
+0x138 MacOptions : 0x8f
+0x13c PendingRequest : (null)
+0x140 MaximumLongAddresses : 0x20
+0x144 MaximumShortAddresses : 0
+0x148 CurrentLookahead : 0x80
+0x14c MaximumLookahead : 0x200
+0x150 HandleInterruptHandler : 0xfca57e8a pcntpci5!LanceHandleInterruptWithLock+0
+0x154 DisableInterruptHandler : 0xfca57676 pcntpci5!LanceDisableInterrupt+0
+0x158 EnableInterruptHandler : 0xfca57626 pcntpci5!LanceEnableInterrupt+0
+0x15c SendPacketsHandler : 0xfc6d764c NDIS!ndisMSendPacketsX+0
+0x160 DeferredSendHandler : 0xfc6d789a NDIS!ndisMStartSendPackets+0
+0x164 EthRxIndicateHandler : 0xfc6e6ef1 NDIS!EthFilterDprIndicateReceive+0
+0x168 TrRxIndicateHandler : 0xfc6e853f NDIS!TrFilterDprIndicateReceive+0
+0x16c FddiRxIndicateHandler : 0xfc6e5044 NDIS!FddiFilterDprIndicateReceive+0
+0x170 EthRxCompleteHandler : 0xfc6e646d NDIS!EthFilterDprIndicateReceiveComplete+0
+0x174 TrRxCompleteHandler : 0xfc6e83eb NDIS!TrFilterDprIndicateReceiveComplete+0
+0x178 FddiRxCompleteHandler : 0xfc6e45f8 NDIS!FddiFilterDprIndicateReceiveComplete+0
+0x17c StatusHandler : 0xfc6dc3c2 NDIS!NdisMIndicateStatus+0
+0x180 StatusCompleteHandler : 0xfc6dd270 NDIS!NdisMIndicateStatusComplete+0
+0x184 TDCompleteHandler : 0xfc6d8715 NDIS!NdisMTransferDataComplete+0
+0x188 QueryCompleteHandler : 0xfc6de0f3 NDIS!NdisMQueryInformationComplete+0
+0x18c SetCompleteHandler : 0xfc6deda3 NDIS!NdisMSetInformationComplete+0
+0x190 WanSendCompleteHandler : 0xfc6d7e92 NDIS!NdisMWanSendComplete+0
+0x194 WanRcvHandler : 0xfc6dc1e8 NDIS!NdisMWanIndicateReceive+0
+0x198 WanRcvCompleteHandler : 0xfc6dc18f NDIS!NdisMWanIndicateReceiveComplete+0
+0x19c NextGlobalMiniport : (null)
+0x1a0 WorkQueue : [7] _SINGLE_LIST_ENTRY
+0x1bc SingleWorkItems : [6] _SINGLE_LIST_ENTRY
+0x1d4 SendFlags : 0x1 ''
+0x1d5 TrResetRing : 0 ''
+0x1d6 ArcnetAddress : 0 ''
+0x1d7 XState : 0 ''
+0x1d8 ArcBuf : (null)
+0x1d8 BusInterface : (null)
+0x1dc Log : (null)
+0x1e0 SlotNumber : 0xffffffff
+0x1e4 AllocatedResources : 0x810e75a0
+0x1e8 AllocatedResourcesTranslated : 0x810e75e4
+0x1ec PatternList : _SINGLE_LIST_ENTRY
+0x1f0 PMCapabilities : _NDIS_PNP_CAPABILITIES
+0x200 DeviceCaps : _DEVICE_CAPABILITIES
+0x240 WakeUpEnable : 0
+0x244 CurrentDevicePowerState : 1 ( PowerDeviceD0 )
+0x248 pIrpWaitWake : (null)
+0x24c WaitWakeSystemState : 0 ( PowerSystemUnspecified )
+0x250 VcIndex : _LARGE_INTEGER 0x0
+0x258 VcCountLock : 0
+0x25c WmiEnabledVcs : _LIST_ENTRY [ 0x810eea94 - 0x810eea94 ]
+0x264 pNdisGuidMap : 0xffa6d870
+0x268 pCustomGuidMap : 0xffa6df70
+0x26c VcCount : 0
+0x26e cNdisGuidMap : 0x45
+0x270 cCustomGuidMap : 5
+0x272 CurrentMapRegister : 0
+0x274 AllocationEvent : 0xfcd6e58c
+0x278 BaseMapRegistersNeeded : 0x40
+0x27a SGMapRegistersNeeded : 0x10
+0x27c MaximumPhysicalMapping : 0x600
+0x280 MediaDisconnectTimer : _NDIS_TIMER
+0x2c8 MediaDisconnectTimeOut : 0xffff
+0x2ca InstanceNumber : 1
+0x2cc OpenReadyEvent : _NDIS_EVENT
+0x2dc PnPDeviceState : 1 ( NdisPnPDeviceStarted )
+0x2e0 OldPnPDeviceState : 0 ( NdisPnPDeviceAdded )
+0x2e4 SetBusData : 0xfc89e030 pci!PciPnpWriteConfig+0
+0x2e8 GetBusData : 0xfc89e006 pci!PciPnpReadConfig+0
+0x2ec DeferredDpc : _KDPC
+0x310 NdisStats : _NDIS_STATS
+0x328 IndicatedPacket : [32] (null)
+0x3a8 RemoveReadyEvent : (null)
+0x3ac AllOpensClosedEvent : (null)
+0x3b0 AllRequestsCompletedEvent : (null)
+0x3b4 InitTimeMs : 0xda
+0x3b8 WorkItemBuffer : [6] _NDIS_MINIPORT_WORK_ITEM
+0x400 SystemAdapterObject : 0x810d4490
+0x404 DriverVerifyFlags : 0
+0x408 OidList : 0xffa0a008
+0x40c InternalResetCount : 0
+0x40e MiniportResetCount : 0
+0x410 MediaSenseConnectCount : 1
+0x412 MediaSenseDisconnectCount : 0
+0x414 xPackets : (null)
+0x418 UserModeOpenReferences : 0
+0x41c SavedSendHandler : 0xfc6bf2b6
+0x41c SavedWanSendHandler : 0xfc6bf2b6
+0x420 SavedSendPacketsHandler : 0xfc6d764c NDIS!ndisMSendPacketsX+0
+0x424 SavedCancelSendPacketsHandler : (null)
+0x428 WSendPacketsHandler : 0xfca5a332 pcntpci5!LanceSendPackets+0
+0x42c MiniportAttributes : 0x28
+0x430 SavedSystemAdapterObject : (null)
+0x434 NumOpens : 2
+0x436 CFHangXTicks : 0
+0x438 RequestCount : 0
+0x43c IndicatedPacketsCount : 0
+0x440 PhysicalMediumType : 0
+0x444 LastRequest : 0xff837cd0
+0x448 DmaAdapterRefCount : 3
+0x44c FakeMac : 0x810cda30
+0x450 LockDbg : 0
+0x454 LockDbgX : 0
+0x458 LockThread : (null)
+0x45c InfoFlags : 0xa010a11
+0x460 TimerQueueLock : 0
+0x464 ResetCompletedEvent : (null)
+0x468 QueuedBindingCompletedEvent : (null)
+0x46c DmaResourcesReleasedEvent : (null)
+0x470 SavedPacketIndicateHandler : 0xfc6e6005 NDIS!ethFilterDprIndicateReceivePacket+0
+0x474 RegisteredInterrupts : 1
+0x478 SGListLookasideList : (null)
+0x47c ScatterGatherListSize : 0
+0x480 WakeUpTimerEvent : (null)
+0x484 SecurityDescriptor : 0x81137e90
+0x488 NumUserOpens : 0
+0x48c NumAdminOpens : 0
+0x490 Ref : _ULONG_REFERENCE
+0x008 NdisDriverInfo : 0x811b3110
+0x000 DriverObject : 0x811324b8
+0x004 ServiceRegPath : _UNICODE_STRING "/REGISTRY/MACHINE/SYSTEM/ControlSet001/Services/PCnet"
+0x00c AssociatedProtocol : (null)
+0x010 DeviceList : _LIST_ENTRY [ 0x8111c718 - 0x8111c718 ]
+0x000 Flink : 0x8111c718 [ 0x8111c718 - 0x8111c718 ]
+0x004 Blink : 0x8111c718 [ 0x8111c718 - 0x8111c718 ]
+0x018 PendingDeviceList : (null)
+0x01c UnloadHandler : (null)
+0x020 MiniportCharacteristics : _NDIS51_MINIPORT_CHARACTERISTICS
+0x000 MajorNdisVersion : 0x5 ''
+0x001 MinorNdisVersion : 0 ''
+0x002 Filler : 0
+0x004 Reserved : 0
+0x008 CheckForHangHandler : (null)
+0x00c DisableInterruptHandler : 0xfca57676 pcntpci5!LanceDisableInterrupt+0
+0x010 EnableInterruptHandler : 0xfca57626 pcntpci5!LanceEnableInterrupt+0
+0x014 HaltHandler : 0xfca5c8fe pcntpci5!LanceHalt+0
+0x018 HandleInterruptHandler : 0xfca57e8a pcntpci5!LanceHandleInterruptWithLock+0
+0x01c InitializeHandler : 0xfca5d29a pcntpci5!LanceInitialize+0
+0x020 ISRHandler : 0xfca576c6 pcntpci5!LanceISR+0
+0x024 QueryInformationHandler : 0xfca5915c pcntpci5!LanceQueryInformation+0
+0x028 ReconfigureHandler : (null)
+0x02c ResetHandler : 0xfca5c868 pcntpci5!LanceReset+0
+0x030 SendHandler : (null)
+0x030 WanSendHandler : (null)
+0x034 SetInformationHandler : 0xfca597c2 pcntpci5!LanceSetInformation+0
+0x038 TransferDataHandler : 0xfca5c1bc pcntpci5!LanceTransferData+0
+0x038 WanTransferDataHandler : 0xfca5c1bc pcntpci5!LanceTransferData+0
+0x03c ReturnPacketHandler : 0xfca57822 pcntpci5!LanceReturnPacket+0
+0x040 SendPacketsHandler : 0xfca5a332 pcntpci5!LanceSendPackets+0
+0x044 AllocateCompleteHandler : (null)
+0x048 CoCreateVcHandler : (null)
+0x04c CoDeleteVcHandler : (null)
+0x050 CoActivateVcHandler : (null)
+0x054 CoDeactivateVcHandler : (null)
+0x058 CoSendPacketsHandler : (null)
+0x05c CoRequestHandler : (null)
+0x060 CancelSendPacketsHandler : (null)
+0x064 PnPEventNotifyHandler : (null)
+0x068 AdapterShutdownHandler : (null)
+0x06c Reserved1 : (null)
+0x070 Reserved2 : (null)
+0x074 Reserved3 : (null)
+0x078 Reserved4 : (null)
+0x09c MiniportsRemovedEvent : _KEVENT
+0x000 Header : _DISPATCHER_HEADER
+0x0ac Ref : _REFERENCE
+0x000 SpinLock : 0
+0x004 ReferenceCount : 2
+0x006 Closing : 0 ''
+0x0b4 Flags : 0
+0x0b8 IMStartRemoveMutex : _KMUTANT
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListEntry : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x018 OwnerThread : (null)
+0x01c Abandoned : 0 ''
+0x01d ApcDisable : 0 ''
+0x0d8 DriverVersion : 0x400
mmm, not bad, we always are lucky guys when playing such game, right? :p,
exactly match..., oh, it's time BRAZIL V.S. GERMANY, SOCCER...BYE...
IDA Pro told me about the code path of ISR/DPC of ndis:
when ndis miniport driver calls ndis!NdisMRegisterInterrupt to register its ISR, NdisMRegisterInterrupt will
call ndis!ndisMRegisterInterruptCommon ( an internal ndis routine) which calls nt!IoConnectInterrupt to
register ndis!ndisMIsr as the common ISR, ndis!ndisMDpcX as the common DPC routine, that's the
story how ndis miniport connects its ISR to system)