nt!PiQueryResourceRequirements函数分析写入注册表LOGCONF下的BasicConfigVector和赋值DeviceNode-＞ResourceRequirements

nt!PiQueryResourceRequirements函数分析写入注册表LOGCONF下的BasicConfigVector和赋值DeviceNode->ResourceRequirements

//
// Remember the resource list
//
Irp->IoStatus.Information = (ULONG_PTR)
( NT_SUCCESS(status) ? resList : NULL );

0: kd> dv
DeviceObject = 0x00000000
Irp = 0x89905220
prsBuf = 0x00000000 ""
minorFunction = 0x0b ''
prsBufSize = 0x8990520b
crsBuf = 0xe129e370 "???"
crsStat = 0n0
resList = 0x899bf758
crsBufSize = 0x1e5
0: kd> dx -r1 ((ACPI!_IRP *)0x89905220)
((ACPI!_IRP *)0x89905220) : 0x89905220 [Type: _IRP *]
[<Raw View>] [Type: _IRP]
IoStack : Size = 1, Current IRP_MJ_PNP / IRP_MN_QUERY_RESOURCE_REQUIREMENTS for Device for "\Driver\ACPI"
CurrentThread : 0x899a1020 [Type: _ETHREAD *]
0: kd> dx -r1 -nv (*((ACPI!_IRP *)0x89905220))
(*((ACPI!_IRP *)0x89905220)) [Type: _IRP]
[+0x000] Type : 6 [Type: short]
[+0x002] Size : 0x94 [Type: unsigned short]
[+0x004] MdlAddress : 0x0 [Type: _MDL *]
[+0x008] Flags : 0x0 [Type: unsigned long]
[+0x00c] AssociatedIrp [Type: __unnamed]
[+0x010] ThreadListEntry [Type: _LIST_ENTRY]
[+0x018] IoStatus [Type: _IO_STATUS_BLOCK]
[+0x020] RequestorMode : 0 [Type: char]
[+0x021] PendingReturned : 0x0 [Type: unsigned char]
[+0x022] StackCount : 1 [Type: char]
[+0x023] CurrentLocation : 1 [Type: char]
[+0x024] Cancel : 0x0 [Type: unsigned char]
[+0x025] CancelIrql : 0x0 [Type: unsigned char]
[+0x026] ApcEnvironment : 0 [Type: char]
[+0x027] AllocationFlags : 0x4 [Type: unsigned char]
[+0x028] UserIosb : 0xf789a258 [Type: _IO_STATUS_BLOCK *]
[+0x02c] UserEvent : 0xf789a248 [Type: _KEVENT *]
[+0x030] Overlay [Type: __unnamed]
[+0x038] CancelRoutine : 0x0 [Type: void (*)(_DEVICE_OBJECT *,_IRP *)]
[+0x03c] UserBuffer : 0x0 [Type: void *]
[+0x040] Tail [Type: __unnamed]
0: kd> dx -r1 (*((ACPI!_IO_STATUS_BLOCK *)0x89905238))
(*((ACPI!_IO_STATUS_BLOCK *)0x89905238)) [Type: _IO_STATUS_BLOCK]
[+0x000] Status : -1073741637 [Type: long]
[+0x000] Pointer : 0xc00000bb [Type: void *]
[+0x004] Information : 0x899bf758 [Type: unsigned long]
0: kd> dd 0x899bf758
899bf758 00000468 0000000f 00000000 00000000
899bf768 00000000 00000000 00000000 00000001
899bf778 00010001 00000022 00030600 00000000
899bf788 00000080 00000000 0000007f 00000000
899bf798 00000000 00000000 00038100 00000000
899bf7a8 00000080 00000000 0000007f 00000000
899bf7b8 00000000 00000000 00030300 00000020
899bf7c8 00020000 00000001 000a0000 00000000

0: kd> dt IO_RESOURCE_REQUIREMENTS_LIST 0x899bf758
nt!IO_RESOURCE_REQUIREMENTS_LIST
+0x000 ListSize : 0x468
+0x004 InterfaceType : f ( PNPBus )
+0x008 BusNumber : 0
+0x00c SlotNumber : 0
+0x010 Reserved : [3] 0
+0x01c AlternativeLists : 1
+0x020 List : [1] _IO_RESOURCE_LIST
0: kd> dx -id 0,0,899a2278 -r1 (*((ntkrnlmp!_IO_RESOURCE_LIST (*)[1])0x899bf778))
(*((ntkrnlmp!_IO_RESOURCE_LIST (*)[1])0x899bf778)) [Type: _IO_RESOURCE_LIST [1]]
[0] [Type: _IO_RESOURCE_LIST]
0: kd> dx -id 0,0,899a2278 -r1 (*((ntkrnlmp!_IO_RESOURCE_LIST *)0x899bf778))
(*((ntkrnlmp!_IO_RESOURCE_LIST *)0x899bf778)) [Type: _IO_RESOURCE_LIST]
[<Raw View>] [Type: _IO_RESOURCE_LIST]
[0] : Bus Number Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[1] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[2] : Memory Resource: 0xa0000 - 0xbffff of length 0x20000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[3] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[4] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[5] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[6] : Memory Resource: 0xcc000 - 0xcffff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[7] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[8] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[9] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[10] : Memory Resource: 0xd0000 - 0xd3fff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[11] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[12] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[13] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[14] : Memory Resource: 0xd4000 - 0xd7fff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[15] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[16] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[17] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[18] : Memory Resource: 0xd8000 - 0xdbfff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[19] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[20] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[21] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[22] : Memory Resource: 0x80000000 - 0xfebfffff of length 0x7ec00000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[23] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[24] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[25] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[26] : Port Resource: 0x0 - 0xcf7 of length 0xcf8 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[27] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[28] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[29] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[30] : Port Resource: 0xd00 - 0xfeff of length 0xf200 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[31] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[32] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[33] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
//
// Done Processing Irp
//
Irp->IoStatus.Status = status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );

0: kd> kc
#
00 ACPI!ACPIBusIrpQueryResourceRequirements
01 ACPI!ACPIDispatchIrp
02 nt!IofCallDriver
03 nt!IopSynchronousCall
04 nt!PpIrpQueryResourceRequirements
05 nt!PiQueryResourceRequirements
06 nt!PiProcessNewDeviceNode
07 nt!PipProcessDevNodeTree
08 nt!PipDeviceActionWorker
09 nt!PipRequestDeviceAction
0a nt!IopInitializeBootDrivers
0b nt!IoInitSystem
0c nt!Phase1Initialization
0d nt!PspSystemThreadStartup
0e nt!KiThreadStartup

0: kd> gu
eax=00000000 ebx=8990520b ecx=80ae0dfa edx=80b18958 esi=f743e51c edi=00000000
eip=f740410e esp=f789a1f4 ebp=f789a218 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000296
ACPI!ACPIDispatchIrp+0x19e:
f740410e ff75fc push dword ptr [ebp-4] ss:0010:f789a214=899c0d58
0: kd> gu
eax=00000000 ebx=00000000 ecx=899c0e74 edx=80b18958 esi=89905220 edi=899050e8
eip=80a2675c esp=f789a228 ebp=f789a234 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
nt!IofCallDriver+0x62:
80a2675c 5f pop edi
0: kd> gu
eax=00000000 ebx=899050e8 ecx=899c0e74 edx=80b18958 esi=f789a2a8 edi=899052b4
eip=80c95e00 esp=f789a23c ebp=f789a264 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
nt!IopSynchronousCall+0x1aa:
80c95e00 8bf0 mov esi,eax
0: kd> gu
eax=00000000 ebx=00000000 ecx=899bf758 edx=80b18958 esi=f789a2cc edi=f789a2a8
eip=80c97814 esp=f789a278 ebp=f789a2a8 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000293
nt!PpIrpQueryResourceRequirements+0x62:
80c97814 8bf8 mov edi,eax
0: kd> gu
eax=00000000 ebx=00000000 ecx=899bf758 edx=80b18958 esi=804edc6c edi=894ffea8
eip=80c90cc0 esp=f789a2b8 ebp=f789a2d0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
nt!PiQueryResourceRequirements+0x4e:
80c90cc0 33f6 xor esi,esi

NTSTATUS
PiQueryResourceRequirements(
IN PDEVICE_NODE DeviceNode,
IN HANDLE LogConfKey
)
{

//
// Query the device's basic config vector.
//
status = PpIrpQueryResourceRequirements(
DeviceNode->PhysicalDeviceObject,
&ioResource);
if (!NT_SUCCESS(status)) {

ASSERT(ioResource == NULL);
ioResource = NULL;
}
if (ioResource) {

ioLength = ioResource->ListSize;
} else {

ioLength = 0;
}
//
// Write resource requirements to registry
//
if (LogConfKey) {

PiWstrToUnicodeString(&unicodeString, REGSTR_VALUE_BASIC_CONFIG_VECTOR);

PiLockPnpRegistry(FALSE);

if (ioResource) {

ZwSetValueKey(
LogConfKey,
&unicodeString,
TITLE_INDEX_VALUE,
REG_RESOURCE_REQUIREMENTS_LIST,
ioResource,
ioLength);

0: kd> dv ioResource
ioResource = 0x899bf758
0: kd> dx -r1 ((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758)
((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758) : 0x899bf758 [Type: _IO_RESOURCE_REQUIREMENTS_LIST *]
[<Raw View>] [Type: _IO_RESOURCE_REQUIREMENTS_LIST]
[0x1] : 0x899bf778 [Type: _IO_RESOURCE_LIST *]
0: kd> dx -r1 -nv (*((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758))
(*((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758)) [Type: _IO_RESOURCE_REQUIREMENTS_LIST]
[+0x000] ListSize : 0x468 [Type: unsigned long]
[+0x004] InterfaceType : PNPBus (15) [Type: _INTERFACE_TYPE]
[+0x008] BusNumber : 0x0 [Type: unsigned long]
[+0x00c] SlotNumber : 0x0 [Type: unsigned long]
[+0x010] Reserved [Type: unsigned long [3]]
[+0x01c] AlternativeLists : 0x1 [Type: unsigned long]
[+0x020] List [Type: _IO_RESOURCE_LIST [1]]

0: kd> dv LogConfKey
LogConfKey = 0x800001e8
0: kd> !handle 1e8

PROCESS 899a2278 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 0a200000 ObjectTable: e1000e38 HandleCount: 34.
Image: System

Kernel handle table at e1000e38 with 34 entries in use

01e8: Object: e128eb98 GrantedAccess: 000f003f Entry: e10043d0
Object: e128eb98 Type: (89996048) Key
ObjectHeader: e128eb80 (old version)
HandleCount: 1 PointerCount: 1
Directory Object: 00000000 Name: \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0A03\2&DABA3FF&0\LOGCONF

0: kd> dt _device_node 894ffea8
nt!_DEVICE_NODE
+0x000 Sibling : 0x8952a1e0 _DEVICE_NODE
+0x004 Child : (null)
+0x008 Parent : 0x899c1008 _DEVICE_NODE
+0x00c LastChild : (null)
+0x010 Level : 3
+0x014 Notify : (null)
+0x018 State : 302 ( DeviceNodeInitialized )
+0x01c PreviousState : 301 ( DeviceNodeUninitialized )
+0x020 StateHistory : [20] 301 ( DeviceNodeUninitialized )
+0x070 StateHistoryEntry : 1
+0x074 CompletionStatus : 0n0
+0x078 PendingIrp : (null)
+0x07c Flags : 0x230
+0x080 UserFlags : 0
+0x084 Problem : 0
+0x088 PhysicalDeviceObject : 0x899050e8 _DEVICE_OBJECT
+0x08c ResourceList : (null)
+0x090 ResourceListTranslated : (null)
+0x094 InstancePath : _UNICODE_STRING "ACPI\PNP0A03\2&daba3ff&0"
+0x09c ServiceName : _UNICODE_STRING ""
+0x0a4 DuplicatePDO : (null)
+0x0a8 ResourceRequirements : 0x899bf758 _IO_RESOURCE_REQUIREMENTS_LIST
+0x0ac InterfaceType : 0xffffffff (No matching name)
+0x0b0 BusNumber : 0xffffffff
+0x0b4 ChildInterfaceType : 0xffffffff (No matching name)
+0x0b8 ChildBusNumber : 0xffffffff
+0x0bc ChildBusTypeIndex : 0xffff
+0x0be RemovalPolicy : 0 ''
+0x0bf HardwareRemovalPolicy : 0 ''
+0x0c0 TargetDeviceNotify : _LIST_ENTRY [ 0x894fff68 - 0x894fff68 ]
+0x0c8 DeviceArbiterList : _LIST_ENTRY [ 0x894fff70 - 0x894fff70 ]
+0x0d0 DeviceTranslatorList : _LIST_ENTRY [ 0x894fff78 - 0x894fff78 ]
+0x0d8 NoTranslatorMask : 0
+0x0da QueryTranslatorMask : 0
+0x0dc NoArbiterMask : 0
+0x0de QueryArbiterMask : 0
+0x0e0 OverUsed1 : __unnamed
+0x0e4 OverUsed2 : __unnamed
+0x0e8 BootResources : (null)
+0x0ec CapabilityFlags : 0x80
+0x0f0 DockInfo : __unnamed
+0x100 DisableableDepends : 0
+0x104 PendedSetInterfaceState : _LIST_ENTRY [ 0x894fffac - 0x894fffac ]
+0x10c LegacyBusListEntry : _LIST_ENTRY [ 0x894fffb4 - 0x894fffb4 ]
0: kd> dx -id 0,0,899a2278 -r1 ((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758)
((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758) : 0x899bf758 [Type: _IO_RESOURCE_REQUIREMENTS_LIST *]
[<Raw View>] [Type: _IO_RESOURCE_REQUIREMENTS_LIST]
[0x1] : 0x899bf778 [Type: _IO_RESOURCE_LIST *]
0: kd> dx -id 0,0,899a2278 -r1 -nv (*((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758))
(*((ntkrnlmp!_IO_RESOURCE_REQUIREMENTS_LIST *)0x899bf758)) [Type: _IO_RESOURCE_REQUIREMENTS_LIST]
[+0x000] ListSize : 0x468 [Type: unsigned long]
[+0x004] InterfaceType : PNPBus (15) [Type: _INTERFACE_TYPE]
[+0x008] BusNumber : 0x0 [Type: unsigned long]
[+0x00c] SlotNumber : 0x0 [Type: unsigned long]
[+0x010] Reserved [Type: unsigned long [3]]
[+0x01c] AlternativeLists : 0x1 [Type: unsigned long]
[+0x020] List [Type: _IO_RESOURCE_LIST [1]]
0: kd> dx -id 0,0,899a2278 -r1 (*((ntkrnlmp!_IO_RESOURCE_LIST (*)[1])0x899bf778))
(*((ntkrnlmp!_IO_RESOURCE_LIST (*)[1])0x899bf778)) [Type: _IO_RESOURCE_LIST [1]]
[0] [Type: _IO_RESOURCE_LIST]
0: kd> dx -id 0,0,899a2278 -r1 (*((ntkrnlmp!_IO_RESOURCE_LIST *)0x899bf778))
(*((ntkrnlmp!_IO_RESOURCE_LIST *)0x899bf778)) [Type: _IO_RESOURCE_LIST]
[<Raw View>] [Type: _IO_RESOURCE_LIST]
[0] : Bus Number Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[1] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[2] : Memory Resource: 0xa0000 - 0xbffff of length 0x20000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[3] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[4] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[5] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[6] : Memory Resource: 0xcc000 - 0xcffff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[7] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[8] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[9] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[10] : Memory Resource: 0xd0000 - 0xd3fff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[11] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[12] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[13] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[14] : Memory Resource: 0xd4000 - 0xd7fff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[15] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[16] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[17] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[18] : Memory Resource: 0xd8000 - 0xdbfff of length 0x4000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[19] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[20] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[21] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[22] : Memory Resource: 0x80000000 - 0xfebfffff of length 0x7ec00000 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[23] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[24] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[25] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[26] : Port Resource: 0x0 - 0xcf7 of length 0xcf8 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[27] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[28] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[29] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[30] : Port Resource: 0xd00 - 0xfeff of length 0xf200 and alignment 0x1 [Type: _IO_RESOURCE_DESCRIPTOR]
[31] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[32] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]
[33] : Private Device Resource [Type: _IO_RESOURCE_DESCRIPTOR]