_DEVOBJ_EXTENSION structure information

Question

I'm looking for information on the _DEVICE_OBJECT->_DEVOBJ_EXTENSION structure.

I'd like to know a bit more about this structure in genernal, like what it's actually used for. But specifically, I'd like to know about the _DEVICE_OBJECT* AttachedTo member and the difference between that and the _DEVICE_OBJECT* AttachedDevice member in the _DEVICE_OBJECT structure.

Google is proving fruitless, and I can't find any reference to it in the Windows Internals book. Any resources or information would be greatly appreciated.

EDIT:
Ok... After a bit of staring at WinDbg I found that the AttachedTo field seems to point to the device object at the top of the device tree. Can anyone confirm this?

Answer 1

According to this diagram from http://www.mouseos.com/windows/kernel/DeviceStack.html, AttachedDevice points to the next device and DeviceExtension->AttachedTo points to the previous device:

Answer 2

use !devobj <address> command
it will tell you what AttachedDevice (upper ) and what AttachedTo device is (lower)

.foreach (place { .shell -ci "!object \\Device;" sed s/"     ".."  "//g | sed s/" .*"//g } ) { !grep -i -c "!devobj place" -e "Attached"}

note:

!grep is from domdbg windbg extension sed is from gnuwin32 

output

AttachedTo (Lower) 86fb1630 \Driver\PnpManager
AttachedTo (Lower) 86d22420 \Driver\aswTdi
AttachedDevice (Upper) 862f59d8 \Driver\wdmaud
AttachedDevice (Upper) 86e11130 \Driver\ROOTMODEM
AttachedDevice (Upper) 86de7528 \Driver\Kbdclass
AttachedTo (Lower) 86fac190 \Driver\PnpManager
AttachedDevice (Upper) 86e02560 \Driver\Rasl2tp
AttachedDevice (Upper) 862e9c90 \Driver\sysaudio
AttachedTo (Lower) 86f5ece8 \Driver\ACPI
AttachedTo (Lower) 86e15020 \Driver\i8042prt

or parse the structures yourself for all devices to find patterns

 .foreach (place { .shell -ci "!object \\Device;" sed s/"     ".."  "//g | sed s/" .*"//g } ) {dt nt!_DEVICE_OBJECT -y Dri->Drivern* place ;dt nt!_DEVICE_OBJECT -yr DeviceOb->Att->Dri->Drivern* place ;dt nt!_DEVICE_OBJECT -yr Atta->Dri->Drivern* place ; .echo ==========}

when a deviceobject has both AttachedDevice and AttachedTo device it should show you an output like this

   +0x008 DriverObject : 
      +0x01c DriverName   : _UNICODE_STRING "\Driver\TermDD"
   +0x0b0 DeviceObjectExtension       : 
      +0x018 AttachedTo                  : 
         +0x008 DriverObject                : 
            +0x01c DriverName                  : _UNICODE_STRING "\Driver\PnpManager"
   +0x010 AttachedDevice     : 
      +0x008 DriverObject       : 
         +0x01c DriverName         : _UNICODE_STRING "\Driver\Kbdclass"

Answer 3

The structure is fully documented by Microsoft on their MSDN site. I also created a blog post a while ago, regarding this data structure which can be found here - http://bsodtutorials.blogspot.co.uk/2013/11/devobj-and-deviceobject.html