2

I'm looking for information on the _DEVICE_OBJECT->_DEVOBJ_EXTENSION structure.

I'd like to know a bit more about this structure in genernal, like what it's actually used for. But specifically, I'd like to know about the _DEVICE_OBJECT* AttachedTo member and the difference between that and the _DEVICE_OBJECT* AttachedDevice member in the _DEVICE_OBJECT structure.

Google is proving fruitless, and I can't find any reference to it in the Windows Internals book. Any resources or information would be greatly appreciated.

EDIT:
Ok... After a bit of staring at WinDbg I found that the AttachedTo field seems to point to the device object at the top of the device tree. Can anyone confirm this?

3

According to this diagram from http://www.mouseos.com/windows/kernel/DeviceStack.html, AttachedDevice points to the next device and DeviceExtension->AttachedTo points to the previous device:

enter image description here

3

use !devobj <address> command
it will tell you what AttachedDevice (upper ) and what AttachedTo device is (lower)

.foreach (place { .shell -ci "!object \\Device;" sed s/"     ".."  "//g | sed s/" .*"//g } ) { !grep -i -c "!devobj place" -e "Attached"}

note:

!grep is from domdbg windbg extension sed is from gnuwin32 

output

AttachedTo (Lower) 86fb1630 \Driver\PnpManager
AttachedTo (Lower) 86d22420 \Driver\aswTdi
AttachedDevice (Upper) 862f59d8 \Driver\wdmaud
AttachedDevice (Upper) 86e11130 \Driver\ROOTMODEM
AttachedDevice (Upper) 86de7528 \Driver\Kbdclass
AttachedTo (Lower) 86fac190 \Driver\PnpManager
AttachedDevice (Upper) 86e02560 \Driver\Rasl2tp
AttachedDevice (Upper) 862e9c90 \Driver\sysaudio
AttachedTo (Lower) 86f5ece8 \Driver\ACPI
AttachedTo (Lower) 86e15020 \Driver\i8042prt

or parse the structures yourself for all devices to find patterns

 .foreach (place { .shell -ci "!object \\Device;" sed s/"     ".."  "//g | sed s/" .*"//g } ) {dt nt!_DEVICE_OBJECT -y Dri->Drivern* place ;dt nt!_DEVICE_OBJECT -yr DeviceOb->Att->Dri->Drivern* place ;dt nt!_DEVICE_OBJECT -yr Atta->Dri->Drivern* place ; .echo ==========}

when a deviceobject has both AttachedDevice and AttachedTo device it should show you an output like this

   +0x008 DriverObject : 
      +0x01c DriverName   : _UNICODE_STRING "\Driver\TermDD"
   +0x0b0 DeviceObjectExtension       : 
      +0x018 AttachedTo                  : 
         +0x008 DriverObject                : 
            +0x01c DriverName                  : _UNICODE_STRING "\Driver\PnpManager"
   +0x010 AttachedDevice     : 
      +0x008 DriverObject       : 
         +0x01c DriverName         : _UNICODE_STRING "\Driver\Kbdclass"
3

The structure is fully documented by Microsoft on their MSDN site. I also created a blog post a while ago, regarding this data structure which can be found here - http://bsodtutorials.blogspot.co.uk/2013/11/devobj-and-deviceobject.html

  • Welcome to Reverse Engineering! We prefer answers to have more than just a link so that even if the link were to go down the content would allow an individual to solve the problem at hand or at least search for the relevant solution. – asheeshr Jan 11 '14 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.