Discussion:
Writing a device-drive - IoGetCurrentIrpStackLocation does not exist ?
(too old to reply)
R.Wieser
2018-09-16 16:19:39 UTC
Permalink
Hello all,

I'm looking for the "IoGetCurrentIrpStackLocation" function.

The problem is that I cannot it in (my XP's) ntoskrnl.exe, nor does the MSDN
make me any wiser (it just describes its usage, but not which DLL its
supposed to be in).

Has anyone an idea where to find it ?

Googeling has returned many examples of its usage, just not where it
resides.

Regards,
Rudy Wieser
JJ
2018-09-16 17:43:20 UTC
Permalink
Post by R.Wieser
Hello all,
I'm looking for the "IoGetCurrentIrpStackLocation" function.
The problem is that I cannot it in (my XP's) ntoskrnl.exe, nor does the MSDN
make me any wiser (it just describes its usage, but not which DLL its
supposed to be in).
Has anyone an idea where to find it ?
Googeling has returned many examples of its usage, just not where it
resides.
Regards,
Rudy Wieser
It's not an external function. It's an inline function.
See WDM.H.
R.Wieser
2018-09-16 18:40:13 UTC
Permalink
JJ,
Post by JJ
It's not an external function. It's an inline function.
See WDM.H.
Yup. More googeling showed me that is indeed the case, and I found several
descriptions of the structure, but with several, and notably MS own one, not
showing any "stack pointer" field:

https://msdn.microsoft.com/library/windows/hardware/ff550694

I've got a major problem with them though: I'm not using C{something}, and
this have to rewrite such structures. Which is rather hard when you're
confronted with typenames which are not specified in the same file.

That means that even though I could find the correct structure, I was unable
to find the actual offset to the _IO_STACK_LOCATION field from it. :-((

Though luckily some more digging turned up a structure which had the offsets
mentioned next to the fields. So, in the end I had what I needed: 0x60. :-)

Regards,
Rudy Wieser

Loading...