wmisample.map

WMI驱动实例

 WMISample

 Timestamp is 41a0bb50 (Sun Nov 21 23:59:12 2004)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 000000fcH .idata$5                CODE
 0001:00000100 000006c4H .rdata                  CODE
 0001:000007c4 0000004eH .rdata$debug            CODE
 0001:00000820 0000e39eH .text                   CODE
 0001:0000ebc0 00000035H .text$yc                CODE
 0001:0000ec00 0000000fH .text$yd                CODE
 0002:00000000 00000090H .data                   DATA
 0002:00000090 0000049dH .bss                    DATA
 0003:00000000 00000004H .CRT$XCA                DATA
 0003:00000004 00000004H .CRT$XCU                DATA
 0003:00000008 00000004H .CRT$XCZ                DATA
 0004:00000000 00000004H .STL$A                  DATA
 0004:00000004 00000004H .STL$L                  DATA
 0004:00000008 00000004H .STL$M                  DATA
 0004:0000000c 00000004H .STL$Z                  DATA
 0005:00000000 0000168cH PAGE                    CODE
 0006:00000000 0000067cH INIT                    CODE
 0006:0000067c 00000028H .idata$2                CODE
 0006:000006a4 00000014H .idata$3                CODE
 0006:000006b8 000000fcH .idata$4                CODE
 0006:000007b4 00000506H .idata$6                CODE
 0007:00000000 000000c8H .rsrc$01                DATA
 0007:000000d0 00000878H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0000:00000000       __except_list              00000000     <absolute>
 0001:00000000       __imp_@KfAcquireSpinLock@4 00010320     wdm:HAL.DLL
 0001:00000004       __imp__KeGetCurrentIrql@0  00010324     wdm:HAL.DLL
 0001:00000008       __imp_@KfReleaseSpinLock@8 00010328     wdm:HAL.DLL
 0001:0000000c       \177HAL_NULL_THUNK_DATA    0001032c     wdm:HAL.DLL
 0001:00000010       __imp__ZwClose@4           00010330     wdm:NTOSKRNL.EXE
 0001:00000014       __imp__IoGetDeviceProperty@20 00010334     wdm:NTOSKRNL.EXE
 0001:00000018       __imp__IoWMIWriteEvent@4   00010338     wdm:NTOSKRNL.EXE
 0001:0000001c       __imp__KeQuerySystemTime@4 0001033c     wdm:NTOSKRNL.EXE
 0001:00000020       __imp__IoWMIRegistrationControl@8 00010340     wdm:NTOSKRNL.EXE
 0001:00000024       __imp__PoStartNextPowerIrp@4 00010344     wdm:NTOSKRNL.EXE
 0001:00000028       __imp_@ObfDereferenceObject@4 00010348     wdm:NTOSKRNL.EXE
 0001:0000002c       __imp__KeWaitForSingleObject@20 0001034c     wdm:NTOSKRNL.EXE
 0001:00000030       __imp__KeReleaseMutex@8    00010350     wdm:NTOSKRNL.EXE
 0001:00000034       __imp_@IofCompleteRequest@8 00010354     wdm:NTOSKRNL.EXE
 0001:00000038       __imp__PoCallDriver@8      00010358     wdm:NTOSKRNL.EXE
 0001:0000003c       __imp_@IofCallDriver@8     0001035c     wdm:NTOSKRNL.EXE
 0001:00000040       __imp__RtlUnwind@16        00010360     wdm:NTOSKRNL.EXE
 0001:00000044       __imp__RtlInitAnsiString@8 00010364     wdm:NTOSKRNL.EXE
 0001:00000048       __imp__DbgBreakPoint@0     00010368     wdm:NTOSKRNL.EXE
 0001:0000004c       __imp__memmove             0001036c     wdm:NTOSKRNL.EXE
 0001:00000050       __imp__strchr              00010370     wdm:NTOSKRNL.EXE
 0001:00000054       __imp___vsnprintf          00010374     wdm:NTOSKRNL.EXE
 0001:00000058       __imp__DbgPrint            00010378     wdm:NTOSKRNL.EXE
 0001:0000005c       __imp_@InterlockedIncrement@4 0001037c     wdm:NTOSKRNL.EXE
 0001:00000060       __imp_@InterlockedDecrement@4 00010380     wdm:NTOSKRNL.EXE
 0001:00000064       __imp__IoDeleteDevice@4    00010384     wdm:NTOSKRNL.EXE
 0001:00000068       __imp__RtlAppendUnicodeStringToString@8 00010388     wdm:NTOSKRNL.EXE
 0001:0000006c       __imp__IoDeleteSymbolicLink@4 0001038c     wdm:NTOSKRNL.EXE
 0001:00000070       __imp__IoCreateSymbolicLink@8 00010390     wdm:NTOSKRNL.EXE
 0001:00000074       __imp__RtlAssert@16        00010394     wdm:NTOSKRNL.EXE
 0001:00000078       __imp__IoAttachDeviceToDeviceStack@8 00010398     wdm:NTOSKRNL.EXE
 0001:0000007c       __imp__RtlIntegerToUnicodeString@12 0001039c     wdm:NTOSKRNL.EXE
 0001:00000080       __imp__IoAllocateIrp@8     000103a0     wdm:NTOSKRNL.EXE
 0001:00000084       __imp__IoFreeIrp@4         000103a4     wdm:NTOSKRNL.EXE
 0001:00000088       __imp__ExFreePool@4        000103a8     wdm:NTOSKRNL.EXE
 0001:0000008c       __imp__ZwOpenKey@12        000103ac     wdm:NTOSKRNL.EXE
 0001:00000090       __imp__ZwCreateKey@28      000103b0     wdm:NTOSKRNL.EXE
 0001:00000094       __imp__RtlCopyUnicodeString@8 000103b4     wdm:NTOSKRNL.EXE
 0001:00000098       __imp_@InterlockedExchange@8 000103b8     wdm:NTOSKRNL.EXE
 0001:0000009c       __imp__RtlFreeUnicodeString@4 000103bc     wdm:NTOSKRNL.EXE
 0001:000000a0       __imp__IoDetachDevice@4    000103c0     wdm:NTOSKRNL.EXE
 0001:000000a4       __imp__IoAcquireCancelSpinLock@4 000103c4     wdm:NTOSKRNL.EXE
 0001:000000a8       __imp__IoReleaseCancelSpinLock@4 000103c8     wdm:NTOSKRNL.EXE
 0001:000000ac       __imp__KeClearEvent@4      000103cc     wdm:NTOSKRNL.EXE
 0001:000000b0       __imp__KeSetEvent@12       000103d0     wdm:NTOSKRNL.EXE
 0001:000000b4       __imp__PoRequestPowerIrp@24 000103d4     wdm:NTOSKRNL.EXE
 0001:000000b8       __imp__PoSetPowerState@12  000103d8     wdm:NTOSKRNL.EXE
 0001:000000bc       __imp__IoCancelIrp@4       000103dc     wdm:NTOSKRNL.EXE
 0001:000000c0       __imp__IoRegisterDeviceInterface@16 000103e0     wdm:NTOSKRNL.EXE
 0001:000000c4       __imp__IoSetDeviceInterfaceState@8 000103e4     wdm:NTOSKRNL.EXE
 0001:000000c8       __imp__KeInitializeSpinLock@4 000103e8     wdm:NTOSKRNL.EXE
 0001:000000cc       __imp__ExAllocatePoolWithTag@12 000103ec     wdm:NTOSKRNL.EXE
 0001:000000d0       __imp__IoCreateDevice@28   000103f0     wdm:NTOSKRNL.EXE
 0001:000000d4       __imp_@ObfReferenceObject@4 000103f4     wdm:NTOSKRNL.EXE
 0001:000000d8       __imp__KeInitializeMutex@8 000103f8     wdm:NTOSKRNL.EXE
 0001:000000dc       __imp__IoGetDeviceObjectPointer@16 000103fc     wdm:NTOSKRNL.EXE
 0001:000000e0       __imp__IoBuildDeviceIoControlRequest@36 00010400     wdm:NTOSKRNL.EXE
 0001:000000e4       __imp__KeInitializeEvent@12 00010404     wdm:NTOSKRNL.EXE
 0001:000000e8       __imp__KeRemoveEntryDeviceQueue@8 00010408     wdm:NTOSKRNL.EXE
 0001:000000ec       __imp_@KefAcquireSpinLockAtDpcLevel@4 0001040c     wdm:NTOSKRNL.EXE
 0001:000000f0       __imp_@KefReleaseSpinLockFromDpcLevel@4 00010410     wdm:NTOSKRNL.EXE
 0001:000000f4       __imp__RtlInitUnicodeString@8 00010414     wdm:NTOSKRNL.EXE
 0001:000000f8       \177NTOSKRNL_NULL_THUNK_DATA 00010418     wdm:NTOSKRNL.EXE
 0001:0000011c       ??_C@_0DF@OJJCGMGD@DriverWorks?5?$CIc?$CJ?5Copyright?52003?5C@ 0001043c     WMISample.obj
 0001:00000154       ??_7WMISample@@6B@         00010474     WMISample.obj
 0001:00000168       ??_7KDriver@@6B@           00010488     WMISample.obj
 0001:0000017c       ??_C@_0BL@NNGFNHOB@m_Irp?9?$DOCurrentLocation?5?$DO?51?$AA@ 0001049c     WMISample.obj
 0001:00000198       ??_C@_0CM@FADDDCMO@m_Irp?9?$DOCurrentLocation?5?$DM?$DN?5m_Irp?9@ 000104b8     WMISample.obj
 0001:000001c4       ??_C@_0DO@EFKCJHCD@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000104e4     WMISample.obj
 0001:00000248       ??_7WMISampleDevice@@6B@   00010568     WMISampleDevice.obj
 0001:00000374       ??_7?$KWmiDataBlock@USamplePdoInfo@@V_none_@@VKStdWmiInterface@@@@6B@ 00010694     WMISampleDevice.obj
 0001:00000394       ??_7?$KWmiDataBlock@USampleControl@@V_none_@@VKStdWmiInterface@@@@6B@ 000106b4     WMISampleDevice.obj
 0001:000003b4       ??_7?$KWmiDataBlock@USampleEvent@@V_none_@@VKStdWmiInterface@@@@6B@ 000106d4     WMISampleDevice.obj
 0001:000003d4       ??_7?$KWmiDataBlock@USampleActivity@@VWMISampleDevice@@VKStdWmiInterface@@@@6B@ 000106f4     WMISampleDevice.obj
 0001:000003f4       ??_C@_0CJ@MEJCFGOE@?$CIindex?5?$DO?$DN?50?$CJ?5?$CG?$CG?5?$CIindex?5?$DM?$DN?5m_MaxI@ 00010714     WMISampleDevice.obj
 0001:00000420       ??_C@_0EA@ODBOPLLN@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010740     WMISampleDevice.obj
 0001:00000460       ??_7?$KWmiBlock@VKStdWmiInterface@@@@6B@ 00010780     WMISampleDevice.obj
 0001:0000048c       ??_C@_05MAJJAKPI@FALSE?$AA@ 000107ac     WMISampleDevice.obj
 0001:00000498       ??_C@_0EB@COLAEKAL@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000107b8     WMISampleDevice.obj
 0001:000004dc       ??_C@_02DKCKIIND@?$CFs?$AA@ 000107fc     WMISampleDevice.obj
 0001:000004e0       ??_C@_0CG@IJCOJOJN@I?4MajorFunction?$CINEXT?$CJ?5?$DN?$DN?5IRP_MJ_@ 00010800     WMISampleDevice.obj
 0001:00000508       ??_C@_0EB@JAFEGOBF@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010828     WMISampleDevice.obj
 0001:0000054c       ??_C@_0BE@HGMFHLDM@?4?2?4?4?2include?2kirp?4h?$AA@ 0001086c     vdw_wdm:ktrace.obj
 0001:00000560       ??_7KDevice@@6B@           00010880     vdw_wdm:kdevice.obj
 0001:000005e8       ??_7KDeviceBase@@6B@       00010908     vdw_wdm:kdevice.obj
 0001:000005f0       ??_C@_0BH@BINHOGGO@?4?2?4?4?2include?2kdevice?4h?$AA@ 00010910     vdw_wdm:kdevice.obj
 0001:00000608       ??_7KPnpDevice@@6B@        00010928     vdw_wdm:kpnpdev.obj
 0001:00000734       ??_C@_0O@KBDMFNDM@m_pdq?5?$CB?$DN?5NULL?$AA@ 00010a54     vdw_wdm:kpnpdev.obj
 0001:00000744       ??_C@_0BH@BIPCAELK@?4?2?4?4?2include?2kdevque?4h?$AA@ 00010a64     vdw_wdm:kpnpdev.obj
 0001:0000075c       ??_C@_0DN@BBDLMDMH@?$CIOnSuccess?$CJ?5?$HM?5?$CIOnError?$CJ?5?$HM?5?$CIOnCan@ 00010a7c     vdw_wdm:kpnpdev.obj
 0001:0000079c       ??_C@_0BH@LIGMDPNJ@?4?2?4?4?2include?2kpnplow?4h?$AA@ 00010abc     vdw_wdm:kpnpdev.obj
 0001:000007b4       ??_7?$KList@UINTERFACE_LIST_ENTRY@@@@6B@ 00010ad4     vdw_wdm:kpnpdev.obj
 0001:00000840       ?AddDevice@WMISample@@UAEJPAU_DEVICE_OBJECT@@@Z 00010b60 f   WMISample.obj
 0001:00000920       ??2@YAPAXI@Z               00010c40 f i WMISample.obj
 0001:00000950       ??2@YAPAXIW4_POOL_TYPE@@@Z 00010c70 f i WMISample.obj
 0001:00000990       ??_V@YAXPAX@Z              00010cb0 f i WMISample.obj