filethread2.map

Windows XP WDM 驱动实例,使用DriverWorks编写

 FileThread2

 Timestamp is 46971f97 (Fri Jul 13 14:45:43 2007)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 00000114H .idata$5                CODE
 0001:00000120 0000063cH .rdata                  CODE
 0001:0000075c 00000047H .rdata$debug            CODE
 0001:000007b0 0000bbe0H .text                   CODE
 0001:0000c390 0000006cH .text$yc                CODE
 0001:0000c400 0000001fH .text$yd                CODE
 0002:00000000 00000170H .data                   DATA
 0002:00000170 000005d5H .bss                    DATA
 0003:00000000 00000004H .CRT$XCA                DATA
 0003:00000004 00000008H .CRT$XCU                DATA
 0003:0000000c 00000004H .CRT$XCZ                DATA
 0004:00000000 00000004H .STL$A                  DATA
 0004:00000004 00000004H .STL$L                  DATA
 0004:00000008 00000004H .STL$M                  DATA
 0004:0000000c 00000004H .STL$Z                  DATA
 0005:00000000 000013f1H PAGE                    CODE
 0006:00000000 000006ccH INIT                    CODE
 0006:000006cc 00000028H .idata$2                CODE
 0006:000006f4 00000014H .idata$3                CODE
 0006:00000708 00000114H .idata$4                CODE
 0006:0000081c 00000580H .idata$6                CODE
 0007:00000000 00000058H .rsrc$01                DATA
 0007:00000060 00000338H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0001:00000000       __imp__KeGetCurrentIrql@0  00010320     wdm:HAL.DLL
 0001:00000004       __imp_@KfReleaseSpinLock@8 00010324     wdm:HAL.DLL
 0001:00000008       __imp_@KfAcquireSpinLock@4 00010328     wdm:HAL.DLL
 0001:0000000c       \177HAL_NULL_THUNK_DATA    0001032c     wdm:HAL.DLL
 0001:00000010       __imp__ZwClose@4           00010330     wdm:NTOSKRNL.EXE
 0001:00000014       __imp__PoSetPowerState@12  00010334     wdm:NTOSKRNL.EXE
 0001:00000018       __imp__DbgPrint            00010338     wdm:NTOSKRNL.EXE
 0001:0000001c       __imp__KeInitializeSpinLock@4 0001033c     wdm:NTOSKRNL.EXE
 0001:00000020       __imp__RtlAssert@16        00010340     wdm:NTOSKRNL.EXE
 0001:00000024       __imp__ExFreePool@4        00010344     wdm:NTOSKRNL.EXE
 0001:00000028       __imp__IoAllocateIrp@8     00010348     wdm:NTOSKRNL.EXE
 0001:0000002c       __imp__IoFreeIrp@4         0001034c     wdm:NTOSKRNL.EXE
 0001:00000030       __imp__PoStartNextPowerIrp@4 00010350     wdm:NTOSKRNL.EXE
 0001:00000034       __imp__ExAllocatePoolWithTag@12 00010354     wdm:NTOSKRNL.EXE
 0001:00000038       __imp__KeReleaseSemaphore@16 00010358     wdm:NTOSKRNL.EXE
 0001:0000003c       __imp_@IofCompleteRequest@8 0001035c     wdm:NTOSKRNL.EXE
 0001:00000040       __imp__PsTerminateSystemThread@4 00010360     wdm:NTOSKRNL.EXE
 0001:00000044       __imp_@ObfDereferenceObject@4 00010364     wdm:NTOSKRNL.EXE
 0001:00000048       __imp__PoCallDriver@8      00010368     wdm:NTOSKRNL.EXE
 0001:0000004c       __imp_@IofCallDriver@8     0001036c     wdm:NTOSKRNL.EXE
 0001:00000050       __imp__strncpy             00010370     wdm:NTOSKRNL.EXE
 0001:00000054       __imp__RtlTimeToTimeFields@8 00010374     wdm:NTOSKRNL.EXE
 0001:00000058       __imp__ExSystemTimeToLocalTime@8 00010378     wdm:NTOSKRNL.EXE
 0001:0000005c       __imp__KeQuerySystemTime@4 0001037c     wdm:NTOSKRNL.EXE
 0001:00000060       __imp__KeWaitForSingleObject@20 00010380     wdm:NTOSKRNL.EXE
 0001:00000064       __imp__RtlInitAnsiString@8 00010384     wdm:NTOSKRNL.EXE
 0001:00000068       __imp__DbgBreakPoint@0     00010388     wdm:NTOSKRNL.EXE
 0001:0000006c       __imp__memmove             0001038c     wdm:NTOSKRNL.EXE
 0001:00000070       __imp__strchr              00010390     wdm:NTOSKRNL.EXE
 0001:00000074       __imp___vsnprintf          00010394     wdm:NTOSKRNL.EXE
 0001:00000078       __imp_@InterlockedIncrement@4 00010398     wdm:NTOSKRNL.EXE
 0001:0000007c       __imp_@InterlockedDecrement@4 0001039c     wdm:NTOSKRNL.EXE
 0001:00000080       __imp__IoDeleteDevice@4    000103a0     wdm:NTOSKRNL.EXE
 0001:00000084       __imp__RtlAppendUnicodeStringToString@8 000103a4     wdm:NTOSKRNL.EXE
 0001:00000088       __imp__IoDeleteSymbolicLink@4 000103a8     wdm:NTOSKRNL.EXE
 0001:0000008c       __imp__IoCreateSymbolicLink@8 000103ac     wdm:NTOSKRNL.EXE
 0001:00000090       __imp__IoCreateDevice@28   000103b0     wdm:NTOSKRNL.EXE
 0001:00000094       __imp__IoAttachDeviceToDeviceStack@8 000103b4     wdm:NTOSKRNL.EXE
 0001:00000098       __imp__RtlInitUnicodeString@8 000103b8     wdm:NTOSKRNL.EXE
 0001:0000009c       __imp__ZwOpenKey@12        000103bc     wdm:NTOSKRNL.EXE
 0001:000000a0       __imp__ZwCreateKey@28      000103c0     wdm:NTOSKRNL.EXE
 0001:000000a4       __imp__RtlCopyUnicodeString@8 000103c4     wdm:NTOSKRNL.EXE
 0001:000000a8       __imp_@InterlockedExchange@8 000103c8     wdm:NTOSKRNL.EXE
 0001:000000ac       __imp__RtlFreeUnicodeString@4 000103cc     wdm:NTOSKRNL.EXE
 0001:000000b0       __imp__KeReleaseMutex@8    000103d0     wdm:NTOSKRNL.EXE
 0001:000000b4       __imp__IoDetachDevice@4    000103d4     wdm:NTOSKRNL.EXE
 0001:000000b8       __imp__IoAcquireCancelSpinLock@4 000103d8     wdm:NTOSKRNL.EXE
 0001:000000bc       __imp__IoReleaseCancelSpinLock@4 000103dc     wdm:NTOSKRNL.EXE
 0001:000000c0       __imp__KeClearEvent@4      000103e0     wdm:NTOSKRNL.EXE
 0001:000000c4       __imp__KeSetEvent@12       000103e4     wdm:NTOSKRNL.EXE
 0001:000000c8       __imp__PoRequestPowerIrp@24 000103e8     wdm:NTOSKRNL.EXE
 0001:000000cc       __imp__IoCancelIrp@4       000103ec     wdm:NTOSKRNL.EXE
 0001:000000d0       __imp__IoRegisterDeviceInterface@16 000103f0     wdm:NTOSKRNL.EXE
 0001:000000d4       __imp__IoSetDeviceInterfaceState@8 000103f4     wdm:NTOSKRNL.EXE
 0001:000000d8       __imp__ObReferenceObjectByHandle@24 000103f8     wdm:NTOSKRNL.EXE
 0001:000000dc       __imp__PsCreateSystemThread@28 000103fc     wdm:NTOSKRNL.EXE
 0001:000000e0       __imp__ZwCreateFile@44     00010400     wdm:NTOSKRNL.EXE
 0001:000000e4       __imp__ZwReadFile@36       00010404     wdm:NTOSKRNL.EXE
 0001:000000e8       __imp__ZwWriteFile@36      00010408     wdm:NTOSKRNL.EXE
 0001:000000ec       __imp__ZwQueryInformationFile@20 0001040c     wdm:NTOSKRNL.EXE
 0001:000000f0       __imp__KeInitializeSemaphore@12 00010410     wdm:NTOSKRNL.EXE
 0001:000000f4       __imp__IoGetDeviceObjectPointer@16 00010414     wdm:NTOSKRNL.EXE
 0001:000000f8       __imp__IoBuildDeviceIoControlRequest@36 00010418     wdm:NTOSKRNL.EXE
 0001:000000fc       __imp__KeInitializeEvent@12 0001041c     wdm:NTOSKRNL.EXE
 0001:00000100       __imp__KeInitializeMutex@8 00010420     wdm:NTOSKRNL.EXE
 0001:00000104       __imp__KeRemoveEntryDeviceQueue@8 00010424     wdm:NTOSKRNL.EXE
 0001:00000108       __imp_@KefAcquireSpinLockAtDpcLevel@4 00010428     wdm:NTOSKRNL.EXE
 0001:0000010c       __imp_@KefReleaseSpinLockFromDpcLevel@4 0001042c     wdm:NTOSKRNL.EXE
 0001:00000110       \177NTOSKRNL_NULL_THUNK_DATA 00010430     wdm:NTOSKRNL.EXE
 0001:0000013c       ??_C@_0DF@OJJCGMGD@DriverWorks?5?$CIc?$CJ?5Copyright?52003?5C@ 0001045c     FileThread2.obj
 0001:00000174       ??_7FileThread2@@6B@       00010494     FileThread2.obj
 0001:00000188       ??_7KDriver@@6B@           000104a8     FileThread2.obj
 0001:0000019c       ??_C@_0BL@NNGFNHOB@m_Irp?9?$DOCurrentLocation?5?$DO?51?$AA@ 000104bc     FileThread2.obj
 0001:000001b8       ??_C@_0CM@FADDDCMO@m_Irp?9?$DOCurrentLocation?5?$DM?$DN?5m_Irp?9@ 000104d8     FileThread2.obj
 0001:000001e4       ??_C@_0DO@EFKCJHCD@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010504     FileThread2.obj
 0001:00000224       ??_C@_02DKCKIIND@?$CFs?$AA@ 00010544     FileThread2.obj
 0001:00000228       ??_C@_02GMHACPFF@?$CFu?$AA@ 00010548     FileThread2.obj
 0001:0000022c       ??_C@_07KFGDNAFA@0x?$CF08lx?$AA@ 0001054c     FileThread2.obj
 0001:00000238       ??_7FileThread2Device@@6B@ 00010558     FileThread2Device.obj
 0001:00000364       ??_C@_05MAJJAKPI@FALSE?$AA@ 00010684     FileThread2Device.obj
 0001:00000370       ??_C@_0EB@COLAEKAL@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010690     FileThread2Device.obj
 0001:000003b4       ??_C@_0DJ@DOBONJOP@?$CB?$CCCan?8t?5wait?5on?5Threads?5in?5Win9X@ 000106d4     FileThread2Device.obj
 0001:000003f0       ??_C@_0EC@MDAOKCIJ@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010710     FileThread2Device.obj
 0001:00000434       ??_C@_0DG@IFCHMJKE@Can?8t?5wait?5on?5Threads?5in?5Win9X?4?5@ 00010754     FileThread2Device.obj
 0001:0000046c       ??_C@_0CG@IJCOJOJN@I?4MajorFunction?$CINEXT?$CJ?5?$DN?$DN?5IRP_MJ_@ 0001078c     FileThread2Device.obj
 0001:00000498       ??_C@_0EB@JAFEGOBF@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000107b8     FileThread2Device.obj
 0001:000004dc       ??_7DebugPrint@@6B@        000107fc     DebugPrint.obj
 0001:000004e0       ??_C@_0BE@HGMFHLDM@?4?2?4?4?2include?2kirp?4h?$AA@ 00010800     vdw_wdm:ktrace.obj
 0001:000004f8       ??_7KDevice@@6B@           00010818     vdw_wdm:kdevice.obj
 0001:00000580       ??_7KDeviceBase@@6B@       000108a0     vdw_wdm:kdevice.obj
 0001:00000588       ??_C@_0BH@BINHOGGO@?4?2?4?4?2include?2kdevice?4h?$AA@ 000108a8     vdw_wdm:kdevice.obj
 0001:000005a0       ??_7KPnpDevice@@6B@        000108c0     vdw_wdm:kpnpdev.obj
 0001:000006cc       ??_C@_0O@KBDMFNDM@m_pdq?5?$CB?$DN?5NULL?$AA@ 000109ec     vdw_wdm:kpnpdev.obj
 0001:000006dc       ??_C@_0BH@BIPCAELK@?4?2?4?4?2include?2kdevque?4h?$AA@ 000109fc     vdw_wdm:kpnpdev.obj
 0001:000006f4       ??_C@_0DN@BBDLMDMH@?$CIOnSuccess?$CJ?5?$HM?5?$CIOnError?$CJ?5?$HM?5?$CIOnCan@ 00010a14     vdw_wdm:kpnpdev.obj
 0001:00000734       ??_C@_0BH@LIGMDPNJ@?4?2?4?4?2include?2kpnplow?4h?$AA@ 00010a54     vdw_wdm:kpnpdev.obj
 0001:0000074c       ??_7?$KList@UINTERFACE_LIST_ENTRY@@@@6B@ 00010a6c     vdw_wdm:kpnpdev.obj
 0001:0000082c       ?AddDevice@FileThread2@@UAEJPAU_DEVICE_OBJECT@@@Z 00010b4c f   FileThread2.obj
 0001:00000970       ??2@YAPAXI@Z               00010c90 f i FileThread2.obj
 0001:000009a0       ??2@YAPAXIW4_POOL_TYPE@@@Z 00010cc0 f i FileThread2.obj
 0001:000009e0       ?ConstructorStatus@KDevice@@QAEJXZ 00010d00 f i FileThread2.obj
 0001:00000a00       ??1KRegistryKey@@QAE@XZ    00010d20 f i FileThread2.obj
 0001:00000a90       ??3@YAXPAX@Z               00010db0 f i FileThread2.obj
 0001:00000a90       ??_V@YAXPAX@Z              00010db0 f i FileThread2.obj
 0001:00000ab0       ?Invalidate@KRegistryKey@@QAEXXZ 00010dd0 f i FileThread2.obj
 0001:00000ae0       ?LastError@KRegistryKey@@QAEJXZ 00010e00 f i FileThread2.obj
 0001:00000b00       ?_self_delete@KDriver@@EAEXXZ 00010e20 f i FileThread2.obj
 0001:00000b40       ??_GKDriver@@QAEPAXI@Z     00010e60 f i FileThread2.obj
 0001:00000b70       ??1KDriver@@QAE@XZ         00010e90 f i FileThread2.obj
 0001:00000bc0       ?DriverInstance@KDriver@@SGPAV1@XZ 00010ee0 f i FileThread2.obj
 0001:00000bd0       ?AddDeviceDispatch@KDriver@@KGJPAU_DRIVER_OBJECT@@PAU_DEVICE_OBJECT@@@Z 00010ef0 f   FileThread2.obj
 0001:00000c30       ?DriverIrpDispatch@KDriver@@SGJPAU_DEVICE_OBJECT@@PAU_IRP@@@Z 00010f50 f   FileThread2.obj
 0001:00000cd0       ??0KIrp@@QAE@PAU_IRP@@@Z   00010ff0 f i FileThread2.obj
 0001:00000cf0       ?MajorFunction@KIrp@@QAEAAEW4EStackLocation@@@Z 00011010 f i FileThread2.obj
 0001:00000d30       ?ValidateStackLocation@KIrp@@QAEXW4EStackLocation@@@Z 00011050 f i FileThread2.obj
 0001:00000dc0       ?DispatchFilter@KDriver@@UAEJPAVKDevice@@VKIrp@@P82@AEJ1@Z@Z 000110e0 f   FileThread2.obj
 0001:00000e3a       __purecall                 0001115a f   FileThread2.obj