Bug Hunter Diary

__in struct _IRP *Irp){ ... }The second function parameter is a pointer to an I/O request packet(IRP) structure. An IRP is the basic structure that the Windows I/Omanager uses to communicate with drivers and allow drivers to communicatewith each other. This structure transports the user-suppliedIOCTL data as well as the requested IOCTL code. 14I then had a look at the disassembly of the dispatch routine inorder to generate a list of the IOCTLs:[..].text:0001098C ; int __stdcall sub_1098C(int, PIRP Irp).text:0001098C sub_1098C proc near ; DATA XREF: DriverEntry+130[..].text:000109B2 mov ebx, [ebp+Irp] ; ebx = address of IRP.text:000109B5 mov eax, [ebx+60h][..]A pointer to the IRP structure is stored in EBX at address.text:000109B2 of the IOCTL dispatch routine. Then a value, locatedat offset 0x60 of the IRP structure, is referenced (see .text:000109B5).kd> dt -v -r 3 _IRPnt!_IRPstruct _IRP, 21 elements, 0x70 bytes+0x000 Type : ??+0x002 Size : ??+0x004 MdlAddress : ????+0x008 Flags : ??[..]+0x040 Tail : union __unnamed, 3 elements, 0x30 bytes+0x000 Overlay : struct __unnamed, 8 elements, 0x28 bytes+0x000 DeviceQueueEntry : struct _KDEVICE_QUEUE_ENTRY, 3 elements, 0x10 bytes+0x000 DriverContext : [4] ????+0x010 Thread : ????+0x014 AuxiliaryBuffer : ????+0x018 ListEntry : struct _LIST_ENTRY, 2 elements, 0x8 bytes+0x020 CurrentStackLocation : ????[..]The output of WinDbg shows that the IRP structure memberCurrentStackLocation is located at offset 0x60. This structure is definedin ntddk.h of the Windows Driver Kit:[..]//// I/O Request Packet (IRP) definition//typedef struct _IRP {One Kernel to Rule Them All 95