Debugging Tools for Windows |
!vpb扩展显示某个卷参数块(volume parameter block (VPB))。
Windows NT 4.0 | 不可用 |
Windows 2000 | Kdextx86.dll |
Windows XP和之后 | Kdexts.dll |
下面是一个例子。首先用!devnode扩展显示设备树:
Dumping IopRootDeviceNode (= 0x80e203b8)
DevNode 0x80e203b8 for PDO 0x80e204f8
InstancePath is "HTREE\ROOT\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x80e56dc8 for PDO 0x80e56f18
InstancePath is "Root\dmio\0000"
ServiceName is "dmio"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x80e56ae8 for PDO 0x80e56c38
InstancePath is "Root\ftdisk\0000"
ServiceName is "ftdisk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x80e152a0 for PDO 0x80e15cb8
InstancePath is "STORAGE\Volume\1&30a96598&0&Signature5C34D70COffset7E00Length60170A00"
ServiceName is "VolSnap"
TargetDeviceNotify List - f 0xe1250938 b 0xe14b9198
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
.....
列出的最后一个节点是一个volume。使用!devobj扩展查看它的物理设备对象(physical device object (PDO)):
Device object (80e15cb8) is for:
HarddiskVolume1 \Driver\Ftdisk DriverObject 80e4e248
Current Irp 00000000 RefCount 14 Type 00000007 Flags 00001050
Vpb 80e15c30 DevExt 80e15d70 DevObjExt 80e15e40 Dope 80e15bd8 DevNode 80e152a0
ExtensionFlags (0000000000)
AttachedDevice (Upper) 80e14c60 \Driver\VolSnap
Device queue is not busy.
列出的内容中包括VPB 地址。使用!vpb扩展和这个地址:
Vpb at 0x80e15c30
Flags: 0x1 mounted
DeviceObject: 0x80de5020
RealDevice: 0x80e15cb8
RefCount: 14
Volume Label: MY-DISK-C
关于VPB的信息,查看Windows Driver Kit (WDK) 文档以及Mark Russinovich 和David Solomon 编写的Microsoft Windows Internals。