windbgkmdfwdf

WinDBG: How to get the underlying FILE_OBJECT from a WDFFILEOBJECT handle?

I'm having a WDFFILEOBJECT handle(0x0000057fedd9b8b8), and I want to know its underlying FILE_OBJECT address, so that I can use !object xxxx to query the FILE_OBJECT's .PointerCount and .HandleCount. What windbg command can I use?

!wdfkd.wdfhandle 0x0000057fedd9b8b8 f0 does not seems to provide that information.

enter image description here

Were it a WDFDEVICE handle, I know !wdfkd.wdfdevice can tell me the underlying DEVICE_OBJECT, but what about WDFFILEOBJECT?

====== SOLVED (many days later) =====

According to snoone's hint, I figured it out. Live information below:

This time, FileObject=0x0000057fede811b8 .

enter image description here

I have to use !wdfkd.handle 0x0000057fede811b8 f0 first, because the handle value 0x0000057fede811b8 is not a valid kernel address, !wdfkd.handle tells the real kernel address for the KMDF FxObject behind the handle.

Solution

  • Try using the dt command specified in the output (dt wdf01000!FxFileObject 0x)