Debugging/Windows

!ndiskd.pendingnbls

haewon83 2022. 8. 30. 09:27

Pending되어 있는 NBL을 확인하기 위해서는 ndiskd extension을 사용할 수 있습니다.

0: kd> !ndiskd.pendingnbls
    This command requires NBL tracking to be enabled on the debugee target
    machine.  (By default, client operating systems have level 2, and servers
    have level 0).  To enable, set this REG_DWORD value to a nonzero value on
    the target machine and reboot the target machine:
     
    HKLM\SYSTEM\CurrentControlSet\Services\NDIS\Parameters ! TrackNblOwner
    Possible Values (features are cumulative)
    * 0:  Disable all tracking.
    * 1:  Track the most recent owner of each NBL (enables !ndiskd.pendingnbls)
    * 2:  Scan for leaks at runtime (use with StuckNblReaction)
    * 3:  Keep a full history of all activity (enables !ndiskd.nbllog and
    !ndiskd.nbl -log)
    * 4:  Take stack capture snapshots (slow, but enables !ndiskd.nbl -log
    -stacks)
 
    Show me all allocated NBLs so I can manually find the one I want ## Hyperlink 클릭
 
0: kd> !ndiskd.nblpool -force -find ((@$extin.Flags)&0x108)==0x100)
    Num Matches        NBL Pool            Tag                Allocated by     
    48953 matches      ffffe0011d27e000    UNbl               NETIO!NetioAllocateNetBufferListNetBufferMdlAndDataPool+50
    3818 matches       ffffe0011d243000    TNbl               NETIO!NetioAllocateNetBufferListNetBufferMdlAndDataPool+50
    9177 matches       ffffe0011ce09000    Nnnn               NETIO!NetioInitializeNetBufferListLibrary+13e
    154 matches        ffffe0011ce00000    Nnbl               NETIO!NetioInitializeNetBufferListLibrary+112