Debugging/Windows
!ndiskd.pendingnbls
haewon83
2022. 8. 30. 09:27
Pending되어 있는 NBL을 확인하기 위해서는 ndiskd extension을 사용할 수 있습니다.
0: kd> !ndiskd.pendingnbls
This command requires NBL tracking to be enabled on the debugee target
machine. (By default, client operating systems have level 2, and servers
have level 0). To enable, set this REG_DWORD value to a nonzero value on
the target machine and reboot the target machine:
HKLM\SYSTEM\CurrentControlSet\Services\NDIS\Parameters ! TrackNblOwner
Possible Values (features are cumulative)
* 0: Disable all tracking.
* 1: Track the most recent owner of each NBL (enables !ndiskd.pendingnbls)
* 2: Scan for leaks at runtime (use with StuckNblReaction)
* 3: Keep a full history of all activity (enables !ndiskd.nbllog and
!ndiskd.nbl -log)
* 4: Take stack capture snapshots (slow, but enables !ndiskd.nbl -log
-stacks)
Show me all allocated NBLs so I can manually find the one I want ## Hyperlink 클릭
0: kd> !ndiskd.nblpool -force -find ((@$extin.Flags)&0x108)==0x100)
Num Matches NBL Pool Tag Allocated by
48953 matches ffffe0011d27e000 UNbl NETIO!NetioAllocateNetBufferListNetBufferMdlAndDataPool+50
3818 matches ffffe0011d243000 TNbl NETIO!NetioAllocateNetBufferListNetBufferMdlAndDataPool+50
9177 matches ffffe0011ce09000 Nnnn NETIO!NetioInitializeNetBufferListLibrary+13e
154 matches ffffe0011ce00000 Nnbl NETIO!NetioInitializeNetBufferListLibrary+112