Internal to Windows, and in conjunction with I/O Request Packets (IRPs), data structures are used to send down specific I/O requests. For example, for storage class devices, Windows drivers build up SCSI_REQUEST_BLOCK structures (SRBs). Embedded within the SRB are the CDB, any data buffer locations, timeout values, and more. For USB requests, Windows drivers build up URB structures (USB Request Blocks). Embedded within the URB are the URB function, any data buffer locations, URB status, and more. The same is true for IOCTLs (though there are many different IOCTL structures in use). busTRACE takes a snapshot of key data structures as they go down the I/O stack and back up the I/O stack (the I/O stack concept was discussed in the Raw Data section). By clicking on the Data Structures tab, you can view these captured structures in their decoded format. For those of you familiar with 'C' data structures, and the Microsoft's Windows Driver Development Kit, these structures will likely look familiar to you. We show you the data structure name (as defined by the DDK), the value that was captured, the structure offset where the data was located, as well as the size of the data for that specific structure item. The View tree control to the left side shows you the available data that busTRACE has captured and can decode for you. Simply select the data structure you are interested in viewing. Below are some common values:
At the top of the window, a toolbar is available with various options.
See Also: |
|