IRP_MN_QUERY_LEGACY_BUS_INFORMATION IRP_MN_SURPRISE_REMOVAL IRP_MN_DEVICE_USAGE_NOTIFICATION    IRP_MN_QUERY_BUS_INFORMATION    IRP_MN_QUERY_PNP_DEVICE_STATE   IRP_MN_QUERY_ID IRP_MN_SET_LOCK IRP_MN_EJECT    IRP_MN_WRITE_CONFIG IRP_MN_READ_CONFIG  INVALID_IRP_CODE    IRP_MN_FILTER_RESOURCE_REQUIREMENTS IRP_MN_QUERY_DEVICE_TEXT    IRP_MN_QUERY_RESOURCE_REQUIREMENTS  IRP_MN_QUERY_RESOURCES  IRP_MN_QUERY_CAPABILITIES   IRP_MN_QUERY_INTERFACE  IRP_MN_QUERY_DEVICE_RELATIONS   IRP_MN_CANCEL_STOP_DEVICE   IRP_MN_QUERY_STOP_DEVICE    IRP_MN_STOP_DEVICE  IRP_MN_CANCEL_REMOVE_DEVICE IRP_MN_REMOVE_DEVICE -  IRP_MN_QUERY_REMOVE_DEVICE  IRP_MN_START_DEVICE     A driver has passed an invalid device object to a function that requires a PDO (DevObj = %DevObj).      A driver has returned STATUS_PENDING but did not mark the IRP pending via a call to IoMarkIrpPending (Irp = %Snapshot). A driver has succeeded IRP_MJ_PNP.IRP_MN_QUERY_DEVICE_RELATIONS(TargetRelations) but didn't properly fill out the request or forward the IRP to the underlying hardware stack (DevObj = %DevObj).       A driver has mistakenly called a file I/O function at an IRQL other than PASSIVE_LEVEL. A driver has enumerated two child PDO's that returned identical Device ID's (DevObj1 = %DevObj1 , DevObj2 = %DevObj2 ). A driver has added a device object that is not a PDO to a device relations query (Irp = %Irp, DevObj = %DevObj).        A driver has failed an IRP that cannot legally be failed IRP (Irp = %Irp).      A driver has failed to copy the DeviceType field from the device object it is attaching to (DevObj = %DevObj).  A driver has set both the DO_BUFFERED_IO and the DO_DIRECT_IO flags. These flags are mutually exclusive (DevObj = %DevObj).     A driver has not copied either the DO_BUFFERED_IO or the DO_DIRECT_IO flag from the device object it is attaching to (DevObj = %DevObj).        A driver has failed to clear the DO_DEVICE_INITIALIZING flag at the end of AddDevice (DevObj = %DevObj).        A driver has deleted it's device object during a surprise remove IRP (Irp = %Irp  DevObj = %DevObj).    A driver has detached it's device object during a surprise remove IRP (Irp = %Irp  DevObj = %DevObj).   A driver is attempting to delete a device object that has already been deleted via a prior call to IoDeleteDevice.      A driver has not inherited the DO_POWER_PAGABLE bit from the stack it has attached to (DevObj = %DevObj).       A driver has marked an IRP pending but didn't return STATUS_PENDING. (Irp = %Snapshot). A driver has returned STATUS_PENDING but did not mark the IRP pending via a call to IoMarkIrpPending (Irp = %Irp).      A driver has completed an IRP without setting the CancelRoutine in the Irp to NULL (Irp = %Irp ).       A driver has forwarded an IRP at an IRQL that is illegal for this major code. (Irp = %Irp ).    The caller of IoCompleteRequest is completing an IRP that has never been forwarded via a call to IoCallDriver or PoCallDriver. This may be a bug. (Irp = %Irp ).        Caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal, unneccessary, and negatively impacts performace in normal use. Check the documentation for IoReuseIrp if this IRP is being recycled.        A driver has sent an IRP that is restricted for system use only. (Irp = %Irp ). The UI Number field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (Irp = %Irp ).  The address field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (Irp = %Irp ).    The size field of the query capabilities structure in a query capabilities IRP was not properly initialized. (Irp = %Irp ).     The version field of the query capabilities structure in a query capabilities IRP was not properly initialized. (Irp = %Irp ).  Caller has completed untouched IRP_MJ_POWER (instead of passing the irp down) or non-PDO has failed the irp using illegal value of STATUS_NOT_SUPPORTED. (Irp = %Irp ). Caller has completed successful IRP_MJ_POWER instead of passing it down (Irp = %Irp ).  Caller has completed a IRP_MJ_POWER it didn't understand instead of passing it down (Irp = %Irp ).      Caller has completed untouched IRP_MJ_PNP (instead of passing the irp down) or non-PDO has failed the irp using illegal value of STATUS_NOT_SUPPORTED. (Irp = %Irp ).   Caller has completed successful IRP_MJ_PNP instead of passing it down (Irp = %Irp ).    Caller has completed a IRP_MJ_PNP it didn't understand instead of passing it down (Irp = %Irp ).        The code implementing the TargetDeviceRelation query has not called ObReferenceObject on the PDO (Irp = %Irp ). PDO has forgotten to fill out the device relation list with the PDO for the TargetDeviceRelation query (Irp = %Irp )    PDO has not responded to a required IRP (Irp = %Irp )   A cancel routine has been set for an IRP that is currently being processed by drivers lower in the stack, possibly stomping their cancel routine (Irp = %Irp, Routine=%Routine ).       A driver's completion routine ( %Routine ) has not marked the IRP pending if the PendingReturned field was set in the IRP passed to it. This may cause the OS to hang, especially if an error is returned by the  stack. (Irp = %Irp )  IRP completion routines must be in nonpagable code, and this one is not: %Routine. (Irp = %Irp )        An IRP dispatch handler has returned without passing down or completing this Irp or someone forgot to return STATUS_PENDING. (Irp = %Snapshot ).        An IRP dispatch handler has returned a status that is illegal (0xFFFFFFFF). This is probably due to an uninitialized stack variable. Please do an ln on address %lx and file a bug. (Irp = %Snapshot )  An IRP dispatch handler ( %Routine ) has returned a status that is inconsistent with the Irp's IoStatus.Status field. ( Irp = %Snapshot - Irp->IoStatus.Status = %Status1 - returned = %Status2 )       An IRP dispatch handler for a bus filter has deleted it's device object, but the PDO is still present! Bus filters must clean up in FastIoDetach callbacks. DeviceObject = %DevObj - Dispatch = %Routine - Irp = %Snapshot      A Bus Filter's IRP dispatch handler has detached upon receiving a remove IRP when the PDO is still alive. Bus Filters must clean up in FastIoDetach callbacks. DeviceObject = %DevObj - Dispatch = %Routine - Irp = %Snapshot   An IRP dispatch handler for a PDO has deleted it's device object, but the hardware has not been reported as missing in a bus relations query. DeviceObject = %DevObj - Dispatch = %Routine - Irp = %Snapshot    IRP_MJ_SYSTEM_CONTROL has been completed by someone other than the ProviderId. This IRP should either have been completed earlier or should have been passed down (Irp = %Irp ). The IRP was targetted at DeviceObject %DevObj  This driver has not filled out a dispatch routine for a required IRP major function (Irp = %Irp ).      An IRP dispatch handler has not properly deleted it's device object upon receiving a remove IRP. DeviceObject = %DevObj - Dispatch = %Routine - Irp = %Snapshot An IRP dispatch handler has not properly detached from the stack below it upon receiving a remove IRP. DeviceObject = %DevObj - Dispatch = %Routine - Irp = %Snapshot   Caller has copied the Irp stack but not set a completion routine. This is inefficient, use IoSkipCurrentIrpStackLocation instead (Irp = %Irp ). Driver has returned a suspicious status. This is probably due to an uninitiaized variable bug in the driver. (Irp = %Irp )      Previously set IRP_MJ_POWER status has been converted to STATUS_NOT_SUPPORTED. This failure status is reserved for use of the OS - drivers cannot fail a Power IRP with this value (Irp = %Irp ).       Non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_POWER is being passed down stack (Irp = %Irp ). Failed POWER IRPs must be completed.      The driver has responded to an IRP that is that is reserved for other device objects elsewhere in the stack. (Irp = %Irp )      The driver has not handled a required IRP. The driver must update the status of the IRP to indicate whether it's been handled or not. (Irp = %Irp ).    Previously set IRP_MJ_PNP status has been converted to STATUS_NOT_SUPPORTED. This failure status is reserved for use of the OS - drivers cannot fail a PnP IRP with this value. (Irp = %Irp ).  Non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_PNP is being passed down stack (Irp = %Irp ). Failed PNP IRPs must be completed.  Caller has changed the information field of an IRP it does not understand (Irp = %Irp ).        Caller has changed the status field of an IRP it does not understand (Irp = %Irp ).     Caller has trashed or has not properly copied IRP's stack (Irp = %Irp ).        Caller has forwarded an Irp while skipping a device object in the stack. The caller is probably sending IRPs to the PDO instead of to the device returned by IoAttachDeviceToDeviceStack (Irp = %Irp ). Any WMI IRP must have status initialized to STATUS_NOT_SUPPORTED (Irp = %Irp ). Any Power IRP must have status initialized to STATUS_NOT_SUPPORTED (Irp = %Irp ).       Any PNP IRP must have status initialized to STATUS_NOT_SUPPORTED (Irp = %Irp ). Caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal and unneccessary, and has caused a quota leak. Check the documentation for IoReuseIrp if this IRP is being recycled. Caller of IoFreeIrp is freeing an IRP that is still enqueued against a thread! (Irp = %Irp )    Caller of IoFreeIrp is freeing an IRP that is still in use! (Irp = %Irp )       Caller of IoFreeIrp is freeing an IRP that is still in use! (Original Irp = %Irp1, Irp in usage is %Irp2 )      Caller is completing an IRP that is currently queued beneath it! The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (Irp = %Irp )     This IRP is about to run out of stack locations. Someone may have forwarded this IRP from another stack (Irp = %Irp ).  Caller has manually copied the stack and has inadvertantly copied the upper layer's completion routine. Please use IoCopyCurrentIrpStackLocationToNext. (Irp = %Irp ).  Caller has incorrectly forwarded an IRP (control field not zerod). The driver should use IoCopyCurrentIrpStackLocationToNext or IoSkipCurrentIrpStackLocation. (Irp = %Irp )    Caller is forwarding an IRP that is currently queued beneath it! The code handling IRPs returning STATUS_PENDING in this driver appears to be broken (Irp = %Irp ).     Caller has passed in NULL as a DeviceObject. This is fatal (Irp = %Irp ).       A driver has called IoCallDriver without setting the CancelRoutine in the Irp to NULL (Irp = %Irp ).    Driver has attempted to detach from device object %DevObj, which is not attached to anything. This may occur if detach was called twice on the same device object.      A device is deleting itself while there is another device beneath it in the driver stack. This may be because the caller has forgotten to call IoDetachDevice first, or the lower driver may have incorrectly deleted itself.

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法