DBGKD_GET_VERSION64 - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
// wdbgexts.h

typedef struct _DBGKD_GET_VERSION64 {
  USHORT  MajorVersion;
  USHORT  MinorVersion;
  UCHAR   ProtocolVersion;
  UCHAR   KdSecondaryVersion;
  USHORT  Flags;
  USHORT  MachineType;
  UCHAR   MaxPacketType;
  UCHAR   MaxStateChange;
  UCHAR   MaxManipulate;
  UCHAR   Simulation;
  USHORT  Unused[1];
  ULONG64 KernBase;
  ULONG64 PsLoadedModuleList;
  ULONG64 DebuggerDataList;
} DBGKD_GET_VERSION64, *PDBGKD_GET_VERSION64;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-wdbgexts-_dbgkd_get_version64)

_DBGKD_GET_VERSION64 structure

Description

The IG_GET_KERNEL_VERSION Ioctl operation receives information related to the operating system version of the target. When calling Ioctl with IoctlType set to IG_GET_KERNEL_VERSION, IpvData should contain an instance of the DBGKD_GET_VERSION64 structure.

Members

MajorVersion

Receives 0xF if the target's operating system is a free build, and 0xC if it is a checked build.

MinorVersion

Receives the build number for the target's operating system.

ProtocolVersion

Receives the version of the debugger protocol that is used to communicate between the debugger and the target.

KdSecondaryVersion

Receives a secondary version number that is used to distinguish among older, deprecated contexts.

Flags

Receives a set of bit flags for the current debugging session. The following flags can be present.

Flag Meaning when set
DBGKD_VERS_FLAG_MP The target kernel was compiled with support for multiple processors.
DBGKD_VERS_FLAG_DATA The list DebuggerDataList is valid.
DBGKD_VERS_FLAG_PTR64 The target uses 64-bit pointers.
DBGKD_VERS_FLAG_NOMM The debugger's memory cache is active. If this is not set, the debugger will convert all virtual addresses into physical address before accessing the target's memory.
DBGKD_VERS_FLAG_HSS The target supports hardware stepping.
DBGKD_VERS_FLAG_PARTITIONS Multiple operating system partitions exist.

MachineType

Receives the type of the target's processor. Possible processor types are listed in the following table.

Value Processor
IMAGE_FILE_MACHINE_I386 x86 architecture
IMAGE_FILE_MACHINE_ARM ARM architecture
IMAGE_FILE_MACHINE_IA64 Intel Itanium architecture
IMAGE_FILE_MACHINE_AMD64 x64 architecture
IMAGE_FILE_MACHINE_EBC EFI byte code architecture

MaxPacketType

Receives one plus the highest number for a debugger packet type recognized by the target.

MaxStateChange

Receives one plus the highest number for a state change generated by the target.

MaxManipulate

Receives one more that the highest number, recognized by the target, for a command to manipulate the target.

Simulation

Receives an indication if the target is in simulated execution. Possible values are listed in the following table.

Value Processor
DBGKD_SIMULATION_NONE No simulation is used.
DBGKD_SIMULATION_EXDI EXDI simulation is used.

Unused

Unused.

KernBase

Receives the base address of the kernel image.

PsLoadedModuleList

Receives the value of the kernel variable PsLoadedModuleList.

DebuggerDataList

Receives the value of the kernel variable KdDebuggerDataBlock. This a pointer to either a KDDEBUGGER_DATA64 structure or a KDDEBUGGER_DATA32 structure. Use the function GetDebuggerData to fetch this structure.

Remarks

The parameters for the IG_GET_KERNEL_VERSION Ioctl operation are the members of the DBGKD_GET_VERSION64 structure.

This operation is only available in kernel-mode debugging.

See also

GetDebuggerData

Ioctl

View the official Windows Driver Kit DDI reference

Edit description on GitHub