Skip to content

Instantly share code, notes, and snippets.

@tijme

tijme/DriverObject->MajorFunction.txt

Created January 8, 2023 10:55
Show Gist options
  • Save tijme/1654c1aefcbe78b594fa75da1bec58ed to your computer and use it in GitHub Desktop.
Save tijme/1654c1aefcbe78b594fa75da1bec58ed to your computer and use it in GitHub Desktop.
Download ZIP
DriverObject MajorFunction offsets
Raw
DriverObject->MajorFunction.txt
Name Array index from 0x0 Func index from 0x0 Array index from 0x70 Func index from 0x70
------------------------------- ---------------------- --------------------- ----------------------- ----------------------
IRP_MJ_CREATE 0x0, 0 0x0, 0 0x70, 112 0x70, 112
IRP_MJ_CREATE_NAMED_PIPE 0x1, 1 0x8, 8 0x71, 113 0x78, 120
IRP_MJ_CLOSE 0x2, 2 0x10, 16 0x72, 114 0x80, 128
IRP_MJ_READ 0x3, 3 0x18, 24 0x73, 115 0x88, 136
IRP_MJ_WRITE 0x4, 4 0x20, 32 0x74, 116 0x90, 144
IRP_MJ_QUERY_INFORMATION 0x5, 5 0x28, 40 0x75, 117 0x98, 152
IRP_MJ_SET_INFORMATION 0x6, 6 0x30, 48 0x76, 118 0xa0, 160
IRP_MJ_QUERY_EA 0x7, 7 0x38, 56 0x77, 119 0xa8, 168
IRP_MJ_SET_EA 0x8, 8 0x40, 64 0x78, 120 0xb0, 176
IRP_MJ_FLUSH_BUFFERS 0x9, 9 0x48, 72 0x79, 121 0xb8, 184
IRP_MJ_QUERY_VOLUME_INFORMATION 0xa, 10 0x50, 80 0x7a, 122 0xc0, 192
IRP_MJ_SET_VOLUME_INFORMATION 0xb, 11 0x58, 88 0x7b, 123 0xc8, 200
IRP_MJ_DIRECTORY_CONTROL 0xc, 12 0x60, 96 0x7c, 124 0xd0, 208
IRP_MJ_FILE_SYSTEM_CONTROL 0xd, 13 0x68, 104 0x7d, 125 0xd8, 216
IRP_MJ_DEVICE_CONTROL 0xe, 14 0x70, 112 0x7e, 126 0xe0, 224
IRP_MJ_INTERNAL_DEVICE_CONTROL 0xf, 15 0x78, 120 0x7f, 127 0xe8, 232
IRP_MJ_SHUTDOWN 0x10, 16 0x80, 128 0x80, 128 0xf0, 240
IRP_MJ_LOCK_CONTROL 0x11, 17 0x88, 136 0x81, 129 0xf8, 248
IRP_MJ_CLEANUP 0x12, 18 0x90, 144 0x82, 130 0x100, 256
IRP_MJ_CREATE_MAILSLOT 0x13, 19 0x98, 152 0x83, 131 0x108, 264
IRP_MJ_QUERY_SECURITY 0x14, 20 0xa0, 160 0x84, 132 0x110, 272
IRP_MJ_SET_SECURITY 0x15, 21 0xa8, 168 0x85, 133 0x118, 280
IRP_MJ_POWER 0x16, 22 0xb0, 176 0x86, 134 0x120, 288
IRP_MJ_SYSTEM_CONTROL 0x17, 23 0xb8, 184 0x87, 135 0x128, 296
IRP_MJ_DEVICE_CHANGE 0x18, 24 0xc0, 192 0x88, 136 0x130, 304
IRP_MJ_QUERY_QUOTA 0x19, 25 0xc8, 200 0x89, 137 0x138, 312
IRP_MJ_SET_QUOTA 0x1a, 26 0xd0, 208 0x8a, 138 0x140, 320
IRP_MJ_PNP 0x1b, 27 0xd8, 216 0x8b, 139 0x148, 328
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment