Calling KeGetCurrentThread() in DriverEntry() and inputing _KTHREAD Address in WinDbg gives (null) value for WaitPrcb member variable - windbg

OK so I have a kernel mode WDF device driver and in DriverEntry I've got two lines of code (see at the bottom). I then take the address displayed in DebugView by the DbgPrintEx statement then enter this command at the WinDbg command line as follows:
dt _KTHREAD 0xFFFFA80000050000
Gives the following output and at the bottom of this output shows WaitPrcb equal to (null):
lkd> dt _KTHREAD 00007ff69a380000
ntdll!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x018 SListFaultAddress : 0x00000000`00000040 Void
+0x020 QuantumTarget : 0
+0x028 InitialStack : (null)
+0x030 StackLimit : (null)
+0x038 StackBase : 0x00000180`00000000 Void
+0x040 ThreadLock : 0xcd09b400`0eba1f0e
+0x048 CycleTime : 0x685421cd`4c01b821
+0x050 CurrentRunTime : 0x70207369
+0x054 ExpectedRunTime : 0x72676f72
+0x058 KernelStack : 0x6f6e6e61`63206d61 Void
+0x060 StateSaveArea : 0x6e757220`65622074 _XSAVE_FORMAT
+0x068 SchedulingGroup : 0x20534f44`206e6920 _KSCHEDULING_GROUP
+0x070 WaitRegister : _KWAIT_STATUS_REGISTER
+0x071 Running : 0x6f 'o'
+0x072 Alerted : [2] "de"
+0x074 SpareMiscFlag0 : 0y0
+0x074 ReadyTransition : 0y1
+0x074 ProcessReadyQueue : 0y1
+0x074 WaitNext : 0y1
+0x074 SystemAffinityActive : 0y0
+0x074 Alertable : 0y1
+0x074 UserStackWalkActive : 0y0
+0x074 ApcInterruptRequest : 0y0
+0x074 QuantumEndMigrate : 0y1
+0x074 UmsDirectedSwitchEnable : 0y0
+0x074 TimerActive : 0y1
+0x074 SystemThread : 0y1
+0x074 ProcessDetachActive : 0y0
+0x074 CalloutActive : 0y0
+0x074 ScbReadyQueue : 0y0
+0x074 ApcQueueable : 0y0
+0x074 ReservedStackInUse : 0y1
+0x074 UmsPerformingSyscall : 0y0
+0x074 ApcPendingReload : 0y1
+0x074 TimerSuspended : 0y1
+0x074 SuspendedWaitMode : 0y0
+0x074 Reserved : 0y00001010000 (0x50)
+0x074 MiscFlags : 0n168627502
+0x078 AutoAlignment : 0y0
+0x078 DisableBoost : 0y0
+0x078 UserAffinitySet : 0y1
[...]
+0x2c8 WaitPrcb : (null)
The following two lines of code are taken from DriverEntry. The question comes down to is what am I doing wrong and why is WaitPrcb (null) ?
1. _KTHREAD* pKthread = KeGetCurrentThread();
2. DbgPrintEx(DPFLTR_SYSTEM_ID, DPFLTR_ERROR_LEVEL, "[ProcessSwitch...] pKTHREAD = %p\n", pKthread);

This answer is just to address the comment by thomas and clarify what Josh Poley commented
Seeing a bunch of characters in ASCII printable range is a strong indicator that some thing is not Right
see below what is sitting in the dumped data
it is a QWORD and characters should be arranged considering Endianess but it is still a visible String
+0x048 CycleTime : 0x685421cd`4c01b821
+0x050 CurrentRunTime : 0x70207369
+0x054 ExpectedRunTime : 0x72676f72
+0x058 KernelStack : 0x6f6e6e61`63206d61 Void
+0x060 StateSaveArea : 0x6e757220`65622074 _XSAVE_FORMAT
+0x068 SchedulingGroup : 0x20534f44`206e6920 _KSCHEDULING_GROUP

Related

Mongo greater than comparison returns 0

I am trying to count all car dealers who's total fleet units is over 1000. This is the code I wrote to do it, however, it returns 0 and I know for a fact there are quite a few records in this data set that are over 1000.
db.Car_Dealership.find({Totalfleetunits : {$gte: 1000} }).count()
This is a sample of what's in my database, both records have total fleets over 1000. Any ideas why it returns 0?
"_id" : ObjectId("5a203ab0b9574375830354d4"),
"2016rank" : 6,
"Dealershipgroupname" : "Hendrick Automotive Group",
"Address" : "6000 Monroe Road",
"City/State/Zip" : "Charlotte, NC 28212",
"Phone" : "(704) 568-5550",
"Companywebsite" : "www.hendrickauto.com",
"Topexecutive" : "Rick Hendrick",
"Topexecutivetitle" : "chairman",
"Totalnewretailunits" : "117,946",
"Totalusedunits" : "88,458",
"Totalfleetunits" : "4,646",
"Totalwholesaleunits" : "56,569",
"Total_units" : "267,619",
"Total_number_of _dealerships" : 103,
"Grouprevenuealldepartments*" : "$8,551,253,132",
"2015rank" : 6
}
{
"_id" : ObjectId("5a203ab0b9574375830354d5"),
"2016rank" : 5,
"Dealershipgroupname" : "Sonic Automotive Inc.?",
"Address" : "4401 Colwick Road",
"City/State/Zip" : "Charlotte, NC 28211",
"Phone" : "(704) 566-2400",
"Companywebsite" : "www.sonicautomotive.com",
"Topexecutive" : "B. Scott Smith",
"Topexecutivetitle" : "CEO",
"Totalnewretailunits" : "134,288",
"Totalusedunits" : "119,174",
"Totalfleetunits" : "1,715",
"Totalwholesaleunits" : "35,098",
"Total_units" : "290,275",
"Total_number_of _dealerships" : 112,
"Grouprevenuealldepartments*" : "$9,731,778,000",
"2015rank" : 4
That happens because the value of Totalfleetunits is stringType.
Now to solve your problem you have to options.
option 1:
You can change your schema for Totalfleetunits to the type of Number and change all the documents Totalfleetvalues value from string to a number. Like,
"Totalfleetunits": "4,646" needs to be changed with "Totalfleetunits"
: "4646"
option 2:
You can use javascript in your query to first remove , from your value then check the Totalfleetunits value for greater than or equal to ( >= ). Only need to change a single line of code as I given below.
db.Car_Dealership.find("this.Totalfleetunits.replace(',','') >= 1000").count()

How to find something from an array in mongo

{
"_id" : ObjectId("586aac4c8231ee0b98458045"),
"store_code" : NumberInt(10800),
"counter_name" : "R.N.Electric",
"address" : "314 khatipura road",
"locality" : "Khatipura Road (Jhotwara)",
"pincode" : NumberInt(302012),
"town" : "JAIPUR",
"gtm_city" : "JAIPUR",
"sales_office" : "URAJ",
"owner_name" : "Rajeev",
"owner_mobile" : "9828024073",
"division_mapping" : [//this contains only 1 element in every doc
{
"dvcode" : "cfc",
"dc" : "trade",
"beatcode" : "govindpura",
"fos" : {
"_id" : ObjectId("586ab8318231ee0b98458843"),
"loginid" : "9928483483",
"name" : "Arpit Gupta",
"division" : [
"cfc",
"iron"
],
"sales_office" : "URAJ", //office
"gtm_city" : "JAIPUR" //city
},
"beat" : {
"_id" : ObjectId("586d372b39f64316b9c3cbd7"),
"division" : {
"_id" : ObjectId("5869f8b639f6430fe4edee2a"),
"clientdvcode" : NumberInt(40),
"code" : "cfc",
"name" : "Cooking & Fabric Care",
"project_code" : "usha-fos",
"client_code" : "usha",
"agent_code" : "v5global"
},
"beatcode" : "govindpura",
"sales_office" : "URAJ",
"gtm_city" : "JAIPUR",
"active" : true,
"agency_code" : "v5global",
"client_code" : "USHA_FOS",
"proj_code" : "usha-fos",
"fos" : {
"_id" : ObjectId("586ab8318231ee0b98458843"),
"loginid" : "9928483483",
"name" : "Arpit Gupta",
"division" : [
"cfc",
"iron"
],
"sales_office" : "URAJ",
"gtm_city" : "JAIPUR"
}
}
}
],
"distributor_mail" : "sunil.todi#yahoo.in",
"project_code" : "usha-fos",
"client_code" : "usha",
"agent_code" : "v5global",
"distributor_name" : "Sundeep Electrical"
}
I am having only 1 element in division_mapping's array and I want to find those documents whose dc in division_mapping is trade.
I have tried following:
"division_mapping":{$elemMatch:{$eq:{"dc":"trade"}}}})
Dont know what I am doing wrong.
//Maybe I have to unwind the array but is there any other way?
According to MongoDB documentation
The $elemMatch operator matches documents that contain an array
field with at least one element that matches all the specified query
criteria.
According to above mentioned description to retrieve only documents whose dc in division_mapping is trade please try executing below mentioned query
db.collection.find({division_mapping:{$elemMatch:{dc:'trade'}}})

Mongoid query embedded document and return parent

I have this document, each is a tool:
{
"_id" : ObjectId("54da43aea96ddcc40915a457"),
"checked_in" : false,
"barcode" : "PXJ-234234",
"calibrations" : [
{
"_id" : ObjectId("54da46ec546173129d810100"),
"cal_date" : null,
"cal_date_due" : ISODate("2014-08-06T00:00:00.000+0000"),
"time_in" : ISODate("2015-02-10T17:46:20.250+0000"),
"time_out" : ISODate("2015-02-10T17:46:20.250+0000"),
"updated_at" : ISODate("2015-02-10T17:59:08.796+0000"),
"created_at" : ISODate("2015-02-10T17:59:08.796+0000")
},
{
"_id" : ObjectId("5509e815686d610b70010000"),
"cal_date_due" : ISODate("2015-03-18T21:03:17.959+0000"),
"time_in" : ISODate("2015-03-18T21:03:17.959+0000"),
"time_out" : ISODate("2015-03-18T21:03:17.959+0000"),
"cal_date" : ISODate("2015-03-18T21:03:17.959+0000"),
"updated_at" : ISODate("2015-03-18T21:03:17.961+0000"),
"created_at" : ISODate("2015-03-18T21:03:17.961+0000")
},
{
"_id" : ObjectId("5509e837686d610b70020000"),
"cal_date_due" : ISODate("2015-03-18T21:03:51.189+0000"),
"time_in" : ISODate("2015-03-18T21:03:51.189+0000"),
"time_out" : ISODate("2015-03-18T21:03:51.189+0000"),
"cal_date" : ISODate("2015-03-18T21:03:51.189+0000"),
"updated_at" : ISODate("2015-03-18T21:03:51.191+0000"),
"created_at" : ISODate("2015-03-18T21:03:51.191+0000")
}
],
"group" : "Engine",
"location" : "Here or there",
"model" : "ZX101C",
"serial" : NumberInt(15449),
"tool" : "octane analyzer",
"updated_at" : ISODate("2015-09-30T20:43:55.652+0000"),
"description" : "Description...",
}
Tools are calibrated periodically. What I want to do is grab tools that are due this month.
Currently, my query is this:
scope :upcoming, -> { where(:at_ats => false).where('calibrations.0.cal_date_due' => {'$gte' => Time.now-1.day, '$lte' => Time.now+30.days}).order_by(:'calibrations.cal_date_due'.asc) }
However, this query gets the tool by the first calibration object and it needs to be the last. I've tried a myriad of things, but I'm stuck here.
How can I make sure I'm querying the most recent calibration document, not the first (which would be the oldest and therefore not relevant)?
You should look into aggregation framework and $unwind operator.
This link may be of help.
This link may be helpful. It contains an example of use of 'aggregation framework' for get the last element of the array, that is, the most recent in your case.

How to loop and insert data into different tables from JSON

I have a JSON and I need to write the values into different tables. I could get the data from json, but I need to insert the data accordingly. It's like I have a form, the form has n number of sections, each section have n number of steps and each step can have n number of questions. How I can loop this and write into different tables? Basically I need to know how we can find how many sections, steps and questions we have in the JSON. I tried array_length, but not working.
Here is a small sample of my JSON.
{ "functionId" : "2","subFunctionId" : "6","groupId" : "11","formId" : "","formName":"BladeInseption","submittedBy" : "200021669","createdDate" : "2015-08-06",
"updatedBy" : "","updatedDate" : "","comments" : "","formStatusId" :"11","formStatus" :"Draft","formLanguage" : "English","isFormConfigured" : "N","formChange":"Yes",
"sectionLevelChange":"Yes","isActive" : "Y","formVersionNo" : "1.0","formFooterDetails" : "","formHeaderDetails" : "","images" : [
{"imageId" : "","imageTempId" : "","imageTempUrl" : "","imageName" : "","imageUrl" : "","isDeleted" : "","imagesDesc" : ""} ],
"imagesDescLevel" : "","sectionElements" : [{"sectionElement":[{"sectionId" : "","sectionTempId":"sectionId+DDMMHHSSSS","sectionName":"section1",
"sectionChange":"Yes","stepLevelChange":"Yes","sectionLabel" : "","sectionOrder" : "1","outOfScopeSection" : "false",
"punchListSection" : "false","images" : [{"imageId" : "","imageTempId" : "","imageTempUrl" : "","imageName" : "","imageUrl" : "","isDeleted" : "",
"imagesDesc" : ""}],"imagesDescLevel" : "","isDeleted" : "","stepElements" : [{"stepElement":[{"stepId" : "","stepTempId":"stepId+DDMMHHSSSS",
"stepName":"section1step1","stepLabel" : "","stepOrder" : "1","stepChange":"Yes","questionLevelChange":"Yes","images" : [{"imageId" : "",
"imageTempId" : "","imageTempUrl" : "","imageName" : "","imageUrl" : "","isDeleted" : "","imagesDesc" : ""}],"imagesDescLevel" : "","isDeleted" : "",
"questionAnswerElements" : [{"questionAnswerElement":[{"questionId" : "","questionClientUid" : "","questionDescription" : "step1question1",
"questionAccessibility" : "","isPunchListQuestion" : "","questionChange":"Yes","questionOrder" : "1","isDeleted" : "","images" : [{
"imageId" : "","imageTempId" : "","imageTempUrl" : "","imageName" : "","imageUrl" : "","isDeleted" : "","imagesDesc" : ""}],"imagesDescLevel" : "",
"answerId" : "","answerClientUid" : "","elements" :[{"element" :[{"elementId": "2","elementMapId" : "12","clientUid" : "","clientClass" : "","imageTempId" : "",
"imageTempUrl" : "","elementType":"Question","elementOrder" : "1","elementArributuesProp": [{"attributeId" : "1","attributeName" : "","defaultValue" : ""}],
"elementArributuesVal":[{"value1" : "item1"}],"rule" : [{"ruleId" : "1","ruleName" : "Mandatory","formula" : "i>a","formulaData" : "i>50","isDeleted" : "",
...
}
If you know all paths to JSON arrays in your code, can use some special functions appearing in 9.4 such as
SELECT json_array_length('{"array":[{"a":1},{"b":2},{"c":3}]}'::json->'array')
If you need to iterate through JSON array, there is another useful function:
SELECT json_array_elements('{"array":[{"a":1},{"b":2},{"c":3}]}'::json->'array')
SELECT json_array_elements('[{"a":1},{"b":2},{"c":3}]'::json)
or if json is stored in table, lets call
SELECT json_array_elements(tbl.json_value->'array') FROM jsontable AS tbl
It returns a set of json values unwrapped from array ready to processing.
http://www.postgresql.org/docs/9.4/static/functions-json.html
More information about JSON parsing can be found here
How do I query using fields inside the new PostgreSQL JSON datatype?

Getting USB Version through WMI Classes

I am trying to query the USB Device for the USB Descriptor which will store information regarding the USB Version, Device ID, PID, VID etc. I only need the USB Version.
Here is the PowerShell Code so far:
[System.Reflection.Assembly]::Load("System.Management, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")
$Man = New-Object System.Management.ManagementClass("Win32_USBHub")
[System.Management.ManagementObjectCollection]$Devs = $Man.GetInstances()
echo $Devs
The output I am getting is:
__GENUS : 2
__CLASS : Win32_USBHub
__SUPERCLASS : CIM_USBHub
__DYNASTY : CIM_ManagedSystemElement
__RELPATH : Win32_USBHub.DeviceID="USB\\VID_0781&PID_5567\\4C530000120619102080"
__PROPERTY_COUNT : 28
__DERIVATION : {CIM_USBHub, CIM_USBDevice, CIM_LogicalDevice, CIM_LogicalElement...}
__SERVER : APPS-SD-AUTO-PC
__NAMESPACE : root\cimv2
__PATH : \\APPS-SD-AUTO- PC\root\cimv2:Win32_USBHub.DeviceID="USB\\VID_0781&PID_5567\\4C530000120619102080"
Availability :
Caption : USB Mass Storage Device
ClassCode :
ConfigManagerErrorCode : 0
ConfigManagerUserConfig : False
CreationClassName : Win32_USBHub
CurrentAlternateSettings :
CurrentConfigValue :
Description : USB Mass Storage Device
DeviceID : USB\VID_0781&PID_5567\4C530000120619102080
ErrorCleared :
ErrorDescription :
GangSwitched :
InstallDate :
LastErrorCode :
Name : USB Mass Storage Device
NumberOfConfigs :
NumberOfPorts :
PNPDeviceID : USB\VID_0781&PID_5567\4C530000120619102080
PowerManagementCapabilities :
PowerManagementSupported :
ProtocolCode :
Status : OK
StatusInfo :
SubclassCode :
SystemCreationClassName : Win32_ComputerSystem
SystemName : APPS-SD-AUTO-PC
USBVersion :
Here USBVersion is coming as an empty field. Can anyone suggest a solution?
I have tried with Win32_usbDeviceController but that is also returning an empty field.