IOP_IRP_EXTENSION

The IOP_IRP_EXTENSION structure supports IRP extensions, which are new functionality for Windows 8. All known instances of the structure are pointed to from an IRP via the latter’s Tail.Overlay.IrpExtension member. Since the most readily available definitions of the IRP, e.g., in WDM.H, do not show anything named IrpExtension, it may be as well to note that this pointer is at offsets 0x68 and 0xC8 in the x86 and x64 builds, respectively.

All Windows versions that support IRP extensions allow that the IOP_IRP_EXTENSION may be in the same memory block as the IRP, after the I/O stack locations, or that it may be a separate allocation (from non-paged no-execute pool). Given that the kernel has highly efficient allocation of I/O Request Packets from per-processor lookaside lists, fitting the IRP extension into the packet in one memory block is clearly desirable.

Variability

As an internal structure, the IOP_IRP_EXTENSION must be expected to vary between versions, and it already has. The changing size gives a rough guide to the variability:

Layout

These sizes, and the offsets, types and names in the tables that follow, are from Microsoft’s symbol files for the kernel starting with Windows 8.1.

union {
    USHORT ExtensionFlags;
    struct {
        /*  bit fields, see below  */
    };
};

USHORT TypesAllocated;

UCHAR GenericExtension [4];

PVOID VerifierContext;

ULONG_PTR DiskIoAttributionHandle;

GUID ActivityId;

 LARGE_INTEGER Timestamp;

union {
    /*  changing members, see below  */
};

Note that in version 6.3 the Timestamp loses the 8-byte alignment that is natural for a LARGE_INTEGER. The purpose will have been to keep the IOP_IRP_EXTENSION no larger than the IO_STACK_LOCATION as a help when building the IRP, the I/O stack locations and the IRP extension as one memory block.

The IO_IRP_EXT_TRACK_OFFSET_HEADER structure is defined in NTIFS.H.

Extension Flags

USHORT Allocated : 1;

USHORT PropagateId : 1;

USHORT TimeStamped : 1;

USHORT Spare : 13;

USHORT SpareBits : 14;

The Allocated bit is set if the IOP_IRP_EXTENSION is separately allocated from its IRP.

Types

The TypesAllocated word at offset 0x02 is also bit fields. Each bit indicates that the extension has a corresponding type of content. Microsoft’s symbols for these are not known.

Note that types 1, 4, 5 and 7 cannot coexist since the corresponding content for these types are all in the union at the end of the extension.

Mutually Exclusive Content

LARGE_INTEGER Timestamp;

ULONG ZeroingOffset;

struct {
    IO_IRP_EXT_TRACK_OFFSET_HEADER *FsTrackOffsetBlob;
    LONGLONG FsTrackedOffset;
};

IO_ADAPTER_CRYPTO_PARAMETERS AdapterCryptoParameters;