Techwiki:Win32k/LDEVOBJ

Representation of a GDI driver.

typedef struct
{ //                               WXP
  UNICODE_STRING usDriverPath;  // 000
  PVOID pvImageBase;            // 008
  PVOID pMmLd;                  // 00C
  PVOID pfnDrvEnableDriver;     // 010
  DWORD unknown2;               // 014
  ULONG cjImageSize;            // 018
 // size                           01C
} LDEVINFO;

usDriverPath

Full path of the drivers dll. Example: '\SystemRoot\System32\ATMFD.DLL'

pvImageBase

Pointer to the beginning of the driver mapping.

pMmLd

Pointer to 'MmLd' Mm load module database. (section handle?)

pfnDrvEnableDriver

Pointer to the drivers entry point.

cjImageSize

Size of the DLL in bytes.

typedef struct _LDEV
{ //                                  W2k WXP
  struct _LDEVOBJ *pldevNext;       // 000 000
  struct _LDEVOBJ *pldevPrev;       // 004 004
  LDEVINFO         pInfo;           //     008
  ULONG            ldevtype;        // 008 00C
  ULONG            cRefs;           // 00C 010
  ULONG            unk_014;         // --- 014
  void *           pGdiDriverInfo;  // 014 018
  ULONG            ulDriverVersion; // 018 01C
  ULONG            unk_020;         //     020
  PFN              apfn[93];        //     024
  PFN              apfnOrig[93];    //     198
 // size                                   310
} LDEV, *PLDEV; 

pldevNext

Pointer to the next LDEV in the global list. NULL if this is the last LDEVOBJ.

pldevPrev

Pointer to the previous LDEV in the global list. NULL if this is the first LDEVOBJ.

pInfo

Pointer to an LDEVINFO structure, if the LDEV is associated with a dll file. NULL if the LDEV describes a driver located inside win32k.

ldevtype

Can be one of:

typedef enum
{
  LDEV_DEVICE_DISPLAY = 1,
  LDEV_DEVICE_PRINTER = 2,
  LDEV_DEVICE_META = 3,
  LDEV_DEVICE_MIRROR = 4,
  LDEV_IMAGE = 5,
  LDEV_FONT = 6
} LDEVTYPE;

apfn

Array of pointers to the according driver functions or win32k!WatchDogXxx interceptions.

apfnOrig

The original function pointer that were returned from the driver entry.

Remarks

All LDEVOBJs are kept in a global list. Both structures have the tag 'Gldv' Total size of LDEV is 0x310 Bytes