[Autogenerated] We can view, the inter app dispatch table.
In the local current debugging session, for example,
by using the ID T command, if its the ID T command,
we can see a list of all the entries which have some meaningful
values inside the inter app app dispatch table.
Sometimes you won't see all the symbols here.
And If this is the case you might need to do a re
load and then call the ID T command.
Again.
In this case,
I probably don't have to do that but let's just do that
to Make sure we get the best symbols.
We can possibly get from the Microsoft symbol server as it relates to
inter up service routines because many of them have been created by
Microsoft So let's take a closer look at this list.
The first part of the list, in fact, has information about exceptions,
not really about interrupts this is one way where exceptions.
And interrupt, are managed in a similar fashion, their dispatch routine.
So to speak, are handled, and stored, in the same interrupt dispatch table,
the first ones, that you see here,
that don't have that K interrupt thing attached,
to them represent actually exceptions rather than two hardware interrupts.
For example, you can see something like exception zero here or index zero points.
To K I divide error fault.
This is a function within the kernel that handles division by zero errors.
So this index zero, is actually coming from internet documentation,
internet internet ad which means that The C P U raises
always an exception of value zero if it encounters a case
where it needs to divide by zero.
So this is something Microsoft has to abide by and They have to fill in
this entry with something that would call a function.
That would handle that kind of case.
Other similar exceptions exist here as well.
Such as for example, the breakpoint exception, that many of you.
Are probably familiar with this is that in three instruction,
that is typically placed by debuggers, to to have a breakpoint,
present, and this is In fact, the breakpoint handler,
that the kernel has this is Also, um technically an exception,
even though it might be triggered by a software interrupt.
So the differences, are really, a little bit kind of the differences.
Are somewhat artificial.
Here's another example, what happens if we access memory,
which happens to be paged out this is where we get that exception
with the value 14 which is the page fault handler,
the kernel is providing the C P will always raise an exception with
the value 14 because that's the way it behaves.
It's up to the kernel to provide the appropriate handler to handle,
that kind of page fault, in the correct way.
So you can see some how to interrupt, and With each how to interact.
We have these data structure called kin interrupt which is an
internal data structure used by the kernel to manage,
and store,
information related to a particular interrupt this data structure in general.
Is undocumented, and That's because it is very platform specific.
However, given that we are running on a particular system.
And we have access to symbols, we can definitely use that number here.
And just click it.
This will simply run the normal D T command.
To provide the internals of the inter up data structure as it is used on X,
64 system which is the system I'm running right here.
Many of these members, are documented,
in the Windows driver kit because they do make sense.
And need to be used in some in some ways within certain channel drivers,
that handle certain hardware devices.
So here, is for example, the actual routine behind the scenes.
And there's also information about the vector itself, that's the vector.
But we we knew that already perhaps then We have the I R Q L,
the R Q L S we will discuss in the Next video represents on the one hand,
the priority of that interrupt.
So this is a priority uh 12.
12.
particular case, there's some other details.
That You might find interesting if you look things up
in in the Microsoft documentation, the Windows driver kit.
So this is the ID T this is the inter up dispatch table,
this is where we can see which kind of interrupt,
is being handled by which kind of function?