1. By Anand George SourceLens.org Copyright. All rights reserved. Content Owner - Meera R (meera at sourcelens.org)

2. LIST_ENTRY  Very commonly used in windows driver code and windows kernel.  Contains forward and backward link.  Normally comes in the middle of the structure.  Used for keeping Circular doubly linked list.  So in the code we may have to subtract the offset to go to the beginning of the record.  From WinNT.h typedef struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; SourceLens.org Copyright. All rights reserved. Content Owner - Meera R (meera at sourcelens.org)

3. CONTAINING_RECORD  Automate the subtraction of LIST_ENTRY record.  Used to access any specific field.  Looks complicated in the initial look but it a matter of getting used to.  From winNT.h  Incorrect by C standard as null pointer de reference but almost all complier generate correct code for this MSVC, gcc etc. And all most all OS kernel linux, windows, bsd has something similar to below. // // Calculate the address of the base of the structure given its type, and an // address of a field within the structure. // #define CONTAINING_RECORD(address, type, field) ((type *)( \ (PCHAR)(address) - \ (ULONG_PTR)(&((type *)0)->field))) SourceLens.org Copyright. All rights reserved. Content Owner - Meera R (meera at sourcelens.org)

4. Demo  A doubly linked list with LIST_ENTRY and accessing the elements with CONTAINING_RECORD.  Looking at the dt command of windbg to display the content from the memory to display processes running on a system.  Understanding LIST_ENTRY and containing record. SourceLens.org Copyright. All rights reserved. Content Owner - Meera R (meera at sourcelens.org)

5. Summary  LIST_ENTRY  CONTAIN RECORD  Importance. SourceLens.org Copyright. All rights reserved. Content Owner - Meera R (meera at sourcelens.org)

6. Thank you SourceLens.org Copyright. All rights reserved. Content Owner - Meera R (meera at sourcelens.org)