title: WinDBG: How to get the underlying FILE_OBJECT from a WDFFILEOBJECT handle?
body: <p>I'm having a WDFFILEOBJECT handle(0x0000057fedd9b8b8), and I want to know its underlying FILE_OBJECT address, so that I can use <code>!object xxxx</code> to query the FILE_OBJECT's <code>.PointerCount</code> and <code>.HandleCount</code>. What windbg command can I use?</p>
  
  <p><code>!wdfkd.wdfhandle 0x0000057fedd9b8b8 f0</code> does not seems to provide that information.</p>
  
  <p><a href="https://i.stack.imgur.com/9vXvX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9vXvX.png" alt="enter image description here"></a></p>
  
  <p>Were it a WDFDEVICE handle, I know <code>!wdfkd.wdfdevice</code> can tell me the underlying DEVICE_OBJECT, but what about WDFFILEOBJECT?</p>
  
  <h2>====== SOLVED (many days later) =====</h2>
  
  <p>According to snoone's hint, I figured it out. Live information below:</p>
  
  <p>This time, FileObject=<strong>0x0000057fede811b8</strong> .</p>
  
  <p><a href="https://i.stack.imgur.com/NAQhe.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NAQhe.png" alt="enter image description here"></a></p>
  
  <p>I have to use <code>!wdfkd.handle 0x0000057fede811b8 f0</code> first, because the handle value 0x0000057fede811b8 is not a valid kernel address, <code>!wdfkd.handle</code> tells the real kernel address for the KMDF FxObject behind the handle.</p>