_DEVOBJ_EXTENSION structure information

use !devobj <address> command
it will tell you what AttachedDevice (upper ) and what AttachedTo device is (lower)

.foreach (place { .shell -ci "!object \\Device;" sed s/" ".." "//g | sed s/" .*"//g } ) { !grep -i -c "!devobj place" -e "Attached"} 

note:

!grep is from domdbg windbg extension sed is from gnuwin32 

output

AttachedTo (Lower) 86fb1630 \Driver\PnpManager AttachedTo (Lower) 86d22420 \Driver\aswTdi AttachedDevice (Upper) 862f59d8 \Driver\wdmaud AttachedDevice (Upper) 86e11130 \Driver\ROOTMODEM AttachedDevice (Upper) 86de7528 \Driver\Kbdclass AttachedTo (Lower) 86fac190 \Driver\PnpManager AttachedDevice (Upper) 86e02560 \Driver\Rasl2tp AttachedDevice (Upper) 862e9c90 \Driver\sysaudio AttachedTo (Lower) 86f5ece8 \Driver\ACPI AttachedTo (Lower) 86e15020 \Driver\i8042prt 

or parse the structures yourself for all devices to find patterns

 .foreach (place { .shell -ci "!object \\Device;" sed s/" ".." "//g | sed s/" .*"//g } ) {dt nt!_DEVICE_OBJECT -y Dri->Drivern* place ;dt nt!_DEVICE_OBJECT -yr DeviceOb->Att->Dri->Drivern* place ;dt nt!_DEVICE_OBJECT -yr Atta->Dri->Drivern* place ; .echo ==========} 

when a deviceobject has both AttachedDevice and AttachedTo device it should show you an output like this

 +0x008 DriverObject : +0x01c DriverName : _UNICODE_STRING "\Driver\TermDD" +0x0b0 DeviceObjectExtension : +0x018 AttachedTo : +0x008 DriverObject : +0x01c DriverName : _UNICODE_STRING "\Driver\PnpManager" +0x010 AttachedDevice : +0x008 DriverObject : +0x01c DriverName : _UNICODE_STRING "\Driver\Kbdclass" 

The structure is fully documented by Microsoft on their MSDN site. I also created a blog post a while ago, regarding this data structure which can be found here - http://bsodtutorials.blogspot.co.uk/2013/11/devobj-and-deviceobject.html