开发者

Call Tracing Windows Driver

开发者 https://www.devze.com 2022-12-13 05:28 出处:网络
I wish to be able to record, in real time, 开发者_运维百科the activity of a kernel mode driver (I have the full symbols for it). It\'s a HID miniclass driver. I wish to record the execution of calls i

I wish to be able to record, in real time, 开发者_运维百科the activity of a kernel mode driver (I have the full symbols for it). It's a HID miniclass driver. I wish to record the execution of calls in this driver (stacktraces every time an IRP enters and leaves the driver).

Is this possible (maybe with EWT and/or WPT)?


How about ETW tracing? MS uses it all over inside windows. It will give you call-stacks also.

Here is the link


If you need to monitor only IRPs you can use Irp Tracker utility.

0

精彩评论

暂无评论...
验证码 换一张
取 消