I wish to be able to record, in real time, 开发者_运维百科the activity of a kernel mode driver (I have the full symbols for it). It's a HID miniclass driver. I wish to record the execution of calls in this driver (stacktraces every time an IRP enters and leaves the driver).
Is this possible (maybe with EWT and/or WPT)?
How about ETW tracing? MS uses it all over inside windows. It will give you call-stacks also.
Here is the link
If you need to monitor only IRPs you can use Irp Tracker utility.
精彩评论