CODEWITHSUNDEEP
ckerneldrivertracestack-trace
Aram Hăvărneanu
Aram Hăvărneanu

Reputation: 784

Call Tracing Windows Driver

I wish to be able to record, in real time, the activity of a kernel mode driver (I have the full symbols for it). It's a HID miniclass driver. I wish to record the execution of calls in this driver (stacktraces every time an IRP enters and leaves the driver).

Is this possible (maybe with EWT and/or WPT)?

Upvotes: 1

Views: 835

Answers (2)

Naveen
Naveen

Reputation: 4120

How about ETW tracing? MS uses it all over inside windows. It will give you call-stacks also.

Here is the link

Upvotes: 2

Sergey Podobry
Sergey Podobry

Reputation: 7189

If you need to monitor only IRPs you can use Irp Tracker utility.

Upvotes: 1

Related Questions