The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.
The tool should compile fine in Microsoft Visual Studio 2013. MSVS 2015 seems to cause problems due to tons of warnings. I will have a look at the problem soon.
To test the program, you may compile it and than use the irpmonconsole applicaton. If you cannot or do not want to compile the project yourself, use the binaries in the binaries
- Install the driver by
irpmonconsole --install - Hook the driver you wish by
irpmonconsole --hook-driver <DriverObjectName> - Specify devices you wish to monitor by a sequence of these commands:
irpmonconsole --hook-device-name <DeviceObjectName>
irpmonconsole --hook-device-address <DeviceObjectAddress> - Use
irpmonconsole --monitorto log the requests (to the standard output).
If you wish to monitor only new devices created by a certain driver (the term "new" refers to devices created after the driver had been hooked) use irpmonconsole --hook-driver-nd <DriverObjectName> instead of the --hook-driver command.
To get information about driver and device objects present in the system, you may either use the irpmonconsole --enumerate command, or take advantage of my VrtuleTree utility.
To enumerate hooked objects and their IDs (handles), use the irpmonconsole --enumerate-hooks command. You can use the handles returned to unhook certain drivers or devices (--unhook-driver, --unhook
-device).
Also, a new version with some improvements, especially related to filtering new devices and devices belonging to certain device setup classes, is comming soon (I hope at least).
If you wish to support development of this tool, you may donate some stuff (BTC) to the following address:
17tEADhePvhHPj2X5GWn8vfiYhZCRH1f7V