The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.
The tool should compile fine in Microsoft Visual Studio 2013. MSVS 2015 seems to cause problems due to tons of warnings. I will have a look at the problem soon.
To test the program, you may compile it and than use the irpmonconsole applicaton. If you cannot or do not want to compile the project yourself, use the binaries in the binaries
- Install the driver by
irpmonconsole --install - Hook the driver you wish by
irpmonconsole --hook-driver <DriverObjectName> - Specify devices you wish to monitor by a sequence of these commands:
irpmonconsole --hook-device-name <DeviceObjectName>
irpmonconsole --hook-device-address <DeviceObjectAddress> - Use
irpmonconsole --monitorto log the requests (to the standard output).
If you wish to monitor only new devices created by a certain driver (the term "new" refers to devices created after the driver had been hooked) use irpmonconsole --hook-driver-nd <DriverObjectName> instead of the --hook-driver command.
To get information about driver and device objects present in the system, you may either use the irpmonconsole --enumerate command, or take advantage of my VrtuleTree utility.
To enumerate hooked objects and their IDs (handles), use the irpmonconsole --enumerate-hooks command. You can use the handles returned to unhook certain drivers or devices (--unhook-driver, --unhook
-device).
There are currently two major and one "minor" problems with IRPMon. The major problem is that fast I/O filtering might easily crash your system if you are interested in calls taht do not have device object as their parameter. The second major problem is an error in the IRPMon GUI that causes some crashes. The minor problem is that I do not have a certificate to sign the IRPMon drivers for now, although I plan to work on it during May 2017.
Also, a new version with some improvements, especially related to filtering new devices and devices belonging to certain device setup classes, is comming soon (I hope at least).
If you wish to support development of this tool, you may donate some stuff (BTC) to the following address:
17tEADhePvhHPj2X5GWn8vfiYhZCRH1f7V