IRPTrace2.00.002.zip

IRPTrace2.00.002.zip ，IRP跟踪工具，支持Windows7。 IRPTrace 2.00.002, Build Date September 23, 2015 File name = README.TXT ====================================================================== CONTENTS ========= 1) IRPTrace Components 2) Release Notes 3) Known problems & limitations 4) Known bugs 5) Update to the documentation 6) List of supported I/O requests We strongly recommend that you read the following information about this release. 1) IRPTrace Components ===================== README.TXT - This file HOWTOREG.TXT - How to register IRPTrace and contact APSoft IRPTrace.EXE - Main application module IRPDRV.SYS - Driver for Windows NT/2000/XP/Server 2003 TERMINAL - Terminal log file TERMINAL.DLL - IRPTrace library UNINSDRV.DLL - IRPTrace library TSCUST.DLL - IRPTrace library IRPTRACE.CHM - Help file TIPS.TXT - 'Tip of the Day' tips GUID.INI - GUID database IRPTRACE.INI - Driver uninstallation information UNINST.ISU - Installation/uninstallation log file 2) Release Notes ================ Release 2.00.002 1. Fixed processing of IRPs at elevated IRQLs 2. Added support for Windows 10 Release (Build 10240) 3. Corrected processing of USB IOCTLs 4. Release 2.00.001 1. Added support for x64 Windows. 2. Added support for Windows Vista, 7 and 8.x. 3. Added decoding of all USB kernel-mode messages. 4. Added decoding of all CDB messages. 5. Revised Terminal tracing. 6. Revised on-line help file. 7. Revised list of known IOCTLs. 8. Revised list of known GUIDs. Release 1.00.007 1. Added support for Microsoft Windows Vista (?). 2. Redesign right panel view. 3. Fix bug with processing of Image hooks. 4. Several minor bugs were fixed. Release 1.00.006 1. A BSOD (blue screen) was fixed, which appeared on some machines when enabling serial output. 2. A possibility to collect output on a remote computer in a terminal program was fixed. 3. Help was updated with information about how to collect IRPTrace's output on a remote computer in HyperTerminal and WinDbg. 4. Several minor bugs were fixed. Release 1.00.005 1. Support for 12-characters serial number was added. 2. Several minor bugs were fixed. Release 1.00.004 1. Support for Windows Server 2003 was added. 2. Support for PAE (Physical Address Extension) was implemented. PAE mode is used by Windows 2000/XP/Server 2003 in order to support more then 4GB of physical memory. Release 1.00.003 1. BSOD at dumping memory block containing '%' characters was fixed. 2. USB and Video I/O control support was implemented: IOCTL_VIDEO_GET_OUTPUT_DEVICE_POWER_STATE IOCTL_VIDEO_ENUM_MONITOR_PDO IOCTL_VIDEO_INIT_WIN32K_CALLBACKS IOCTL_VIDEO_IS_VGA_DEVICE IOCTL_VIDEO_MAP_VIDEO_MEMORY IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES IOCTL_VIDEO_QUERY_PUBLIC_ACCESS_RANGES IOCTL_VIDEO_SET_CURRENT_MODE IOCTL_INTERNAL_USB_SUBMIT_URB Subfunctions: _URB_BULK_OR_INTERRUPT_TRANSFER _URB_CONTROL_DESCRIPTOR_REQUEST _URB_CONTROL_FEATURE_REQUEST _URB_CONTROL_GET_CONFIGURATION_REQUEST _URB_CONTROL_GET_INTERFACE_REQUEST _URB_CONTROL_GET_STATUS_REQUEST _URB_CONTROL_TRANSFER _URB_CONTROL_VENDOR_OR_CLASS_REQUEST _URB_ISOCH_TRANSFER _URB_GET_CURRENT_FRAME_NUMBER _URB_GET_FRAME_LENGTH _URB_PIPE_REQUEST _URB_SELECT_CONFIGURATION _URB_SELECT_INTERFACE _URB_SET_FRAME_LENGTH _URB_FRAME_LENGTH_CONTROL 3. GUID database was updated 4. Support of 'Forwarded' requests was added 5. 'Tip of the Day' support was implemented 6. Limitations in Evaluation Version were implemented: * A timed evaluation message is displayed on startup; * A registration reminder dialog appears regularly; * Information about every 4th IRP is disabled. 7. A hang on dual CPU machine under Windows NT 4.0 was fixed. 8. A BSOD at collecting driver information was fixed. 9. A hang during the attempt to clear IRP tree was fixed. 10. A log of minor bugs were fixed. Release 1.00.002 1. Problem with Driver Verifier support was fixed. 2. Template for several I/O controls of Serial driver were corrected. 3. Support for changing limit on size of raw data was added (Driver Control dialog) Release 1.00.001 Initial release. 3) Known problems & limitations =============================== 3.1) Hook on disk drivers It is not recommended to set hook on disk drivers such as FASTFAT ATAPI NTFS DISK DISKPERF with switched on File Logging option, because any attempt of IRPTrace to log IRP information causes sending several IRPs to disk driver. 3.2) Capturing Kernel output IRPTrace does not support capturing debug messages sent on IRQL greater than DISPATCH_LEVEL. Maximal size of cache for debug messages is 1MB. Some messages can be lost if frequency/size of debug messages is too big. 3.3) IRPTrace does not allow to set hook on IRPDRV driver 4) Known bugs ============= Currently unavailable. 5) Update to the documentation. =============================== Currently unavailable. 6) List of supported I/O requests -------------------------------------------------------------------------- Major/Minor function Generic Parameters Information Input Output -------------------------------------------------------------------------- IRP_MJ_CREATE + + N/A IRP_MJ_CREATE_NAMED_PIPE + - - IRP_MJ_CLOSE + N/A N/A IRP_MJ_READ + + + IRP_MJ_WRITE + + + IRP_MJ_QUERY_INFORMATION + + + IRP_MJ_SET_INFORMATION + - - IRP_MJ_QUERY_EA + - - IRP_MJ_SET_EA + - - IRP_MJ_FLUSH_BUFFERS + N/A N/A IRP_MJ_QUERY_VOLUME_INFORMATION + + + IRP_MJ_SET_VOLUME_INFORMATION + - - IRP_MJ_DIRECTORY_CONTROL + - - IRP_MN_QUERY_DIRECTORY + - - IRP_MN_NOTIFY_CHANGE_DIRECTORY + - - IRP_MJ_FILE_SYSTEM_CONTROL + - - IRP_MN_USER_FS_REQUEST + - - IRP_MN_MOUNT_VOLUME + - - IRP_MN_VERIFY_VOLUME + - - IRP_MN_LOAD_FILE_SYSTEM + - - IRP_MN_TRACK_LINK + - - IRP_MN_KERNEL_CALL + - - IRP_MJ_DEVICE_CONTROL + + + IRP_MJ_INTERNAL_DEVICE_CONTROL + + + IRP_MJ_SHUTDOWN + N/A N/A IRP_MJ_LOCK_CONTROL + - - IRP_MN_LOCK + - - IRP_MN_UNLOCK_SINGLE + - - IRP_MN_UNLOCK_ALL + - - IRP_MN_UNLOCK_ALL_BY_KEY + - - IRP_MJ_CLEANUP + N/A N/A IRP_MJ_CREATE_MAILSLOT + - - IRP_MJ_QUERY_SECURITY + - - IRP_MJ_SET_SECURITY + - - IRP_MJ_POWER + + + IRP_MN_WAIT_WAKE + + N/A IRP_MN_POWER_SEQUENCE + - - IRP_MN_SET_POWER + + - IRP_MN_QUERY_POWER + + N/A IRP_MJ_SYSTEM_CONTROL + - - IRP_MN_QUERY_ALL_DATA + - - IRP_MN_QUERY_SINGLE_INSTANCE + - - IRP_MN_CHANGE_SINGLE_INSTANCE + - - IRP_MN_CHANGE_SINGLE_ITEM + - - IRP_MN_ENABLE_EVENTS + - - IRP_MN_DISABLE_EVENTS + - - IRP_MN_ENABLE_COLLECTION + - - IRP_MN_DISABLE_COLLECTION + - - IRP_MN_REGINFO + + + IRP_MN_EXECUTE_METHOD + - - IRP_MN_REGINFO_EX + + + IRP_MJ_DEVICE_CHANGE + - - IRP_MJ_QUERY_QUOTA + - - IRP_MJ_SET_QUOTA + - - IRP_MJ_PNP + - - IRP_MN_START_DEVICE + + N/A IRP_MN_QUERY_REMOVE_DEVICE + N/A N/A IRP_MN_REMOVE_DEVICE + N/A N/A IRP_MN_CANCEL_REMOVE_DEVICE + N/A N/A IRP_MN_STOP_DEVICE + N/A N/A IRP_MN_QUERY_STOP_DEVICE + N/A N/A IRP_MN_CANCEL_STOP_DEVICE + N/A N/A IRP_MN_QUERY_DEVICE_RELATIONS + + + IRP_MN_QUERY_INTERFACE + + + IRP_MN_QUERY_CAPABILITIES + + + IRP_MN_QUERY_RESOURCES + N/A + IRP_MN_QUERY_RESOURCE_REQUIREMENTS + N/A + IRP_MN_QUERY_DEVICE_TEXT + + + IRP_MN_FILTER_RESOURCE_REQUIREMENTS + + + IRP_MN_READ_CONFIG + + + IRP_MN_WRITE_CONFIG + + + IRP_MN_EJECT + N/A N/A IRP_MN_SET_LOCK + + N/A IRP_MN_QUERY_ID + + + IRP_MN_QUERY_PNP_DEVICE_STATE + N/A + IRP_MN_QUERY_BUS_INFORMATION + N/A + IRP_MN_DEVICE_USAGE_NOTIFICATION + + N/A IRP_MN_SURPRISE_REMOVAL + N/A N/A IRP_MN_QUERY_LEGACY_BUS_INFORMATION + N/A + -------------------------------------------------------------------------- N/A - Request does not have input (output) parameters