IRPTrace是一款强大的工具，专为Windows操作系统设计，用于跟踪和检测I/O请求包（Input/Output Request Packets，简称IRPs）。IRPs是Windows内核中处理设备I/O操作的核心机制，它们在驱动程序之间传递，以完成硬件访问任务。IRPTrace能够帮助系统管理员、开发者以及故障排除专家深入理解系统内部的I/O流程，从而优化性能，定位和解决与I/O相关的复杂问题。 IRPTrace的主要功能包括： 1. 实时跟踪：该工具可以实时监控系统中的IRP活动，记录下每一个IRP的创建、传递、完成过程，以及相关的参数和状态变化。这对于了解驱动程序如何处理I/O请求非常有帮助。 2. 详细日志：IRPTrace会生成详细的跟踪日志，记录每个IRP的详细信息，如IRP的类型、服务例程、目标设备对象等，便于分析和调试。 3. 用户友好的界面：尽管IRPTrace提供的是命令行界面，但它输出的结果清晰易读，方便用户快速查找和理解关键信息。 4. 过滤和搜索：用户可以根据需要设置过滤条件，只显示特定类型的IRP或与特定设备相关的IRP，同时提供搜索功能，帮助用户快速定位到感兴趣的部分。 5. 分析报告：IRPTrace还支持生成分析报告，总结IRP的行为模式，有助于发现潜在的问题和性能瓶颈。 6. 故障排除：对于系统出现的I/O问题，IRPTrace能够提供宝贵的线索，通过跟踪IRP的路径，找出导致问题的具体环节，加速故障排查。 7. 开发辅助：对于驱动程序的开发和测试，IRPTrace可以帮助开发者验证IRP处理逻辑的正确性，确保驱动程序按照预期工作。 8. 性能优化：通过对IRP的深度分析，可以识别出可能导致系统延迟或资源浪费的操作，从而进行性能优化。 使用IRPTrace时，首先需要正确配置和启动工具，可能需要以管理员权限运行，并根据需要设置跟踪级别和过滤器。然后，工具会在后台运行，收集IRP信息。一旦收集完成，用户可以导出结果，进一步分析或与其他工具结合使用。 IRPTrace是系统管理员和开发者不可或缺的工具，它提供了深入洞察Windows内核I/O操作的能力，帮助提升系统的稳定性和效率。通过熟练掌握IRPTrace，可以更有效地管理和维护复杂的系统环境，及时发现并解决问题。

从事windows驱动开发的新人可以看下

IRPTrace2.00.002.zip ，IRP跟踪工具，支持Windows7。 IRPTrace 2.00.002, Build Date September 23, 2015 File name = README.TXT ====================================================================== CONTENTS ========= 1) IRPTrace Components 2) Release Notes 3) Known problems & limitations 4) Known bugs 5) Update to the documentation 6) List of supported I/O requests We strongly recommend that you read the following information about this release. 1) IRPTrace Components ===================== README.TXT - This file HOWTOREG.TXT - How to register IRPTrace and contact APSoft IRPTrace.EXE - Main application module IRPDRV.SYS - Driver for Windows NT/2000/XP/Server 2003 TERMINAL - Terminal log file TERMINAL.DLL - IRPTrace library UNINSDRV.DLL - IRPTrace library TSCUST.DLL - IRPTrace library IRPTRACE.CHM - Help file TIPS.TXT - 'Tip of the Day' tips GUID.INI - GUID database IRPTRACE.INI - Driver uninstallation information UNINST.ISU - Installation/uninstallation log file 2) Release Notes ================ Release 2.00.002 1. Fixed processing of IRPs at elevated IRQLs 2. Added support for Windows 10 Release (Build 10240) 3. Corrected processing of USB IOCTLs 4. Release 2.00.001 1. Added support for x64 Windows. 2. Added support for Windows Vista, 7 and 8.x. 3. Added decoding of all USB kernel-mode messages. 4. Added decoding of all CDB messages. 5. Revised Terminal tracing. 6. Revised on-line help file. 7. Revised list of known IOCTLs. 8. Revised list of known GUIDs. Release 1.00.007 1. Added support for Microsoft Windows Vista (?). 2. Redesign right panel view. 3. Fix bug with processing of Image hooks. 4. Several minor bugs were fixed. Release 1.00.006 1. A BSOD (blue screen) was fixed, which appeared on some machines when enabling serial output. 2. A possibility to collect output on a remote computer in a terminal program was fixed. 3. Help was updated with information about how to collect IRPTrace's output on a remote computer in HyperTerminal and WinDbg. 4. Several minor bugs were fixed. Release 1.00.005 1. Support for 12-characters serial number was added. 2. Several minor bugs were fixed. Release 1.00.004 1. Support for Windows Server 2003 was added. 2. Support for PAE (Physical Address Extension) was implemented. PAE mode is used by Windows 2000/XP/Server 2003 in order to support more then 4GB of physical memory. Release 1.00.003 1. BSOD at dumping memory block containing '%' characters was fixed. 2. USB and Video I/O control support was implemented: IOCTL_VIDEO_GET_OUTPUT_DEVICE_POWER_STATE IOCTL_VIDEO_ENUM_MONITOR_PDO IOCTL_VIDEO_INIT_WIN32K_CALLBACKS IOCTL_VIDEO_IS_VGA_DEVICE IOCTL_VIDEO_MAP_VIDEO_MEMORY IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES IOCTL_VIDEO_QUERY_PUBLIC_ACCESS_RANGES IOCTL_VIDEO_SET_CURRENT_MODE IOCTL_INTERNAL_USB_SUBMIT_URB Subfunctions: _URB_BULK_OR_INTERRUPT_TRANSFER _URB_CONTROL_DESCRIPTOR_REQUEST _URB_CONTROL_FEATURE_REQUEST _URB_CONTROL_GET_CONFIGURATION_REQUEST _URB_CONTROL_GET_INTERFACE_REQUEST _URB_CONTROL_GET_STATUS_REQUEST _URB_CONTROL_TRANSFER _URB_CONTROL_VENDOR_OR_CLASS_REQUEST _URB_ISOCH_TRANSFER _URB_GET_CURRENT_FRAME_NUMBER _URB_GET_FRAME_LENGTH _URB_PIPE_REQUEST _URB_SELECT_CONFIGURATION _URB_SELECT_INTERFACE _URB_SET_FRAME_LENGTH _URB_FRAME_LENGTH_CONTROL 3. GUID database was updated 4. Support of 'Forwarded' requests was added 5. 'Tip of the Day' support was implemented 6. Limitations in Evaluation Version were implemented: * A timed evaluation message is displayed on startup; * A registration reminder dialog appears regularly; * Information about every 4th IRP is disabled. 7. A hang on dual CPU machine under Windows NT 4.0 was fixed. 8. A BSOD at collecting driver information was fixed. 9. A hang during the attempt to clear IRP tree was fixed. 10. A log of minor bugs were fixed. Release 1.00.002 1. Problem with Driver Verifier support was fixed. 2. Template for several I/O controls of Serial driver were corrected. 3. Support for changing limit on size of raw data was added (Driver Control dialog) Release 1.00.001 Initial release. 3) Known problems & limitations =============================== 3.1) Hook on disk drivers It is not recommended to set hook on disk drivers such as FASTFAT ATAPI NTFS DISK DISKPERF with switched on File Logging option, because any attempt of IRPTrace to log IRP information causes sending several IRPs to disk driver. 3.2) Capturing Kernel output IRPTrace does not support capturing debug messages sent on IRQL greater than DISPATCH_LEVEL. Maximal size of cache for debug messages is 1MB. Some messages can be lost if frequency/size of debug messages is too big. 3.3) IRPTrace does not allow to set hook on IRPDRV driver 4) Known bugs ============= Currently unavailable. 5) Update to the documentation. =============================== Currently unavailable. 6) List of supported I/O requests -------------------------------------------------------------------------- Major/Minor function Generic Parameters Information Input Output -------------------------------------------------------------------------- IRP_MJ_CREATE + + N/A IRP_MJ_CREATE_NAMED_PIPE + - - IRP_MJ_CLOSE + N/A N/A IRP_MJ_READ + + + IRP_MJ_WRITE + + + IRP_MJ_QUERY_INFORMATION + + + IRP_MJ_SET_INFORMATION + - - IRP_MJ_QUERY_EA + - - IRP_MJ_SET_EA + - - IRP_MJ_FLUSH_BUFFERS + N/A N/A IRP_MJ_QUERY_VOLUME_INFORMATION + + + IRP_MJ_SET_VOLUME_INFORMATION + - - IRP_MJ_DIRECTORY_CONTROL + - - IRP_MN_QUERY_DIRECTORY + - - IRP_MN_NOTIFY_CHANGE_DIRECTORY + - - IRP_MJ_FILE_SYSTEM_CONTROL + - - IRP_MN_USER_FS_REQUEST + - - IRP_MN_MOUNT_VOLUME + - - IRP_MN_VERIFY_VOLUME + - - IRP_MN_LOAD_FILE_SYSTEM + - - IRP_MN_TRACK_LINK + - - IRP_MN_KERNEL_CALL + - - IRP_MJ_DEVICE_CONTROL + + + IRP_MJ_INTERNAL_DEVICE_CONTROL + + + IRP_MJ_SHUTDOWN + N/A N/A IRP_MJ_LOCK_CONTROL + - - IRP_MN_LOCK + - - IRP_MN_UNLOCK_SINGLE + - - IRP_MN_UNLOCK_ALL + - - IRP_MN_UNLOCK_ALL_BY_KEY + - - IRP_MJ_CLEANUP + N/A N/A IRP_MJ_CREATE_MAILSLOT + - - IRP_MJ_QUERY_SECURITY + - - IRP_MJ_SET_SECURITY + - - IRP_MJ_POWER + + + IRP_MN_WAIT_WAKE + + N/A IRP_MN_POWER_SEQUENCE + - - IRP_MN_SET_POWER + + - IRP_MN_QUERY_POWER + + N/A IRP_MJ_SYSTEM_CONTROL + - - IRP_MN_QUERY_ALL_DATA + - - IRP_MN_QUERY_SINGLE_INSTANCE + - - IRP_MN_CHANGE_SINGLE_INSTANCE + - - IRP_MN_CHANGE_SINGLE_ITEM + - - IRP_MN_ENABLE_EVENTS + - - IRP_MN_DISABLE_EVENTS + - - IRP_MN_ENABLE_COLLECTION + - - IRP_MN_DISABLE_COLLECTION + - - IRP_MN_REGINFO + + + IRP_MN_EXECUTE_METHOD + - - IRP_MN_REGINFO_EX + + + IRP_MJ_DEVICE_CHANGE + - - IRP_MJ_QUERY_QUOTA + - - IRP_MJ_SET_QUOTA + - - IRP_MJ_PNP + - - IRP_MN_START_DEVICE + + N/A IRP_MN_QUERY_REMOVE_DEVICE + N/A N/A IRP_MN_REMOVE_DEVICE + N/A N/A IRP_MN_CANCEL_REMOVE_DEVICE + N/A N/A IRP_MN_STOP_DEVICE + N/A N/A IRP_MN_QUERY_STOP_DEVICE + N/A N/A IRP_MN_CANCEL_STOP_DEVICE + N/A N/A IRP_MN_QUERY_DEVICE_RELATIONS + + + IRP_MN_QUERY_INTERFACE + + + IRP_MN_QUERY_CAPABILITIES + + + IRP_MN_QUERY_RESOURCES + N/A + IRP_MN_QUERY_RESOURCE_REQUIREMENTS + N/A + IRP_MN_QUERY_DEVICE_TEXT + + + IRP_MN_FILTER_RESOURCE_REQUIREMENTS + + + IRP_MN_READ_CONFIG + + + IRP_MN_WRITE_CONFIG + + + IRP_MN_EJECT + N/A N/A IRP_MN_SET_LOCK + + N/A IRP_MN_QUERY_ID + + + IRP_MN_QUERY_PNP_DEVICE_STATE + N/A + IRP_MN_QUERY_BUS_INFORMATION + N/A + IRP_MN_DEVICE_USAGE_NOTIFICATION + + N/A IRP_MN_SURPRISE_REMOVAL + N/A N/A IRP_MN_QUERY_LEGACY_BUS_INFORMATION + N/A + -------------------------------------------------------------------------- N/A - Request does not have input (output) parameters

Windows驱动程序开发比较复杂，我将带领大家一起领略内核模式下编程的奥妙。 您将真正掌握内核编程的原理与技术，将技术水平提升一个档次，学会核心技术。 您将掌握Windows驱动开发的基本技术；灵活应用IRP、IO堆栈、设备栈、派遣函数等； 您将掌握Windows驱动的分层技术，了解WDM驱动的基本原理 您将掌握Windows驱动开发中的各种回调例程：完成例程、取消例程、DPC例程、APC例程、等等。 具体内容包括但不限于： Windows驱动开发小白入门，Windows内核架构与驱动开发的基本概念，VS2015+VMware(win10x64)双机调试驱动，Win10x64中安装WDM驱动，驱动程序的基本结构（NT,WDM)，Windows内存管理，Windows内核函数，驱动程序的派遣函数，驱动程序的同步处理，IRP的同步，定时器，驱动程序调用驱动程序，分层驱动程序

所有驱动开发人员都要知道的知识，在微软的Windows 操作系统家族中，都通过发送I/O 请求包(IRP, I/o Request Packets)来进行和驱动程序的通讯。

一个示例驱动，演示了如何更换一个Irp包，且如何将一个Irp包分拆成多个小Irp包。

IRP讲座-信息化建设基础工程

将IRP（信息资源规划）技术应用于高校教育信息管理系统中并与实践相结合，解决信息孤岛，实现信息共享。从IRP的理论体系入手，分析了IRP应用技术，基于IRP技术规划了高校教育信息管理系统的实施步骤，提出了数据的整合集成等方案，为现有系统的集成改造提供了新的方法。

irp trace v2.0 破解版,支持winxp,2003,vista,7,8,10 x86,x64等版本，非常好用，不敢独享。

研究了大型、复杂网络信息系统分散开发造成的数据格式不统一、系统接口复杂,使系统集成软件维护成本巨大、资金浪费严重问题。应用IRP新的技术和方法,对大型供电网络进行了分析,通过业务过程矩阵、关键成功因素分析(CSF)等,得到业务模型,使用用户视图分析、数据流分析(DFD)、分类编码技术和范式理论进行数据元规范化,得到了系统体系结构模型。以此建立了一个大型供电企业的信息组织框架、进行了全面的信息的规划,建立了主题数据库,保证应用数据的唯一性,实现了调度运行管理、变电运行管理、线路运行管理的无纸化,使调度运行、