After a period of study, can already use WDK to write some simple driver, also use windbg double-click debugging,
Need to understand the implementation principle of IRPMON now, I think and I/o manager has a direct relationship, hope can provide some information and direction

CodePudding user response:

"WINDOWS kernel principle and implementation of the" pan aimin

6.7.2 irpmon implementation principle

CodePudding user response:

reference 1st floor zhao4zhong1 response:

"WINDOWS kernel principle and implementation of the" pan aimin

6.7.2 irpmon principle

Hello, HOOK IoCallDriver function methods such as I already will, I hope I can get the "I/o manager and relevant IRP" of ideas or information,

CodePudding user response:

I can only suggest that you first learn to use WinDbg remote step through another computer boot process,