Tracing Function Calls in Windows NT Kernel
Roman Kápl · Digital Repository (National Repository of Grey Literature) · 2015
Operating systems are complex and hard to understand. Students that want to learn more about internal operation of the Windows NT system can use tools such as WinDbg, WinObj or Process Monitor. However, these tools are either hard to use or do not offer sufficient level of detail. This thesis implements a new tool focused on monitoring of the I/O handling, called WinTrace. It can monitor key I/O events, such as execution of dispatch routines, completion rou- tines, interrupts and deferred procedure calls. To make the understanding of the recorded events easier, WinTrace can summarize them as graphical diagrams. While the tool is primarily targeted at students, it should also be valuable to driver developers when debugging real-world problems or as a general purpose function tracer. We also hope the thesis will be useful to anyone hooking func- tions in the NT Kernel, as we identify the problems that can be encountered during the implementation. 1