Viewing TraceEvent Messages in WindDbg

NTDEV
1

Hi Guys,
I am trying to debug my driver which has trace messages and the driver is installed on a remote system to which I do not have access. It is a driver which has all the TraceEvents. I do have all the TMH files. I have a debugger connection to the machine and I can put break points etc. I am trying to see the TraceEvent messages in WinDbg. I am trying to do this:-

https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/example-16--viewing-trace-messages-in-a-debugger

The problem is that with the latest SDKs I cannot find Traceprt.dll. Now sure what I am missing. I installed the latest debugging tools for windows and still not there.
What am I missing here?

Thanks
Aj

2

I just confirmed this works for me and I didn’t need that DLL. Steps:

  1. Copy tracelog.exe to the target system
  2. Create a guid.etl file with the GUID, flags, and level. I made mine look like this (i.e. just try to turn everything on):
    {79C04C13-1234-4DE7-911C-53F90811B72C};0xFFFFFFFF;255
  3. Enable the trace:
    tracelog -start MyTrace -guid guid.ctl -rt -kd
  4. Then the messages started coming out in the debugger without any further action
3

Thank you Sir!! It works!!

1 Like