Getting driver load addresses from user space

NTDEV
1

I’ve got a embedded NT system that slows down after its been up for
months.

I’d love to run VTUNE on it, but that requires a reboot, making the
symptoms disappear.

Kernprof.exe runs, but it doesn’t work for any of drivers that are
Automatic or Manual.

I have some source code that replicates kernprof.exe, and it calls
NtQuerySystemInformation(0x0B, …), which returns the boot time modules
and their load addresses.

Does anyone know how to get similar information on drivers that are loaded
after boot time? (Connecting windbg is not practical.)

-DH

2

How about EnumDeviceDrivers then GetDeviceDriverBaseName
this is supposed to return all drivers. These are documented in
MSDN.

Don Burn
Windows 2k/XP/2k3 Filesystem and Driver Consulting

----- Original Message -----
From: “Dave Harvey”
To: “NT Developers Interest List”
Sent: Monday, April 07, 2003 2:10 PM
Subject: [ntdev] Getting driver load addresses from user space

> I’ve got a embedded NT system that slows down after its been up for
> months.
>
> I’d love to run VTUNE on it, but that requires a reboot, making the
> symptoms disappear.
>
> Kernprof.exe runs, but it doesn’t work for any of drivers that are
> Automatic or Manual.
>
> I have some source code that replicates kernprof.exe, and it calls
> NtQuerySystemInformation(0x0B, …), which returns the boot time modules
> and their load addresses.
>
> Does anyone know how to get similar information on drivers that are loaded
> after boot time? (Connecting windbg is not practical.)
>
> -DH
>
> —
> You are currently subscribed to ntdev as: xxxxx@acm.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com