How Diskmon (Sysinternals) works?

NTDEV
1

Hi,

Anybody knows how Diskmon can monitor disk activities?

I am wondering if I can hook some places (functions?) in Windows to do
something similar.

Many thanks,
J

2

I’ve never looked at ‘diskmon,’ nor is this really my thing, but I think a good place to start might be the ‘diskperf’ sample in the wdk (\src\storage\filters\diskperf).

Good luck,

mm

3

If I am right it uses ETW windows.

From:
Sent: Wednesday, March 03, 2010 11:01 AM
To: “Windows System Software Devs Interest List”
Subject: RE:[ntdev] How Diskmon (Sysinternals) works?

> I’ve never looked at ‘diskmon,’ nor is this really my thing, but I think a
> good place to start might be the ‘diskperf’ sample in the wdk
> (\src\storage\filters\diskperf).
>
>
> Good luck,
>
> mm
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

I think that you should write a filter driver and install it on the top of disk driver stack. Then your filter driver can check all IRPs that are sent to the disk driver.

5

This makes about the third time this, or some variation of the same question
has been asked in as many months. In fact the name is awfully familiar. Why
are you so “hooked” on hooking, and why of all places would you ask a
question about “hooking” anything in a forum that considers any kind of
“hooking” the vilest of prostitution?

As has been suggested this time, and has been suggested every time this
question has been posted, write a frigging filter and quit trying to pimp
the system.

The personal opinion of
Gary G. Little

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jun Koi
Sent: Tuesday, March 02, 2010 11:26 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How Diskmon (Sysinternals) works?

Hi,

Anybody knows how Diskmon can monitor disk activities?

I am wondering if I can hook some places (functions?) in Windows to do
something similar.

Many thanks,
J

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 4911 (20100303) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature
database 4911 (20100303) __________

The message was checked by ESET Smart Security.

http://www.eset.com

6

And Gary’s original suggestion of looking at diskperf is correct.
Russinovich based his code on diskperf from way back when.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: Gary G. Little [mailto:xxxxx@comcast.net]
Posted At: Wednesday, March 03, 2010 10:50 AM
Posted To: ntdev
Conversation: How Diskmon (Sysinternals) works?
Subject: RE: How Diskmon (Sysinternals) works?

This makes about the third time this, or some variation of the same
question has been asked in as many months. In fact the name is awfully
familiar. Why are you so “hooked” on hooking, and why of all places
would you ask a question about “hooking” anything in a forum that
considers any kind of “hooking” the vilest of prostitution?

As has been suggested this time, and has been suggested every time
this
question has been posted, write a frigging filter and quit trying to
pimp the system.

The personal opinion of
Gary G. Little

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jun Koi
Sent: Tuesday, March 02, 2010 11:26 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How Diskmon (Sysinternals) works?

Hi,

Anybody knows how Diskmon can monitor disk activities?

I am wondering if I can hook some places (functions?) in Windows to do
something similar.

Many thanks,
J

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus
signature database 4911 (20100303) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus
signature database 4911 (20100303) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus
signature database 4911 (20100303) __________

The message was checked by ESET Smart Security.

http://www.eset.com