Tools for debugging driver .sys

NTDEV
1

Hi,

Are there any tools availalble to debug a live running device driver (.sys) on Windows XP ? I do not have the source code for the driver, only .sys file and the application associated with it.

I’m particularly interested in capturing:

  1. the data being sent to driver when the application communicates with the driver.
  2. The data sent from driver to lower drivers/device

Can IDA Pro be useful ? Or any other method to proceed for the same.

Thanks and Regards,
RDH

2

debugview

xxxxx@gmail.com wrote: Hi,

Are there any tools availalble to debug a live running device driver (.sys) on Windows XP ? I do not have the source code for the driver, only .sys file and the application associated with it.

I’m particularly interested in capturing:

  1. the data being sent to driver when the application communicates with the driver.
  2. The data sent from driver to lower drivers/device

Can IDA Pro be useful ? Or any other method to proceed for the same.

Thanks and Regards,
RDH

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Here’s a new way to find what you’re looking for - Yahoo! Answers

3

I only have the .sys file. No symbol file i.e. pdb files. Can we still debug the .sys file ???

4

Yes you can still debug the driver, but only at an assembly language level, which will be very painful. Perhaps you ought to get in touch with the owner of the driver and see if they can help.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-278830-
xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, February 21, 2007 7:01 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Tools for debugging driver .sys

I only have the .sys file. No symbol file i.e. pdb files. Can we still
debug the .sys file ???

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer