IrpTracker
Description
You've GOTTA check out this cool new utility! IrpTracker allows you to monitor all I/O request packets (IRPs) on a system without the use of any filter drivers and with no references to any device objects, leaving the PnP system entirely undisturbed. In addition to being able to see the path the IRP takes down the driver stack and its ultimate completion status, a detailed view is available that allows you to see the entire contents of static portion of the IRP and an interpreted view of the current and previous stack locations.
Use it as a learning tool if you're wondering how different devices/drivers interact or handle certain typs of I/O. Or, use it as a debugging tool (i.e. why does this I/O request succeed, but this one fails?). "Supported" on?XP?through Windows 7.
What's new in IrpTracker V2.20
Fixed Win7 crash when tracking NTAPI calls
What's new in IrpTracker V2.19
Added support for Windows 7 as well as SCSI Request Block decoding in the IRP details view for IRP_MJ_SCSI requests.
What's new in IrpTracker V2.18
Added support for Windows Vista RC1
What's new in IrpTracker V2.1
IrpTracker now includes the ability to track Native API calls that can result in IRPs being sent to a device stack. When the NTAPI option is enabled and a device near the top of a device stack is selected, IrpTracker will show the user mode application's Native API calls that generate the IRPs being sent to the stack.
Added the ablitity to track devices by driver name. This allows you to enter a driver name in before the driver is loaded and automatically track the devices that the driver subsequently creates.
Added Windows Server 2003 SP1 support
Please send any of your likes, dislikes, bugs, requests and rants to bugs@osr.com.
What's new in IrpTracker V1.3
Added the ability to save the display contents to a file
IrpTracker now comes with a WinDBG extension DLL that allows you to dump the driver's in memory tracking records in the event of a system crash
What's new in IrpTracker V1.2
IrpTracker now tracks completion routine processing! Completion routines now show up in the main application window labeled as "CompRoutine". The amount of data collected while the IRP travels up the stack is minimal, so a full view of the IRP is not available by double clicking a "CompRoutine" entry (This information is still available on all "Call" and "Comp" rows).
IrpTracker is now compatible with Driver Verifier. The tracking data displayed for a device is now fully correct when Verifier is running on any driver in the system
Various UI bug fixes
V1.2a Updates:
Fixed reported load error bug
| Version: |
V2.20 |
| OS Support |
Windows XP, Server 2003, Windows Vista, Windows 7 |
| Date Updated: |
February 2010 |
| Author: |
OSR |
Download
 ?IrpTracker V2.20 x86 Zip Archive, 194KB
Number Of Downloads
This utility has been downloaded 31272 times.
User Comments
Rate this utility and tell the community how well you like it. Is it a worthwhile download? Does it work as described?? Does it help you in your job as a driver writer or tester?
Click Here To Post Your Comment
"Win 8 and Later and ARM Not Supported"
We're aware that this utility doesn't work on Win8 and later... and that it also doesn't work on ARM.
This is a diagnostic utility that does uses some pretty serious hacks to enable it to work without using a filter driver (which is a major goal for the utility). Those hacks require that we work around Patch Guard, and Patch Guard is becoming increasingly effective at preventing exactly the sorts of things that this utility does.
We don't have any immediate plans to update this utility. We may do so, but as of now we hope you enjoy using it on Win7.
14-Oct-15, Peter Viscarola
"Win10 Support"
I get an error message box "Unable to load device driver!" and then the app exits on Win10, even when running as Administrator. Anyone else?
24-Sep-15, Kashif Hasan
"May be good idea to port this tool to Win8.1/x64"
In spite of having doubt, I tried on Win8.1/x64. Did not work. I know this may be expected from OSR perspective... :)
15-Oct-14, Ramana Reddy Polaka
"Help :/"
I am running the utility on a Win 7 Ultimate SP1 system through VMWare . Whenever i try to load IRP Tracker is quits showing the message "unable to load device driver". Please guide me on this.
Regards, Maitreya
Rating:
02-Jun-13, maitreya dave
"IrpTracker - No 64-bit version, and also not an Open project."
"Why OSR does not want to make this valuable utility working on 64-bit system? 64-bit Windows has been installed on more and more computers."
Probably because that will require a second driver, and despite the wealth of information on OSR not everyone is capable writing a driver for x64 windows.
Unfortunately, 32bit windows is slowly being phased out, and the use of this and other similar tools will no longer be an option for Windows Server (and, eventually, consumer class Windows deploys.) Eventually the community will need to rebuild this tool. Where is the code?
30-Mar-13, Shaun Wilson
"IPR tracking error"
Hi I am getting a problem while trying to open software. I am getting this message "unable to load device driver!". how can i fix it?
Rating:
19-Jan-13, maddy ejas
"Any plans on supporting Win 8"
This is a nice tool. Are there any plans on supporting Windows 8? I tried it on an x86 clover trail but the driver doesnt work.
Vishal
Rating:
21-Dec-12, Vishal Manan
"timestamp missing in log file?"
when i saved it as a log file, the timestamp is missing! can you fix it?
31-Oct-12, chris cheung
"Irp tracker not working on Win 7-32/Win 8-32"
I am not sure if you have support for win8, so I tried out the tool on Win 7-32 / Win 8-32 but I always get a unable load device driver error. Any ideas on how to resolve this ?
16-Apr-12, vivek dev
"Great tool..."
New to OSR...is there some way that source code is provided?
Rating:
02-Sep-11, Akshay Kadam
"Error while Runnig IrpTracker"
Hai......
I am using Windows Vista Home Premium Service Pack 1 Operating System. When I run IrpTracker, it is showing a dialog box, i pressed OK button, then it is showing an error dialog box contains "Unable to load device driver". What was the problem ???
Thankyou
Rating:
27-Aug-11, Yugandhar Babu
"64-bit support"
Why OSR does not want to make this valuable utility working on 64-bit system? 64-bit Windows has been installed on more and more computers.
09-Aug-11, Michael Zhu
"RE: Print IoControlCode for DEVICE_CONTROL?"
If you double click the IRP entry in the display we'll tell you what the device control is (we even interpret it and look up the constant value). Having it in the display itself would be a good feature though.
Thanks!
-scott
11-Jul-11, Scott Noone
"Print IoControlCode for DEVICE_CONTROL?"
Is it possible to print IoControlCode for DEVICE_CONTROL requests? Would be totally awesome!
Rating:
11-Jul-11, Alex S
"objinfo"
It pop up a message "Unable to load objinfo device driver" and the tool can't be opened. What's wrong with this situation? Thanks.
16-Dec-10, yalan pan
"Additional info columns would be nice"
I think the IrpTracker utility would be even more useful if some more information columns could be added. I don't see any mini-filter or legacy filter entries for IrpTracker when I invoke fltmc.exe, so I don't know if thread and file information are available. But those are the things I would find the most useful if they were added.
Rating:
21-Sep-10, Michael Bailey
"v2.20 crashes on NTAPI Tracking"
I am getting an 0x8E blue screen when I turn on NTAPI tracking. I don't know exactly what the feature does, but I suspect it would be useful to me if it worked. I'll post the !analyze -v output elsewhere, as I think this area is for short comments only.
Rating:
21-Sep-10, Michael Bailey
"64-bit Support"
Lots of folks have asked about 64-bit support. The answer is: We have no plans for a 64-bit version of this utility at the present time.
01-Sep-10, Peter Viscarola
""Unabel to laod driver on 2k8 Enterprise x64 Hyper-V"
Hi I get "Unable to load device driver" when I invoke this on 2k8 Enterprise x64 (with Hyper-V enabled). I also enabled application Server Role on this machine. Let me know. Thanks
Rating:
15-Jul-10, s m
"Can't initialize device driver under Windows 7"
when I run the Irptracker under windows 7,it just popup a dialog saying "Unable to initialize device driver!"
Rating:
18-May-10, Decoder Quan
"IrpTracker for AMD64"
Hi, it's really a cool utility - but: is there a version available which supports AMD64/x64 architecture?
I would need this tool on a Server 2008 R2 box. And this OS is no longer available in a 32 bit version.
thanks andy
Rating:
13-Apr-10, Andreas Dietrich
"IRP Tracker trouble"
I have downloaded Irp Tracker(Version 2.20) from your site and executed it. But I found the message "IrpTracker_V220 x86\IrpTracker.exe is not valid Win32 Application." I executed it on Windows 2000 Server SP4. Could you teach the cause or the action method of the event though time is spent?
Rating:
08-Apr-10, shinsuke watanabe
"IRP Tracker trouble"
I have downloaded Irp Tracker(Version 2.20) from your site and executed it. But I found the message "IrpTracker_V220 x86\IrpTracker.exe is not valid Win32 Application." I executed it on Windows 2000 Server SP4. Could you teach the cause or the action method of the event though time is spent?
08-Apr-10, shinsuke watanabe
"IRP Tracker trouble"
I have downloaded Irp Tracker(Version 2.20) from your site and executed it. But I found the message "IrpTracker_V220 x86\IrpTracker.exe is not valid Win32 Application."
I executed it on Windows 2000 Server SP4. It was written that Windows2000 was supported to the site. http://www.osronline.com/article.cfm?article=199
Could you teach the cause or the action method of the event though time is spent?
08-Apr-10, shinsuke watanabe
"IrpTracker 2.20 Error"
I'm using win 2OOO SP4 and have "Not a valid win32 application" message and "can't load objinf driver" message when using V2.18
25-Feb-10, ahmed morjane
"x64 support"
IrpTracker does not work on my x64 bit Windows 7 machine (fails with 'Unable to load device driver'). I guess that's because it is an x86 application. Is there a chance of 64 bit support in the future?
09-Feb-10, Yariv Barkan
"x64 support"
Are there any plans to make x64 version?
02-Feb-10, Ivan Strelcov
"RE: Monitor newly created devices?"
There already is an option to do this, albeit not exactly what you're looking for.
If you go to the "Track Driver" option under the File menu, then you can enter the name of a driver that you want to track all of the devices for. This works even if the driver isn't loaded yet.
30-Nov-09, Scott Noone
"Monitor newly created devices?"
It would be great if this tool could monitor newly created devices instead of just existing ones. Here's an example of why it would be useful: I have a malware sample that loads a driver as soon as it executes. The driver creates a device, and then the user mode components starts communicating with the driver using IRPs. I would like to start IrpTracker, launch the malware, and observe which IRPs it sends.
Are there any plans to add a feature that can automatically add new devices to the monitoring queue?
Rating:
28-Nov-09, michael hale
"RE: IrpTracker V2.18 on Windows7"
Version 2.19 now supports Windows 7
12-Nov-09, Scott Noone
"IrpTracker V2.18 on Windows7"
IrpTracker V2.18 doesn't work on Windows7 :(
Rating:
09-Nov-09, Gevorg Martirosyan
"Support for Win7?"
When IrpTracker v 2.18 is not working in Windows 7. :(
Rating:
09-Nov-09, Gevorg Martirosyan
"How about the suppor to for Windows 7?"
It would be great if you can add Windows 7 support. I have noticed the fact that you have noticed that the new Device Tree supports Windows 7 so, I know you are busy.
Rating:
10-Aug-09, Senthil Jayaraman
"Log to File"
Is is possible to redirect the output to a file rather than the display? I am trying to debug a multiple IRP bugcheck (44).
Thanks
Rating:
17-Jul-09, Juan Yanez
"No 64 bit support and no support for Windows 7"
It would be nice 64 bit is added and support for Win 7
Rating:
15-Jul-09, Senthil Jayaraman
"Win7"
Doesn't work with Win7. Hope you guys update to support it
Rating:
24-Jun-09, Jeff Myers
"No 64 bit support and Win 7"
I like this tool and use it often.
I maily use this tool along with Device Tree to understand how the driver stack is built and how the whole things add up. And some times I use it to debug. Though MS has become good at WDK documentation, it doesn't give a clear structure of the pnp/device stack when it comes to supporting a new device. Here is where I find irpTracker/Device Tree to be very useful, it fills the gap that is left behind by MS.
Thus it would be great if OSR adds support for new OS's when they are in their Beta stage so that it would allow us to explore changes in the new OS.
Windows 7 support and 64 bit support would make this a great tool.
Thanks, Senthil
Rating:
10-May-09, Senthil Jayaraman
"enabling "Display NTAPI Calls" makes system crash"
I'm running the irp tracker v2.18 under Vista. Whenever I enable the "Display NTAPI Calls", system goes to crash. Any idea about this?
Rating:
26-Mar-09, Matt Wang
"Command-line interface"
It will be greate thing to implement CMI for this tool!
Rating:
25-Nov-08, Andrey Prirez
"Available for x64?"
This is a great tool. Is there a version for X64 platform? Thanks.
Rating:
12-Nov-08, Yingping Lu
"Help files"
I downloaded this utility and it seems to work fine, but the help doesn't work. Help says "navigation to the web page was canceled: what you can try? Retype the address". Is it something I'm doing wrong?
Rating:
05-Nov-08, Greg Pearce
"good!good!"
thank you!this tool is very good!
01-Oct-08, yang jiansheng
"Not working on windows server 2008"
I got an error "unable to load device driver" when I ran this utility on w2k8.
08-Sep-08, Nitin Chhabra
"goog job"
Rating:
07-Aug-08, zhou jiamurong
"Logging irps from bootup"
Anyone know how to log the irps send to a specific device at boot time ?
Rating:
30-Jun-08, Smore Hung
"x64"
Is there also a port available for x64?
Rating:
19-Jun-08, W van 't Erve
"x64 version?"
Is there, or is there going to be, an x64 version of irptracker available? Need it for an Vista x64 issue.
18-Jun-08, Sean Walker
"IrpTracker"
Very-very nice tool :-)
Rating:
19-Apr-08, Sasha Pigovat
"Error - Unable to load device driver"
Downloaded AMD64 version to run on XP-64. Ran IrpTracker.exe - received message box: "Error""Unable to load device driver!"
Is there supposed to be some sort of IrpSys driver?
Thanks. MarkH
Rating:
05-Mar-08, Mark Holiday
"Error "Unable to load device driver""
Getting error "Unable to load device driver" with IrpTracker_V21_amd64 on system with Windows Server 2003 R2, X64, SP2.
Any suggesstions ?
Rating:
23-Nov-07, Varsha J
"Error on Win Vista Enterprise Edition"
I am getting the following error when i run it on Vista.
"Unable to load the driver". Can anyone help me out.
Thanks.
Rating:
28-Aug-07, Pawan Rathi
"Timestamps saved in log?"
Is it just me, or has anyone else noticed that the Timestamp displayed in the UI is not saved in the log file? If this is a bug (not just me), is there any possibility of a fix?
16-Jul-07, John Garrett
"Bug"
I could't run this utility on XP SP2. The first time I run this utility I gut this message Unable to load device driver! the next time I try to run it's reboot my system.
can any one help
Rating:
27-Dec-06, Mohammad Abo Hendy
"RE: IrpTracker V2.18 Error"
You need to be running an up to date version of Win2K (SP4+Hotfixes)
-scott
05-Dec-06, Scott Noone
"IrpTracker V2.18 Error"
IrpSys.sys cannot find insertion point for PsGetProcessImageFileName in ntoskrnl.exe (message box repeated two times)
Error Unable to load device driver! :(
I'm using Windows 2000 pro 5.00.2195 (italian Nls) with SP3 on a PIII (900MHz) machine. In the spare time, could you tell me what's wrong ? FLOC
For Love Of Completeness...thank in advance and best regards
29-Nov-06, Hackeronte de Bugger
"Great tool"
Great tool, but also win2k support at least would be really great!
Also letting the user chose the collums which get displayed (Time/call/IRP adr-seq Number, etc) would be appreciated. I would also like an option to show the process in the columns, like this I can see directly which process created it, in stead of double clicking on every irp
07-Aug-06, Jo Goossens
"amd64"
Repeatdly crash after I select my driver and start the HCT. It hangs on for 5 mnts and reboot the meachine.I'm running windows XP professional-64 SP1
28-Mar-06, Denny Jose
"Filter by process name"
The tool is great. I was wondering whether it is possible to filter the irptracker by process name or id.
Rating:
15-Feb-06, eran borovik
"UI suggestions"
First, it is great tool. Thanks for it.
I'd suggest few user interface improvements. Yes, I know, user mode and even GUI work ;-)
- remember size of collums so it isn't necessary to set it again and again after every start
- remember size and position of IRP details dialog so it isn't necessary to resize it whewever displayed
- add Next and Previous buttons to IRP details dialog so one can browse through IRP list faster and more convenient way
- automatically highlight related CompRoutine line for Call and vice versa if available. It should be probably optional. More complicated but better would be DbgView-like highlight filters.
- add searching
Thanks.
Rating:
13-Oct-05, Michal Vodicka
"IrpTracker on win2003 SP1"
Nice tool, use it on win2003 system, wasn't able to run it on win2003 SP1 I got "Unable to initialize device driver!"
Rating:
23-May-05, Radu Vines
"IRPTracker for Win98SE"
Ah...there *may* be, but it surely wouldn't be something developed by OSR.
17-Nov-04, Daniel Root
"RE: Filesystem driver objects"
Hi,
Yup, you're right, it's only checking the \Driver\ namespace. I'll get this fixed in the next release. Thanks!
-scott
03-Sep-04, Scott Noone
"Filesystem driver objects"
I can't get output for newly created device objects for file system drivers. Probably IrpTracker scans only Driver Object Manager subdirectory. Could you add scanning for file system drivers in FileSystem subdirectory in such case?
Rating:
03-Sep-04, Oleksiy Shatylo
"How to enumerate the Driver tree"
What API's are used to enumerate the driver tree as in which drivers are present in what stacks on the system. The tool is a great one..
Rating:
21-Jun-04, Sunil Pandita
"RE: Port to NTV4 or Win2K?"
Nope.
Absolutely no plans, ever, to make this run on NTV4.
If there were enough people who begged, pleaded, and whined we might consider a Win2K port. Maybe. But that's definitely not in our current plans, and would require SNoone to be in a particularly good mood and have nothing more pressing to do.
Sorry, but ports of this utility to down-rev platforms would require real work.
18-Mar-04, Peter Viscarola
"Support for legacy OS's"
Any plans to port this for NT4 or Win2K?
Rating:
18-Mar-04, Delmont Fredricks
"IrpTracker"
Is there any utility like this for Win2K?
03-Mar-04, Steve Jones
"Selecting a Device"
This is a great utility. I like that fact that it does not disturb the PnP Manager.
To be useful in what I'm doing at the moment, I would need a way to select a device that I know is going to be plugged into the PC so that PnP IRPs occuring because of a new event could be monitored. If that is possible now, I don't know how to do it.
Rating:
12-Aug-03, David Voeller
|
|
