Discussion Overview
The discussion revolves around monitoring API calls from a program (Z.exe) to a driver (Y.sys) that contains a specific function (foo()). Participants explore methods to intercept these calls and identify the function being invoked, particularly when it is not part of standard Win32 library calls.
Discussion Character
- Technical explanation
- Debate/contested
- Experimental/applied
Main Points Raised
- One participant inquires about methods to monitor calls from Z.exe to the driver Y.sys and specifically return the name of the function foo().
- Another participant suggests placing a debugger breakpoint at the start of foo() to monitor its invocation, although they express uncertainty due to lack of experience with driver debugging.
- A participant clarifies that they did not write the driver themselves and are looking to modify a specific function within it.
- There is a suggestion that if the source code is available, building the project in a debugger with a breakpoint could be a viable approach.
- One participant mentions that there used to be methods using Windows debuggers to achieve this, questioning if those methods are still supported and providing a link to Microsoft’s debugging tools.
- Another participant expresses confidence that the debuggers are still supported, despite uncertainty about the current methods.
Areas of Agreement / Disagreement
Participants express varying levels of familiarity with debugging drivers, and while some suggest practical approaches, there is no consensus on the best method to monitor the API calls or the current state of debugging tools.
Contextual Notes
There are limitations regarding the availability of source code and the specific capabilities of current debugging tools, which remain unresolved in the discussion.
Who May Find This Useful
This discussion may be useful for developers working with USB device drivers, those interested in debugging techniques, and individuals looking to modify existing driver functions.