Enable Wpp for Minifilter Driver

Scoot3r · Apr 29, 2021

Hi,
I wanna enable wpp tracing for my first minifilter driver,
i do that on normal driver but for minifilter i can't find any sample
how can i enable this feature ?
thank you

Scoot3r · Apr 29, 2021

Hi again
i finally SOLVED it
but i have another problem
how can use unicode string to wpp tracing?
i mean like this :>
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, &Data->Iopb->TargetFileObject->FileName); // got error

x BlueRobot · Apr 30, 2021

What is the error message that you're receiving?

Scoot3r · Apr 30, 2021

Error wpp Parsing "&Data->Iopb->TargetFileObject->FileName", cannot find format string (i even add %wZ but i'm not sure is correct for some situation)
i trying search for find a sample but

x BlueRobot · Apr 30, 2021

Have you inspected the value of that string?

Scoot3r · Apr 30, 2021

UNICODE STRING and i use kdprint with that format string

x BlueRobot · Apr 30, 2021

Could you please provide what values you've passed to the fields of the unicode string structure? Is the structure initialised?

Scoot3r · Apr 30, 2021

this is my unicode string &Data->Iopb->TargetFileObject->FileName
this is correct ?
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "File Name: %wZ", &Data->Iopb->TargetFileObject->FileName);

x BlueRobot · Apr 30, 2021

That's the pointer to the object, what is the actual unicode string structure initialised to?

x BlueRobot · Apr 30, 2021

Scoot3r said:
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "File Name: %wZ", &Data->Iopb->TargetFileObject->FileName);

I've just noticed that you've changed the arguments you've passed in from your last example. For your third parameter, I would advise using the predefined formatting strings, see if that makes a difference.

Scoot3r · Apr 30, 2021

x BlueRobot said:
I've just noticed that you've changed the arguments you've passed in from your last example. For your third parameter, I would advise using the predefined formatting strings, see if that makes a difference.

yes, i read it but i can't find sample for my situation

edit:
i finally see some example
microsoft/Windows-driver-samples

x BlueRobot · May 2, 2021

Glad you were able to find something useful.

Search

Search

Enable Wpp for Minifilter Driver

Scoot3r

Member

Scoot3r

Member

x BlueRobot

Administrator

Scoot3r

Member

x BlueRobot

Administrator

Scoot3r

Member

x BlueRobot

Administrator

Scoot3r

Member

x BlueRobot

Administrator

x BlueRobot

Administrator

Scoot3r

Member

x BlueRobot

Administrator