Question about stealth methods

[LordCrush]

The bad is that i don't get any msg in DebugView so far. I have written a little usermode pgm with DebugPrint, i can see the debugoutput, but not from the driver.

when i call the driver i only get Error code 87 (GetLast ErrorCode)

i assume the driver is dooing nothing ...

[gawker]

Thanks for all the help. Got it working this weekend!

[fester]

Lord Crush,

My understanding is that if you use kernel debugs, you need to have a debugger attached to your kernel via a serial port (running on another machine) *OR* you need XP to debug locally (mentioned above).

I didn't bother with this, and just assigned certain values in the pIOBuffer and had my userland program understand these error codes.

[LordCrush]

from lostinspace

Another, maybe even better option, is to use OutputDebugString in kernel driver to send your debug messages at various places in your driver code, and to use DebugView from SysInternals to watch those messages

Hmm is that function really called OutputDebugString ?


/shrug ... will keep on trying ..

[lostinspace]

Function is not called OutputDebugString. It is one i used in last example, called DbgPrint. It has declaration in ntifs.h i think. It is possible that there is some other function with same name, but i used DbgPrint and it worked.

And no, you dont have to be in any debbuging kernel mode for that to work, DebugView will show it. Only situation when DbgView will not show debug message is when another debugger is attached to executable.

[LordCrush]

Thank you for clarify ... i will work on getting any debug messages out of the driver.
But i have not much free time to fool around with this - kids want to play with daddy

Thanks again for answer ... i am gaining hope again, to get it to work someday