IRPMon v1.0 Release Candidate 3

v1.0-rc3

[gui]: Mark Hyper-V as not implemented

IRPMon v1.0 Release Candidate 2

v1.0-rc2

Merge branch 'sample/kbdclass'

v1.0 Release Candidate

See the IRPMon v1.0 RC milestone for quite an incomplete list of fixes and enhancements.

IRPMon v0.9

What is new:

• Capture file names
• Log data associated with the requests
  • IRPs only
  • read, write, ioctl, pnp, query/set information...
  • turned off by default since it may be dangerous (turn it on by checking the Data item in the context menu)
  • displayed in the Request Details* form
• Custom data parsers
  • displays data associated with individual formats in reasonable form
  • are simple DLLs, kind of a plugin interface (i.e. you may write your own)
  • currently only hexadecimal view and security descriptor view are available
• binary logs
  • as counterpart to the text one
  • can be loaded on different machine (with the same architecture as the original)
  • to save a long in binary format, select the .bin extension in the save dialog
• Request filtering and higlighting
  • similar to Process Monitor
  • can be applied to both live capture and loaded binary logs

Since this is a pre-release/beta, I did not update the documentation yet, however, there was not much of GUI changes, so the application may still look familiar to you. I would greatly appreciate any bug reports and other feedback.

Drivers are digitally signed by my latest certificate, so IRPMon should run correctly on all PCs expect those with Secure Boot enabled.

IRPMon v0.8

This is the first release with the signed driver. The driver, however, did not go through the attestation signing, so you may experience problems when using IRPMon on freshly installed post-Anniversary Update versions of Windows 10 booted with Secure Boot.

The irpmnconsole program is not part of the release, since it starts being deprecated by now. The GUI application and the documentation may change quite a bit during the future releases. I hope not to touch the driver too much until post-1.0 release.

IRPMon Beta #1

The first beta version of the project. Binaries are not signed, documentation is included. The release contains only the GUI application and the driver, not the console one, since that is now quite obsolete.