Home

IRPMon is a software that allows the user (meaning you) to monitor communication between applications and device drivers, and between device drivers themselves. The project can be viewed as an alternative to IrpTracker from OSR Online. Certain drawbacks of IrpTracker were actually the reason why it was decided to develop IRPMon.

IRPMon can be used to monitor the following means of communication:

• I/O request packets (IRPs),
• fast I/O dispatch routines,
• start I/O,
• the AddDevice routine,
• the DriverUnload routine.

IrpTracker is only capable of IRP monitoring. IRPMon also beats it in the following areas:

• 64-bit compatibility. IRPMon runs on 64-bit versions of Windows and should not conflict with Kernel Patch Protection (Patchguard) if used with caution. No inline hooks are performed, only callback pointers are modified.
• Open source. IRPMon source code is freely available on GitHub under the MIT license. Basically, you can download and use the code how at will.
• Monitoring non-existent objects. IRPMon can be configured to watch for the appearance of certain PnP drivers, or automatically report communication targeted at device objects that do not exist in the time of the configuration. This feature allows you to monitor what happens when you connect a Plug&Play device to your computer.
• Dynamic. IRPMon driver can be dynamically unloaded from the system, although this operation may be dangerous and is not recommended in general. All depends on what drivers and devices are being monitored.