What's the best way to spy on IOCTLs?

Question

I have a U9 Telit modem which, at first, appears as a disk drive on USB bus. Then, the native software after autorun and install, sends a couple of IOCTLs to tell the device to reappear as other things. I can see them in procmon.

I want to better spy on these, to know exactly what they send and how, in order to do the same in proper way.

score 1 · Answer 1 · answered Jul 12 '10 at 18:41

1

Try something like Systemtap. Attach a probe that dumps all ioctls and arguments from the kernel, grep through them.

answered Jul 12 '10 at 18:41

user318904

2,968
4
28
37

Anything for platform Windows? – Pavel Radzivilovsky Jul 13 '10 at 06:01
1

Ah Windows, I have no idea. I didn't even know they had them. – user318904 Jul 13 '10 at 19:18

score 0 · Answer 2 · edited May 23 '17 at 12:20

You could use something like strace under linux. The windows equivalent is discussed here Systrace for Windows. This might show you the ioctl commands sent.

Some companies offer the linux kernels of their devices as direct download from their official webpage. There you might find more information on how it works. For some devices, it's easy to build and deploy your own kernel. This helps as you can add custom debug output.

What's the best way to spy on IOCTLs?

2 Answers2