windows-8.1wdksysinternalsminifilterdebugview

Viewing DbgPrint messages in Windows 8.1


I'm trying to write a MiniFilter driver. I've got Visual Studio 2013 Update 3 and WDK up and running on my Windows 8.1 box, along with a template from MS installed called "Filter Driver: Filesystem Mini-filter". I've made a fresh project with this template, enabling deployment to a remote (on my LAN) 8.1 VM with a small batch file to install the driver in lieu of the built-in driver installer (which I think isn't supported yet for minifilters).

In this template, there are many debug statements which are typedef'd to a call to DbgPrint. I would really like to be able to view these in DebugView from the SysInternals suite. Apparently all I needed to do would be to create in the registry a DWORD called DEFAULT set to 0xF under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter according to http://msdn.microsoft.com/en-us/library/windows/hardware/ff551519(v=vs.85).aspx. But still, nothing shows up in DebugView. I launched it as an admin on the VM, and disabled capturing Win32.

I would assume the deployment tool from the WDK would have set up kernel debugging properly (it created a second user on my VM called WDKRemoteUser and ran BCDEdit /debug for me), but it doesn't seem to be enough. Any ideas?


Solution

  • I believe that the issue is the test machine must be started with a debugger waiting to attach to it. When I do that, the kernel messages show up in the Visual Studio debugger and I assume in DebugView, too.