How to understand the internal working of NDIS Miniport driver

Question

I am new to Window driver development.

I am trying to understand the working of a NDIS miniport driver (from Microsoft WDK samples). Especially, to understand the packet flow.

As per numerous sources, I have seen suggestions of installing two instances of NDIS miniport driver and proceed from there. However, I am unable to continue from there, as there is only vague info. Please advise - Especially on how to attach a Windows Debugger Tool to an instance of the driver and to see the callbacks being called on sent/receive packets.

My platform: Windows 7 x64 with debug mode set (Debugging Setup: Single Computer).

There is a similar question. But no info about how to debug the driver: NDIS and miniport driver

Answer 1

You can't debug on the same machine in which you are running the driver, you need to use remote machine, that could be a "Real" one or as done usually a VirtualMachine.

Here how to setup a Windows Kernel Debugging environment with a Virtual Machine:

https://msdn.microsoft.com/en-us/library/windows/hardware/ff538143%28v=vs.85%29.aspx

Answer 2

Best way to understand driver internals of driver is to use WPP tracing in driver to print messages and view using traceview.exe. Or using dbgprint() to print messages and these messages are viewed using dbgview.

https://msdn.microsoft.com/en-us/library/windows/hardware/ff556204(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/hardware/ff543632(v=vs.85).aspx