Posts
  • The NDIS blog

    Using C++ in an NDIS driver

    • 0 Comments
    Are NDIS drivers allowed to use C++? The first question is easy: can NDIS drivers be written in C++?  The answer: yes.  In this case, NDIS doesn’t have any official stance on C++, so we just fall back on the WDK’s general rules.  As of...
  • The NDIS blog

    Using WDF in an NDIS driver

    • 0 Comments
    Can, Should, and How? WDF is a framework that makes it easier to write Windows drivers.  NDIS is a framework for writing low-level Windows network drivers.  The purposes of these frameworks overlap a bit, and some people (okay, probably many...
  • The NDIS blog

    The NDIS API naming convention

    • 0 Comments
    NdisFWhat?  Your secret decoder ring to NDIS functions The first time you come across NDIS, you might find yourself lost in the enormous number of NDIS APIs, OIDs, status codes, and data structures.  What’s the difference between NdisMIndicateStatus...
  • The NDIS blog

    Using the checked version of NDIS.SYS

    • 0 Comments
    I assert that this is a good way to find bugs Installing the checked version of the operating system is an effective technique to quickly find bugs in your network driver.  If you’re not familiar with checked builds (and even if you are), you should...
  • The NDIS blog

    NdisFRegisterFilterDriver fails… now what?

    • 0 Comments
    Decoding the error codes “I compiled my NDIS filter driver, but NdisFRegisterFilterDriver fails in my DriverEntry function.  Now what?” Here’s a table listing common problems and fixes.  Rows are grouped by symptom. Problem Resolution NDIS_STATUS_BAD_CHARACTERISTICS...
  • The NDIS blog

    Kernel debugging over the network

    • 0 Comments
    What just happened to my NIC?! We’ve previously published some tips on how to use the debugger to fix your NDIS miniport driver. But today we’re going to turn the tables and talk about how the debugger uses NDIS to break your miniport driver. You...
  • The NDIS blog

    Why is there a redundant Restart-NetAdapter cmdlet?

    • 0 Comments
    Sometimes you can’t just Enable your way out of a Disable mess Windows 8 and Windows Server 2012 include a whole set of new PowerShell cmdlets to manage the network stack. These cmdlets include Enable-NetAdapter and Disable-NetAdapter . Believe it...
  • The NDIS blog

    Thanks for your help making Windows great!

    • 3 Comments
    Really, it’s all about self-interest Remember way back when you first set up your new computer?  Windows probably prompted you to “join the Customer Experience Improvement Program”.  For those of you who elected to join this program: thanks...
  • The NDIS blog

    Making minidumps more useful

    • 3 Comments
    Miniport: meet minidump Minidumps are a small (~100kb) record of a crash.  As their name suggests, they’re optimized for small size… at the expense of usefulness.  Minidumps include just enough information to see the stack of the faulting thread...
  • The NDIS blog

    Summary of packet-tracking techniques

    • 0 Comments
    Tracking the packet tracking We just covered a couple ways to track packets in the kernel debugger.  Here’s a quick reference table to help you understand how these techniques fit into your toolbelt.   !ndiskd.pendingnbls !ndiskd.nbl -log Documentation...
  • The NDIS blog

    !ndiskd.nbl -log

    • 0 Comments
    All your NBL are belong to !ndiskd Last time we talked about !ndiskd.pendingnbls .  This command shows you which component currently holds an NBL.  But what if you want to see how the NBL got there?  That sounds like a job for !ndiskd.nbl...
  • The NDIS blog

    !ndiskd.pendingnbls

    • 0 Comments
    I’ve got your NBLs right here The most common issue we see in NDIS drivers is a “lost packet”.  You have lost a packet when NDIS gives your driver a NET_BUFFER_LIST (NBL) and your driver never returns the packet back to NDIS.  A lost packet...
  • The NDIS blog

    WMI events

    • 1 Comments
    Smarter than polling Suppose you want to know if a network adapter is connected. If you read our last WMI blog post , you're already clever enough to solve this handily: just query MSNdis_LinkState and execute the WmiQueryLinkState method. This is...
  • The NDIS blog

    Exploring NDIS’s WMI classes

    • 5 Comments
    Getting fancy with PowerShell and WMI Last time we got our feet wet with a simple PowerShell script to query Ethernet MAC addresses. It looked easy, but of course, it requires you to know the magic WMI class name "MSNdis_EthernetCurrentAddress". How...
  • The NDIS blog

    TMF download page

    • 0 Comments
    Are you targeting Windows 8 or Windows Server 2012?  You don't need anything from here!  These operating systems already include all the TMFs you'll need in the PDB from the Microsoft Symbol Server. For Windows 7 and Windows Server 2008 R2,...
  • The NDIS blog

    WPP and KD

    • 1 Comments
    Industrial-strength tracing in an industrial-strength debugger Last time we talked about controlling WPP from the command-line.  This is great if you need to send instructions to a customer to collect logs, or if you want to automatically enable...
  • The NDIS blog

    Diagnostics with WPP

    • 1 Comments
    Industrial-strength tracing WPP is similar to DbgPrint. In fact, for NDIS.SYS, WPP and DbgPrint trace exactly the same messages. However, WPP is easier to enable and works on retail versions of NDIS.SYS. These advantages mean that WPP can be enabled...
  • The NDIS blog

    Diagnostics with Event Viewer

    • 0 Comments
    Tracing made easy Starting with Windows 7 and Windows Server 2008 R2, NDIS can be configured to emit certain diagnostic information to the event log.  The event log is very easy to use, and it doesn't require any special tools.  It's especially...
  • The NDIS blog

    Diagnostics tools in NDIS

    • 0 Comments
    Evolving beyond DbgPrint I'd like to take a break from our series on WMI (don't worry -- more WMI is coming soon!) to respond to a recent discussion in the community. Traditionally , we've used DbgPrint to debug NDIS issues. This is convenient, since...
  • The NDIS blog

    PWN* your network adapter

    • 0 Comments
    *PWN = PowerShell, WMI, and NDIS WMI is frequently misunderstood. WMI is a large collection of technologies designed to help you manage computers. Most commonly, you'll see IT pros using WMI (usually via VBScript) to do something funky across their...
  • The NDIS blog

    Debugging with NDISKD

    • 2 Comments
    Chapter three of a beginner’s guide to debugging with NDISKD In Part 1 of the series , we set up a kernel debugger. In the second installment , we took a closer look at ndiskd’s output for miniports. Today, we will use what we know to debug...
  • The NDIS blog

    NDISKD and !miniport

    • 0 Comments
    The second installment of a beginner’s guide to debugging with NDISKD Last time we set up the debugger, looked at !ndiskd.help , and dumped out a table of active miniports. Today we’ll continue our laboratory by examining a specific miniport...
  • The NDIS blog

    Getting started with NDISKD

    • 0 Comments
    Part 1 of a beginner’s guide to debugging with NDISKD If you haven’t already, grab the updated WDK with its new ndiskd debugger extension . You’ll need it for today’s laboratory exercise: getting started with ndiskd. If you...
  • The NDIS blog

    [Re]Introducing NDISKD

    • 0 Comments
    Over a decade of making NDIS developers dangerous Today we released a new version of the WDK.  This release has an updated version of the debuggers, including an overhauled version of ndiskd. Ndiskd is a debugger extension written by the NDIS team...
  • The NDIS blog

    The difference between a miniport and a miniport driver

    • 0 Comments
    A grammatical kinship between NDIS and tennis If you've ever programmed a WDM driver, you're probably familiar with the difference between a DRIVER_OBJECT and a DEVICE_OBJECT. In NDIS, we also differentiate between a driver and a running instance created...
Page 1 of 2 (32 items) 12