Why am i only seeing IRP_MJ_PNP events upon plugging / unplugging / using various USB devices ?
The vast majority are some
IRP_MJ_PNP - IRP_MN_QUERY_CAPABILITIES
Using the tool from here
I am hooking these devices / drivers:
{
Reference count: 6
BLUETOOTH
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\BTHUSB
Reference count: 2
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\RtkBtFilter
Reference count: 1
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\ACPI
Reference count: 11
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBHUB3
\Device\USBPDO-3
}
Last error g: 0Last error h: 0Last error i: 01 : DEVICE LIST : STACK
{
Reference count: 4
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBHUB3
Reference count: 1
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\ACPI
Reference count: 8
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBXHCI
\Device\USBPDO-0
}
Last error g: 0Last error h: 0Last error i: 02 : DEVICE LIST : STACK
{
Reference count: 4
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBXHCI
\Device\USBFDO-0
Reference count: 1
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\ACPI
Reference count: 7
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\pci
\Device\NTPNP_PCI0003
}
Which are obtained by enumerating the first 4 parents of GUID_CLASS_USB_DEVICE
Dispatch table: 1111111111111111111111111111 signifies that all of the 28 IRPs are marked for hooking.
Maybe there is some other tool for hooking IRPs that I can check against ?