/debugview

Driver IOCTLs and Buffer Formats

Reference documentation for the Dbgv.sys kernel driver interface used by DbgViewCli.

Device Identity

IOCTL Commands

All IOCTLs use CTL_CODE(FILE_DEVICE_DBGMON, function, method, access).

Buffer Structures

STORE_BUF — Driver Output Buffer

The driver accumulates debug messages in a linked list of STORE_BUF pages.

#define NUM_STORE_PAGES  1
#define MAX_STORE        (PAGE_SIZE * NUM_STORE_PAGES - 4 * sizeof(ULONG))
#define STORE_SIGNATURE  0xFEADDEAF

#pragma pack(1)
typedef struct _store {
    ULONG           Signature;       // Must be STORE_SIGNATURE
    ULONG           UpdateSequence;  // Incremented on each write
    struct _store * Next;            // Pointer to next buffer in chain
    ULONG           Len;             // Bytes used in Data[]
    char            Data[MAX_STORE]; // Packed ENTRY records
} STORE_BUF, *PSTORE_BUF;
#pragma pack()

Size: STORESIZE = ((sizeof(STORE_BUF) + 0xFFF) / 0x1000) pages

STORE_BUF_DUMP64 — 64-bit Crash Dump Variant

For reading driver buffers from 64-bit crash dumps (pointer width differs):

#pragma pack(1)
typedef struct _store_dump64 {
    ULONG           Signature;       // STORE_SIGNATURE
    ULONG           UpdateSequence;
    ULONGLONG       Next64;          // 8 bytes (64-bit kernel pointer)
    ULONG           Len;
    char            Data[MAX_STORE];
} STORE_BUF_DUMP64, *PSTORE_BUF_DUMP64;
#pragma pack()

ENTRY — Individual Debug Output Record

Each entry in Data[] is packed sequentially:

#pragma pack(1)
typedef struct {
    ULONG           seq;        // Sequence number
    LARGE_INTEGER   datetime;   // File time (100ns since 1601-01-01)
    LARGE_INTEGER   perftime;   // Performance counter value
    char            text[0];    // Null-terminated message string
} ENTRY, *PENTRY;
#pragma pack()

Walking entries: Advance by sizeof(ENTRY) + strlen(entry->text) + 1, aligned as needed. Validate that the next entry start does not exceed Data + Len.

WIN32OUTPUT — Win32 Shared Memory Record

Used for DBWIN shared-memory capture (OutputDebugString):

typedef struct _win32rec {
    struct _win32rec * next;       // Linked list pointer
    ULONG              sequence;   // Sequence number
    LARGE_INTEGER      time;       // Timestamp
    LARGE_INTEGER      perftime;   // Performance counter
    char               text[];     // Flexible array — null-terminated message
} WIN32OUTPUT, *PWIN32OUTPUT;

CLIENT_RESOLUTION — Timer Resolution

Shared between service and GUI/CLI for timestamp calibration:

typedef struct {
    LARGE_INTEGER   TimerResolution;
} CLIENT_RESOLUTION, *PCLIENT_RESOLUTION;

Win32 DBWIN Shared Memory Protocol

DbgViewCli captures OutputDebugString by creating these named objects:

Protocol:

1. Create the section and events with appropriate security descriptors
2. Signal DBWIN_BUFFER_READY to indicate buffer is available
3. Wait on DBWIN_DATA_READY — signaled when a process calls OutputDebugString
4. Read PID (first 4 bytes) + message text from the shared section
5. Signal DBWIN_BUFFER_READY again for the next message

Boot Logging Registry Configuration

When boot logging is enabled, the driver loads at boot:

The driver binary must be copied to %SystemRoot%\System32\Drivers\ before enabling.