Member Avatar for programmingman

I want to write code to see what applications access device drivers on my computer. The drivers are disk, display, audio, keyboard, etc. Can someone introduce me on how to do this?

  • 3 Contributors
  • 2 Replies
  • 123 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by manofprogram

Dani AI

Generated

— as and pointed out, the OS determines the right approach. Broadly there are two paths: quick, user‑mode inspection with existing tools; or deeper, programmatic/kernel inspection that requires drivers or kernel tracing.

On Windows start with Sysinternals tools: Process Monitor (for file/device I/O) and Handle (to list which processes have open handles to device names). These are fast ways to see which processes touch disk/display/audio device objects (Process Monitor, Handle). For higher‑volume or production tracing, use Event Tracing for Windows (ETW) to capture kernel I/O events (ETW overview). If full visibility into IRPs/IOCTLs is required, the supported route is a kernel filter driver (minifilter for file/disk scenarios) using the Windows Driver Kit; see the Filter Manager docs and WDK guidance (). Caveat: kernel drivers need signing, admin privileges, and can destabilize the system. For audio-only needs, user‑mode Core Audio APIs can enumerate audio sessions and map them to process IDs ().

On Linux and macOS, the usual first step is enumerating open device nodes with lsof or by scanning /proc/*/fd. Example:

lsof /dev/input/*      # which processes have keyboard devices open
lsof /dev/snd/*        # which processes use audio devices

For syscall-level tracing (ioctl, open) use auditd or eBPF tools (bpftrace, bcc) to trace sys_enter_ioctl or open/vfs hooks system-wide. macOS offers lsof and DTrace/bpf but is subject to SIP and privilege limits.

Suggested workflow: decide OS and exact device class, reproduce the activity with Process Monitor/lsof/handle, escalate to ETW/eBPF for system tracing, and only write a kernel filter driver if capturing IRP/IOCTL contents is indispensable.

Recommended Answers

All 2 Replies

Member Avatar for L7Sqr

In general, these things are highly coupled with your OS - what OS are you using?

Member Avatar for manofprogram

Are you using Windows XP, 7, or 8?

Edited by manofprogram
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.