0009:trace:ntoskrnl:NTOSKRNL_connect Connecting to ntoskrnl 0009:trace:ntoskrnl:NTOSKRNL_connect Trying to start ntoskrnl 000f:trace:ntoskrnl:add_driver jwstolk_3(0 20 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 34 ), semi-stub 000f:trace:ntoskrnl:IoCreateDevice (0x4074fe20, 0, L"\\??\\ntoskrnl_ctrl", -1, 0, 0, 0x4074fe14) 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 24 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 184 ), semi-stub 000f:trace:ntoskrnl:IoCreateDevice Created device with handel 0x20 000f:trace:ntoskrnl:find_driver jwstolk_5DEVICE_OBJECT(0x401fcac0) Type=0 Size=0 refcount=0 0009:trace:ntoskrnl:NTOSKRNL_connect Connected to ntoskrnl (0xc0) 000f:trace:ntoskrnl:driver_control jwstolk_2Handling IoContorl, handle is 0x20, ioctl: ff4007, in_size: 0x78,out_size: 0x0 000f:trace:ntoskrnl:find_device jwstolk_7(0 0 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 120 ), semi-stub 000f:trace:ntoskrnl:driver_control calling driver @ 0x406226f4 000f:trace:ntoskrnl:ntoskrnl_ioctl Got internal ioctl. Buffer: L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\CdaC15BA" 000f:trace:ntoskrnl:ExAllocatePoolWithTag (1 16 ), semi-stub 000f:trace:ntoskrnl:ExFreePool (0x401fcc18) 000f:trace:ntoskrnl:ExAllocatePoolWithTag (1 94 ), semi-stub 000f:trace:ntoskrnl:find_driver jwstolk_5000f:Call ntdll.RtlInitUnicodeString(4074fba8,4020d22c L"c:\\windows\\system32\\drivers\\CDAC15BA.SYS") ret=40622991 000f:trace:ntoskrnl:ExFreePool (0x4020d220) 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 168 ), semi-stub 000f:trace:ntoskrnl:add_driver jwstolk_3(0 20 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 120 ), semi-stub 000f:trace:ntoskrnl:IoCreateDevice (0x4020d220, 0, L"\\Device\\CdaC17BA", 51712, 0, 0, 0x407523a0) 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 24 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 184 ), semi-stub 000f:trace:ntoskrnl:IoCreateDevice Created device with handel 0x28 000f:trace:ntoskrnl:find_driver jwstolk_5DEVICE_OBJECT(0x4020d4e8) Type=0 Size=0 refcount=0 000f:trace:ntoskrnl:IoCreateSymbolicLink (L"\\DosDevices\\CdaC17BA" -> L"\\Device\\CdaC17BA") 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 24 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (1 36 ), semi-stub 000f:trace:ntoskrnl:IoCreateDevice (0x4020d220, 0, L"\\Device\\CdaC15BA", 61184, 0, 0, 0x40752140) 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 24 ), semi-stub 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 184 ), semi-stub 000f:trace:ntoskrnl:IoCreateDevice Created device with handel 0x34 000f:trace:ntoskrnl:find_driver jwstolk_5DEVICE_OBJECT(0x4020d650) Type=0 Size=0 refcount=0 000f:trace:ntoskrnl:IoCreateSymbolicLink (L"\\DosDevices\\CdaC15BA" -> L"\\Device\\CdaC15BA") 000f:trace:ntoskrnl:ExAllocatePoolWithTag (0 24 ), semi-stub 000f:trace:ntoskrnl:driver_control returned from call with status 00000000