IRP Driver & Agent — Buffered I/O Communication

A Windows kernel driver and user-mode agent that demonstrates IRP (I/O Request Packet) communication using Buffered I/O. Messages are sent from user space through the driver and printed to DebugView (DbgView) via DbgPrint.

---

📁 Project Structure

IRP-DRIVER-AGENT/
├── DRIVER/          # Kernel-mode driver (WDM)
├── Agent/           # User-mode agent application
├── IRP-DRIVER-AGENT.sln
└── .gitignore

---

🔧 How It Works

[ Agent (User Mode) ]
        |
        |  DeviceIoControl / WriteFile
        ↓
[ Windows I/O Manager ]
        |
        |  IRP (I/O Request Packet)
        ↓
[ Kernel Driver (DRIVER) ]
        |
        |  DbgPrint()
        ↓
[ DebugView Output ]

1. The Agent sends a message to the driver using DeviceIoControl or WriteFile
2. The I/O Manager packages the request into an IRP and dispatches it to the driver
3. The Driver handles the IRP, reads the buffered data, and prints it via DbgPrint
4. Output is visible in DebugView (DbgView)

---

🚀 Getting Started

Prerequisites

• Windows 10/11
• Visual Studio 2019 or later
• Windows Driver Kit (WDK) — matching your VS version
• DebugView (Sysinternals)
• Test signing enabled OR a VM with kernel debugging

Build

1. Open IRP-DRIVER-AGENT.sln in Visual Studio
2. Set configuration to Debug / x64
3. Build the solution — both DRIVER and Agent projects

Enable Test Signing (for loading unsigned driver)

Run in an elevated CMD:

bcdedit /set testsigning on

Then reboot.

Load the Driver

sc create IRPDriver type= kernel binPath= "C:\path\to\DRIVER.sys"
sc start IRPDriver

Run the Agent

Agent.exe

Open DebugView as Administrator with Kernel Capture enabled — you should see the printed messages.

---

📖 Key Concepts

Concept	Description
IRP	I/O Request Packet — the core data structure Windows uses for driver communication
Buffered I/O	Data is copied to/from a kernel buffer managed by the I/O manager — safer than Direct I/O
DbgPrint	Kernel-mode function to output debug strings, visible in DebugView
DeviceIoControl	Win32 API used by the agent to send custom control codes to the driver
DriverEntry	Kernel driver entry point, equivalent to main()
IRP_MJ_WRITE	IRP major function code for write operations

---

⚠️ Disclaimer

This project is for educational purposes — learning Windows kernel internals, IRP handling, and driver/agent communication patterns. Always test kernel drivers in a VM to avoid system crashes (BSODs).

---

📚 Resources

• Windows Driver Kit Docs
• IRP Overview
• Buffered I/O
• DebugView

---

👤 Author

EynaExp — github.com/EynaExp