Windows内核IRP挂钩

Question

为什么在插入/拔出/使用各种USB设备时我仅看到IRP_MJ_PNP事件？

绝大多数是一些

IRP_MJ_PNP - IRP_MN_QUERY_CAPABILITIES

使用here中的工具

我正在挂接这些设备/驱动程序：

{
Reference count: 6
BLUETOOTH
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\BTHUSB

Reference count: 2
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\RtkBtFilter

Reference count: 1
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\ACPI

Reference count: 11
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBHUB3
\Device\USBPDO-3
}
Last error g: 0Last error h: 0Last error i: 01 : DEVICE LIST : STACK
{
Reference count: 4
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBHUB3

Reference count: 1
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\ACPI

Reference count: 8
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBXHCI
\Device\USBPDO-0
}
Last error g: 0Last error h: 0Last error i: 02 : DEVICE LIST : STACK
{
Reference count: 4
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\USBXHCI
\Device\USBFDO-0

Reference count: 1
ACPI
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\ACPI

Reference count: 7
UNKNOWN
DEVICE_SECURE_OPEN
Dispatch table: 1111111111111111111111111111
\Driver\pci
\Device\NTPNP_PCI0003
}

通过枚举GUID_CLASS_USB_DEVICE的前4个父级来获得

Dispatch table: 1111111111111111111111111111表示所有28个IRP都标记为挂机。

也许还有其他我可以检查的挂钩IRP的工具？