What's the best way to spy on IOCTLs?

Question

I have a U9 Telit modem which, at first, appears as a disk drive on USB bus. Then, the native software after autorun and install, sends a couple of IOCTLs to tell the device to reappear as other things. I can see them in procmon.

I want to better spy on these, to know exactly what they send and how, in order to do the same in proper way.

Answer 1

Try something like Systemtap. Attach a probe that dumps all ioctls and arguments from the kernel, grep through them.