protected void InitializeDriver() { FILTER_INFO filterInfo; driver = NtTdiApi.OpenFilterDriverW(NtTdiApi.NTTDIDR_DRIVER_NAMEW); if (driver == 0) { throw new Exception("Cannot open driver"); } uint driverVersion = NtTdiApi.GetDriverVersion(driver); if (driverVersion != NtTdiApi.NTTDIDR_DRIVER_VERSION) { throw new Exception("Unsupported driver version"); } buffer = Marshal.AllocHGlobal(new IntPtr(bufferSize)); if (buffer == IntPtr.Zero) { throw new Exception(string.Format("Cannot allocate {0} bytes", bufferSize)); } NtTdiApi.SetLoggingState(driver, 1); filterInfo = new FILTER_INFO(1, NtTdiApi.EVENT_MASK_FULL, NtTdiApi.FLT_ACTION_LOG, 0, 0x00000000, 0x00000000, 0, 0xFFFF, PROTOCOL.PROTOCOL_ANY, 0, 0xFFF); NtTdiApi.RemoveAllFilters(driver); if (!NtTdiApi.AddStaticFilter(driver, filterInfo)) { throw new Exception("Cannot set filter"); } }