_ACPI Monitoring and Debugging

Quick manual on how to monitor, what specifically AC or other Asus app sends to the device

Preparation

1. Disable windows Bitlocker / Drive Encryption
2. Turn off Secure Boot in BIOS
3. Download and IRPMon application install https://github.com/MartinDrab/IRPMon/releases
4. Reboot

EXPLANATION: In order to allow IRPM Mon run, you need to disable Secure Boot in BIOS. But with secure boot disabled, your windows bitlocker also won't work, so you need to turn off Bitlocker beforehand as well

Setting up IRPMon

1. Right click on IRPMon icon, and select Run as Administrator

2. In popup window select Device tab, enter \\.\irpmndrv there and click OK

3. Go to Action -> Select Drivers and Devices and scroll down to Driver/ATKWMIACPIIO AND Driver/ATKACPI

4. Right click on them, and check Data (important!) and Hooked. Under IRP column (on the right) select only DeviceControl checkbox.

5. Under Request -> Filters create a new filter with this params

Type : IRP, Column : DeviceName, Contains : ATKACPI, Action : INCLUDE. Click ADD and APPLY (important)

6. Under Monitoring select Capture Events. You should see some requests coming from AC (or any other app)

By double clicking on packets, you should see Hexer tab containing actual data payload that app sends

Capturing

1. Launch AC (or MyASUS, ProART app, etc) and in UI prepare to perform action you want to monitor. For example go to Manual mode
2. In IRPMmon, select Monitoring -> Start capturing and Clear everything (AC could be quite spammy with data)
3. Quickly alt-tab to AC (or MyASUS, ProART app, etc) and perform your action - i.e. click Apply on Manual mode
4. In IRPMon - Stop Capturing and save captured data as a log via Action -> Save