open source process monitor
open source process monitor
You don't have a digital signature yourself? It doesn't matter. You can use the original procmon driver, this sdk is 100% compatible with the original procmon driver. And of course, The original procmon driver can be replaced with this driver to learn how procmon works.
WDK
Install the last WDK
WTL
Download the last WTL library and put it in folder whatever you like. for example i put it in "D:\source\WTL10_9163"
cmake .. -G "Visual Studio 16 2019" -A X64 -DWTL_ROOT_DIR=D:\source\WTL10_9163 -DWDK_WINVER=0x0A00
cmake --build . --config Release
!!!Please note that I don't how to use the cmake to sign the driver with test signature. please do it yourself!!
#include <conio.h>
#include "../../sdk/procmonsdk/sdk.hpp"
class CMyEvent : public IEventCallback
{
public:
virtual BOOL DoEvent(const CRefPtr<CEventView> pEventView)
{
ULONGLONG Time = pEventView->GetStartTime().QuadPart;
LogMessage(L_INFO, TEXT("%llu Process %s Do 0x%x for %s"),
Time,
pEventView->GetProcessName().GetBuffer(),
pEventView->GetEventOperator(),
pEventView->GetPath().GetBuffer());
return TRUE;
}
};
int main()
{
CEventMgr& Optmgr = Singleton<CEventMgr>::getInstance();
CMonitorContoller& Monitormgr = Singleton<CMonitorContoller>::getInstance();
CDrvLoader& Drvload = Singleton<CDrvLoader>::getInstance();
if(!Drvload.Init(TEXT("PROCMON24"), TEXT("procmon.sys"))){
return -1;
}
Optmgr.RegisterCallback(new CMyEvent);
//
// Try to connect to procmon driver
//
if (!Monitormgr.Connect()){
LogMessage(L_ERROR, TEXT("Cannot connect to procmon driver"));
return -1;
}
//
// try to start monitor
//
Monitormgr.SetMonitor(TRUE, TRUE, FALSE);
if (!Monitormgr.Start()){
LogMessage(L_ERROR, TEXT("Cannot start the mointor"));
return -1;
}
_getch();
//
// try to stop the monitor
//
Monitormgr.Stop();
LogMessage(L_INFO, TEXT("!!!!!monitor stop press any key to start!!!!"));
_getch();
Monitormgr.Start();
_getch();
Monitormgr.Stop();
Monitormgr.Destory();
return 0;
}
It is pertty esay right?
The GUI is still in Pre-Alpha state, and many features have yet to be improved. Wellcome PR.
main window:
properties windows
dbghelp.dll
symsrv.dll
symsrv.yes
srv*D:\reverse\symbols*https://msdl.microsoft.com/download/symbols
Discover it yourself!!!