Monitoring IO like Sysinternals' ProcMon
-
14-10-2019 - |
Pergunta
How does the Process Monitor from Sysinternals monitor file IO activity like it does? If you enable the advanced information, you can see that calls that were previously shown as CreateFile are now shown as IRP_MJ_CREATE which suggests that it hooks some rather low level stuff. Does anyone know exactly what it hooks/how it works?
Solução
Perhaps your answer is with this SO post
Licenciado em: CC-BY-SA com atribuição
Não afiliado a StackOverflow