Monitoring IO like Sysinternals' ProcMon

StackOverflow https://stackoverflow.com/questions/4583213

Question

How does the Process Monitor from Sysinternals monitor file IO activity like it does? If you enable the advanced information, you can see that calls that were previously shown as CreateFile are now shown as IRP_MJ_CREATE which suggests that it hooks some rather low level stuff. Does anyone know exactly what it hooks/how it works?

Was it helpful?

Solution

Perhaps your answer is with this SO post

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top