3 ms·
I wish I could help you but I haven't touched windows in decades. Perhaps someone else can chime in.
by epilys 4y ago
I wish I could help you but I haven't touched windows in decades. Perhaps someone else can chime in.
- DontchaKnowit 4y agoSo as far as I can tell the only way a user can access this type of info on windows is via procmon. Problem is its just a gui application, no programatic access afaik. I did find a project where someone reverse engineered it to some extent and it allowed you to make calls to it programatically. Anyway, it turned out there was a loooot of heavy lifting that'd be required to get it to behave the way I needed it. Anywho, I'm happy for the info on linux. I was looking for a project that would require me to up my bash skills anyway. This sounds perfect
- Joker_vD 3y agoI'm pretty sure the latter (Win8 and on?) versions of Windows had some sort of framework for writing FS filter drivers or something, that the AVs are supposed to use?
- p_l 3y agoEvery NT version, in fact. Driver filters including filesystem filters are core NT feature. So you'd have to write a driver that hooked itself at appropriate step in IO Request processing, then it could inspect and gather data just like eBPF. Procmon uses diagnostic interfaces from outside kernel, might require debug permissions.