Skip to content
This repository has been archived by the owner on Nov 7, 2020. It is now read-only.
/ ProcMonX Public archive

Extended Process Monitor-like tool based on Event Tracing for Windows

License

Notifications You must be signed in to change notification settings

zodiacon/ProcMonX

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

29 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

ProcMonX

Extended Process Monitor-like tool based on Event Tracing for Windows

The classic Sysinternals tool Process Monitor uses a file system minifilter, registry minifilter and process/thread callbacks to get the information it provides.

An alternative way is to use Event Tracing for Windows (ETW) to get this information, without the need for a kernel driver. (Process Monitor does use ETW for network events).

See more info at this blog post.

ProcMonX

About

Extended Process Monitor-like tool based on Event Tracing for Windows

Resources

License

Stars

Watchers

Forks

Sponsor this project

Packages

No packages published

Languages