How does Procmon work on 64-bit Vista+?

Question

I understand older Procmon and its predecessors (filemon, regmon etc) used virtual drivers to hook the kernel. However, Patchguard prevents SSDT hooking etc on 64-bit Vista+.

It is my understanding that Procmon now uses a minifilter driver for File IO monitoring and ETW for networking monitoring. However, I am no clear on how it monitors registry access and process/image/thread events? Does it also use ETW for these?

score 3 · Answer 1 · answered Apr 18 '13 at 14:36

There are bunch of callbacks for monitoring support in kernel (since xp):

registry -> http://msdn.microsoft.com/en-us/library/windows/hardware/ff545879(v=vs.85).aspx
process/image/thread notify - PsSetCreateProcessNotifyRoutineEx / PsSetLoadImageNotifyRoutine / PsSetCreateThreadNotifyRoutine -> http://msdn.microsoft.com/en-us/library/windows/hardware/ff559917(v=vs.85).aspx
object manager callbacks for handles monitoring -> http://msdn.microsoft.com/en-us/library/windows/hardware/ff558692(v=vs.85).aspx

on xp was some limitation, but since vista they fully functional. No need to patch any internal tables for any monitoring activity.

How does Procmon work on 64-bit Vista+?

1 Answers1