Windows sysinternals

Injecting Debug Output into Procmon Traces
Chapter 4 Process Monitor 141
Procmon provides an application programming interface (API) allowing developers to
create debug output events that appear in the Procmon event stream with custom text. For
example, you can inject custom debug output in the trace upon entering or exiting a function
to correlate those activities with file, registry, or other events. By applying the Exclude
Events Before and Exclude Events After filters on these debug events, you can easily focus
on the areas of interest in your program. Unlike standard Windows debug output that is
captured by DebugView (described in Chapter 7, “Process and Diagnostic Utilities”) or other
debuggers, this interface specifically targets Procmon.
These events appear as Debug Output Profiling operations and are part of the Profiling
events class, along with Process Profiling and Thread Profiling events. Note that by default all
Profiling events are filtered out. To see your debug output events, enable the Show Profiling
Events toggle button on the toolbar. After doing so, you might also want to highlight Debug
Output Profiling operations and exclude the display of Process Profiling operations. Figure
4-33 shows debug output highlighted and interspersed with registry operations.
FIGURE 4-33 Debug Output Profiling events.
Any process, including one running at Low integrity, can use this interface, which accepts
wide character (Unicode) text strings of up to 2048 characters in length. The following code
sample demonstrates how to use the interface:
#include
#include
const ULONG FILE_DEVICE_PROCMON_LOG = 0x00009535;
const ULONG IOCTL_EXTERNAL_LOG_DEBUGOUT =
(ULONG) CTL_CODE( FILE_DEVICE_PROCMON_LOG, 0x81, METHOD_BUFFERED, FILE_WRITE_ACCESS );
www.it-ebooks.info