Syscall-Monitor
Syscall-Monitor copied to clipboard
hzqst
Syscall Monitor is a system monitor program (like Sysinternal's Process Monitor) using Intel VT-X/EPT for Windows7+
We like Syscall-Monitor a lot and have some private questions, could you contact us via [email protected]?
Hi, Can we add support for dlls in C:\Windows\SysWOW64\wbem\*.dll? These dlls don't seemingly invoke functions in kernel32.dll If you follow the example here where it prints out the process list,...
Hi, Is there any usermode component to the syscall monitoring or is it all relying on DdiMon/ring0 tricks? I am wondering if this would be a good reference for something...
The memory consumption went 25 ~ 30MB per 50000 events when commented `CallStack(ba);` in `bool CMonitorWorker::ParseMessage(PUCHAR data)`, while it went 50 ~ 60MB per 50000 events when CallStack is recorded....
