51 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
1
vote
0
answers
179
views
Windows C++ API BackupRead is stuck(?) when trying to fetch all the streams of a file
I am trying to investigate an issue where the Windows C++ API BackupRead, used in our software, appears to get stuck for few files.
I suspected large file streams to be the reason.
I wrote a small ...
4
votes
0
answers
129
views
Sysinternals Process Monitor: capturing file system events on a Windows Dev Drive (ReFS)
It seems that Sysinternals Process Monitor (version 4.01) does not capture any file system access events (like QueryOpen) on Windows Dev Drives (or more generally on ReFS drives?) by default. Is there ...
0
votes
0
answers
95
views
How to effectively monitor process creation using python in Windows ? Currently missing out short lived processes
My aim: I have been trying to continuously monitor process creation using python (without a lot of pre-requisites) but I am not able to capture short lived processes. I want this python script to run ...
0
votes
1
answer
221
views
Can't find a filter of a program in Procmon
I was given a task to put 2 filters in Procmon. 1) Process name is "test.exe" (a WinAPI createFile, readFile, closeHandle project written in Visual Studio in C) 2)Operation is read file. ...
0
votes
1
answer
75
views
Previously working executable now gives application error at runtime
I recently copied C++ source code I am developing in VS2017 from my desktop (running Win 10) to my new laptop (running Win 11).
Although the code compiles and links successfully, I now encounter a ...
1
vote
0
answers
104
views
What does the "QueryDeviceInformationVolume" operation in Process Monitor mean?
Seeing an operation called "QueryDeviceInformationVolume" in a SysInternals Process Monitor log when I start a desktop application. Simply trying to get some details about this operation and ...
0
votes
0
answers
65
views
What is Process CreateTime in the xml procmon saved?
Process data in the xml file Procmon saved has "CreateTime". For a process starting from 2023年4月17日 14:36:01, its CreateTime in the xml file is 133261869619355124. Regardless of whether this ...
0
votes
0
answers
159
views
Hide activity from Procmon
I am trying to develop an evaluation software mechanism that will limit the use of the program, and then require a purchase.
But when I gave it to my friend, he told me that whatever I do - write to ...
0
votes
1
answer
142
views
Force Python to use certain set of drivers?
This is a follow-up question to a previous discussion.
Basically, I have a python code with ctypes code that is calling a vendor-supplied DLL. The code works fine when I use 32 bit python with the 32 ...
0
votes
0
answers
2k
views
How to track down access violation "at address 00000000" in third party software using MadExcept of Sysinternals ProcessMonitor?
Access violation "at address 00000000" started appear to my Delphi 2009 installation. I started ProcessMonitor https://learn.microsoft.com/en-us/sysinternals/downloads/procmon and filtered ...
0
votes
1
answer
312
views
Process Monitor and Registry Free COM: why no access to "manifest"?
I try to do COM without touching the registry.
I started with a very simple C++ "client", trying to CoCreateInstance with ramdom arbitrary UUID.
#include <stdio.h>
#include <Windows....
0
votes
0
answers
1k
views
Procmon produces corrupt output file
I am trying to diagnose an issue causing my computer to crash when using audio for some time.
I tried running procmon (Process Monitor v 3.84) using the option of ring buffer to a file (to limit the ...
1
vote
0
answers
45
views
What causes a large exe to load slowly (65,536 bytes at time according to Procmon)?
We are running Docker on a VMware host running Windows 10.
Based on the first comment, I wonder if the issue isn't specifically the read portion, but maybe there is something happening at the end of ...
2
votes
1
answer
2k
views
the file <FILE_NAME>.PML was not closed cleanly during capture and is corrupt
I'm using procmon to save logs while running some tests on VM. I'm using python and pytest but I think is irrelevant here.
For every test I'm running to start procmon with:
psexec.exe -accepteula -s -...
0
votes
2
answers
2k
views
Sysinternals Process Monitor (ProcMon): Working with Time of Day Filter
I am using Sysinternals Process Monitor to debug some incoming events.
Now I am trying to create a filter on 'Time Of Day' in order to filter those incoming events which time is greater than an ...