IRPMon
The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.
파일 탐색기
최종 버전 다운로드 (.zip)- CallbackStream.dpr
- CallbackStream.dproj
- CallbackStream.res
- decider-sample.c
- decider-sample.def
- decider-sample.vcxproj
- decider-sample.vcxproj.filters
- device-connector.c
- device-connector.def
- device-connector.vcxproj
- device-connector.vcxproj.filters
- version.h
- ucrtbased.dll
- vcruntime140d.dll
- ucrtbase.dll
- ucrtbase_clr0400.dll
- vcruntime140.dll
- vcruntime140_clr0400.dll
- borlndmm.dll
- dbghelp.dll
- symsrv.dll
- ucrtbased.dll
- vcruntime140d.dll
- ucrtbase.dll
- ucrtbase_clr0400.dll
- vcruntime140.dll
- vcruntime140_1.dll
- vcruntime140_clr0400.dll
- borlndmm.dll
- dbghelp.dll
- symsrv.dll
- DParser.dpr
- DParser.dproj
- DParser.res
- generics.dictionaries.inc
- generics.dictionariesh.inc
- generics.collections.pas
- generics.defaults.pas
- generics.hashes.pas
- generics.helpers.pas
- generics.memoryexpanders.pas
- generics.strings.pas
- generics.strings.rsj
- AboutForm.dfm
- AboutForm.pas
- AddEditSymServerForm.dfm
- AddEditSymServerForm.pas
- ClassWatch.pas
- ClassWatchAdd.dfm
- ClassWatchAdd.pas
- ColumnForm.dfm
- ColumnForm.pas
- ConnectorSelectionForm.dfm
- ConnectorSelectionForm.pas
- DLLDecider.pas
- DriverNameWatchAddForm.dfm
- DriverNameWatchAddForm.pas
- DriverSettings.pas
- FillterForm.dfm
- FillterForm.pas
- HookObjects.pas
- HookProgressForm.dfm
- HookProgressForm.pas
- IRPMon.dpr
- IRPMon.dproj
- IRPMon.lpi
- IRPMon.lps
- irpmon.manifest
- IRPMon.res
- ListModel.pas
- MainForm.dfm
- MainForm.pas
- RequestDetailsForm.dfm
- RequestDetailsForm.pas
- RequestFilter.pas
- RequestListModel.pas
- RequestThread.pas
- SetSymPathForm.dfm
- SetSymPathForm.pas
- TreeForm.dfm
- TreeForm.pas
- WatchedDriverNames.pas
- hyperv-connector.c
- hyperv-connector.def
- hyperv-connector.vcxproj
- hyperv-connector.vcxproj.filters
- version.h
- callback-stream.h
- data-parser-types.h
- debug.h
- device-connector.h
- dll-decider-types.h
- dparser.h
- general-types.h
- hyperv-connector.h
- ioctls.h
- irpmondll-types.h
- irpmondll.h
- kernel-shared.h
- libserver.h
- libvsock.h
- network-connector.h
- parser-base.h
- regman.h
- reqlist.h
- symbols.h
- vsock-connector.h
- driver.c
- driver.h
- fs-watch.c
- fs-watch.h
- image-load.c
- image-load.h
- irpmndrv.vcxproj
- irpmndrv.vcxproj.filters
- pnp-class-watch.c
- pnp-class-watch.h
- um-services.c
- um-services.h
- version.h
- irpmon-server.vcxproj
- irpmon-server.vcxproj.filters
- server.c
- version.h
- driver-hook.h
- driver-settings.cpp
- driver-settings.h
- guid-api.c
- guid-api.h
- irpmonc.cpp
- irpmonc.h
- irpmonc.vcxproj
- irpmonc.vcxproj.filters
- request-output.h
- stop-event.c
- stop-event.h
- version.h
- driver-com.cpp
- driver-com.h
- irpmondll.def
- irpmondll.vcxproj
- irpmondll.vcxproj.filters
- main.cpp
- version.h
- boot-log.c
- data-loggers.c
- devext-hooks.c
- driver-settings.c
- hook-handlers.c
- hook.c
- kbase.c
- kbase.def
- kbase.vcxproj
- kbase.vcxproj.filters
- key-record.c
- key-record.h
- pnp-driver-watch.c
- process-events.c
- registry-callback.c
- registry-callback.h
- regman.c
- req-queue.c
- thread-context.c
- value-record.c
- value-record.h
- version.h
- kbdsample.c
- kbdsample.vcxproj
- kbdsample.vcxproj.filters
- allocator.c
- allocator.h
- boot-log.h
- data-loggers.h
- devext-hooks.h
- driver-settings.h
- fo-context-table.c
- fo-context-table.h
- handle-table.c
- handle-table.h
- hash_table.c
- hash_table.h
- hook-handlers.h
- hook.h
- kbase.h
- modules.c
- modules.h
- multistring.c
- multistring.h
- pnp-driver-watch.h
- preprocessor.h
- process-context-table.c
- process-context-table.h
- process-events.h
- req-queue.h
- string-hash-table.c
- string-hash-table.h
- string-ref-table.c
- string-ref-table.h
- thread-context.h
- utils-dym-array-types.h
- utils-dym-array.c
- utils-dym-array.h
- utils.c
- utils.h
- callback-stream.cpp
- libcallbackstreamdll.vcxproj
- libcallbackstreamdll.vcxproj.filters
- dparser.cpp
- libdparserdll.vcxproj
- libdparserdll.vcxproj.filters
- libreqlistdll.vcxproj
- libreqlistdll.vcxproj.filters
- reqlist.cpp
- libserver.c
- libserver.def
- libserver.vcxproj
- libserver.vcxproj.filters
- Symbols.dpr
- Symbols.dproj
- Symbols.res
- libsymbolsdll.vcxproj
- libsymbolsdll.vcxproj.filters
- symbols.cpp
- libvsock.c
- libvsock.def
- libvsock.vcxproj
- libvsock.vcxproj.filters
- network-connector.c
- network-connector.def
- network-connector.vcxproj
- network-connector.vcxproj.filters
- version.h
- ea.c
- ea.h
- ea.vcxproj
- ea.vcxproj.filters
- version.h
- hexer.c
- hexer.h
- hexer.vcxproj
- hexer.vcxproj.filters
- version.h
- keyboard-parser.c
- keyboard-parser.h
- keyboard.vcxproj
- keyboard.vcxproj.filters
- version.h
- mailslots.c
- mailslots.h
- mailslots.vcxproj
- mailslots.vcxproj.filters
- version.h
- mouse-parser.c
- mouse-parser.h
- mouse.vcxproj
- mouse.vcxproj.filters
- version.h
- pbase.c
- pbase.def
- pbase.vcxproj
- pbase.vcxproj.filters
- version.h
- pipes.c
- pipes.h
- pipes.vcxproj
- pipes.vcxproj.filters
- version.h
- pnp-devcaps.c
- pnp-devcaps.h
- pnp-devcaps.vcxproj
- pnp-devcaps.vcxproj.filters
- version.h
- pnp-ids.c
- pnp-ids.h
- pnp-ids.vcxproj
- pnp-ids.vcxproj.filters
- version.h
- pnp-interface.c
- pnp-interface.h
- pnp-interface.vcxproj
- pnp-interface.vcxproj.filters
- version.h
- secdesc.c
- secdesc.h
- secdesc.vcxproj
- secdesc.vcxproj.filters
- version.h
- version.h
- wpd-data.h
- wpd-parser.cpp
- wpd-parser.h
- wpd.vcxproj
- wpd.vcxproj.filters
- Parser.props
- DEFCON-24-Bigezy-Saci-Pinworm-MITM-for-Metadata.pdf
- 0.8.zip
- beta1.zip
- ReqList.dpr
- ReqList.dproj
- ReqList.res
- request.def
- requests.vcxproj
- requests.vcxproj.filters
- version.h
- about.bmp
- ioctl.txt
- ntstatus.txt
- uninst-6.0.4 (u)-e13338eef5.e32
- version.rc
- winerr.txt
- all.bat
- build.bat
- installer.iss
- path.iss
- sign-installer.bat
- sign.bat
- server-svc.c
- server-svc.vcxproj
- server-svc.vcxproj.filters
- version.h
- AbstractRequest.pas
- AddDeviceRequest.pas
- BinaryLogHeader.pas
- CallbackStreamImpl.pas
- DataParsers.pas
- DbgHelpDll.pas
- DriverUnloadRequest.pas
- FastIoRequest.pas
- FileObjectNameXXXRequest.pas
- ImageLoadRequest.pas
- IRPCompleteRequest.pas
- IRPMonDll.pas
- IRPMonRequest.pas
- IRPRequest.pas
- NameTables.pas
- ProcessList.pas
- ProcessXXXRequests.pas
- RefObject.pas
- RequestList.pas
- StartIoRequest.pas
- SymTables.pas
- Utils.pas
- VSockConnector.pas
- XXXDetectedRequests.pas
- request.cpp
- request.h
- version.h
- vsock-connector.c
- vsock-connector.def
- vsock-connector.vcxproj
- vsock-connector.vcxproj.filters
- xml2doc.cpp
- xml2doc.vcxproj
- xml2doc.vcxproj.filters
- .gitignore
- .gitmodules
- DLLs.props
- General.optset
- General.props
- ioctl.txt
- irpmon.groupproj
- irpmon.sln
- irpmon.suo
- irpmon.v11.suo
- irpmon.v12.suo
- Kernel.props
- LICENSE
- pugixml
- README.md
- Server.props
# 설치 가이드
1. 코드 내려받기
git clone https://github.com/MartinDrab/IRPMon
깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.
cd IRPMon
방금 내려받은 프로젝트 폴더 안으로 이동합니다.
// repository documentation
Was this content helpful?
(0 ratings)
