Syscall Monitor
Introduction
This is a process monitoring tool (like Sysinternal's Process Monitor) implemented with Intel VT-X/EPT for Windows 7+.
Develop Environment
- Visual Studio 2015 update 3
- Windows SDK 10
- Windows Driver Kit 10
- QT5.7 for MSVC
Deployment
- QT GUI project: SyscallMonQT/SyscallMonQT.pro
- Windows kernel driver project: ddimon/DdiMon/DdiMon.vcxproj
- Remember to modify the shadow build path to /build32 or /build64 when configure the QT project
- Remember to modify the windeploy.exe path in deploy32/deploy64.bat, run deploy32/64.bat to deploy x86/x64 binary files to bin32/bin64
- Remember to sign the x64 kernel driver file
Platform
- x86 and x64 Windows 7, 8.1 and 10
- CPU with Intel VT-x and EPT technology support
Reference & Thanks
- BOOST http://www.boost.org/
- QT https://www.qt.io/
- HyperPlatform https://github.com/tandasat/HyperPlatform
- Capstone http://www.capstone-engine.org/
TODO
1.Optimize the memory usage issue.
Screenshots
