Geek asks and answers

View messages sent through the ALPC port?

I am trying to figure out what messages are used on a specific ALPC port in Windows 7, and since there does not seem to be any place where port messages are only documented by the actual ports themselves, I would like to listen to specific ports, to see the messages sent to the port.

Does anyone know how to do this?

+3
source share
1 answer

ALPC calls must be fast, so there are no intercept points. Your best bets:

  • Enable ETW kernel logging and control message flows using the ALPC class (highly recommended)
  • Detours. , , . , .
+2

More articles:


All Articles