Hacker News Reader

This is wonderful, thank you. I may try this out.

Originally wanted to do it for windows but I eventually concluded it would take some prodigious hackery to get it do work

View on HN

I wish I could help you but I haven't touched windows in decades. Perhaps someone else can chime in.

So as far as I can tell the only way a user can access this type of info on windows is via procmon. Problem is its just a gui application, no programatic access afaik. I did find a project where someone reverse engineered it to some extent and it allowed you to make calls to it programatically. Anyway, it turned out there was a loooot of heavy lifting that'd be required to get it to behave the way I needed it.

Anywho, I'm happy for the info on linux. I was looking for a project that would require me to up my bash skills anyway. This sounds perfect

I'm pretty sure the latter (Win8 and on?) versions of Windows had some sort of framework for writing FS filter drivers or something, that the AVs are supposed to use?

Every NT version, in fact. Driver filters including filesystem filters are core NT feature.

So you'd have to write a driver that hooked itself at appropriate step in IO Request processing, then it could inspect and gather data just like eBPF.

Procmon uses diagnostic interfaces from outside kernel, might require debug permissions.

Reply on news.ycombinator.com