How does SysInternal's ProcessMonitor work?

问题:

Could someone please give me a high level explanation how they are able to monitor every single registry access?

http://technet.microsoft.com/en-us/sysinternals/bb896645

Enough detail so that i could google around the various sub-topics and try to write my own one? I know they've used some sort of dll injection/API hooking, but i'm unsure how they reached all the kernel mode activity.

回答1:

It loads a virtual driver on startup which does the monitoring on a low-level. So it doesn't have to inject anything in other processes.

On http://www.decuslib.com/decus/vmslt00a/nt/filemon.htm there's a short explanation about how FileMon, one of ProcMon's predecessors, works.

If you like reading code, here's the source code of FileMon and RegMon: http://www.wasm.ru/baixado.php?mode=tool&id=283 (from http://forum.sysinternals.com/topic8038_page1.html)