windowswinapinamed-pipes

Is there any way to sniff named pipe traffic in Windows?

Is there any tool that can monitor/capture/sniff named pipe traffic?

Even when max instance = 1?

Solution

  • There's no official way.

    Use API hooking. Hook ReadFile and/or WriteFile, maybe also CreateFileA/W (assuming that the app is a pipe client) and do the necessary things on their invocation.

    Microsoft has also its own library for API hooking - Detours .