I was given a task to put 2 filters in Procmon. 1) Process name is "test.exe" (a WinAPI createFile, readFile, closeHandle project written in Visual Studio in C) 2)Operation is read file. When I look for the filters I can't find either. I thought maybe I need to run the project for it to show, but even then, it doesn't. Do I need to do something extra? The file the project is reading is a simple text file with "Hello World!" written in it. I have a photo of what the filters are supposed to look like (the "barakgonen.exe" is the "test.exe"): If it helps the code that reads the file is
#include <windows.h>
#include <stdio.h>
int main() {
// Specify the relative path to the file
LPCSTR fileName = "C:\\TestFolder\\test.txt";
// Attempt to open the file
HANDLE fileHandle = CreateFileA(
fileName, // File name
GENERIC_READ, // Desired access
0, // Share mode
NULL, // Security attributes
OPEN_EXISTING, // Creation disposition
FILE_ATTRIBUTE_NORMAL, // Flags and attributes
NULL // Template file handle
);
if (fileHandle == INVALID_HANDLE_VALUE) {
printf("Could not open file (error %d)\n", GetLastError());
return 1;
}
// Buffer to store the data read
char buffer[1024];
DWORD bytesRead;
// Read data from the file
BOOL readResult = ReadFile(
fileHandle, // File handle
buffer, // Buffer to store data
sizeof(buffer) - 1, // Number of bytes to read
&bytesRead, // Number of bytes read
NULL // Overlapped
);
if (!readResult) {
printf("Could not read from file (error %d)\n", GetLastError());
CloseHandle(fileHandle);
return 1;
}
// Null-terminate the buffer to make it a valid string
buffer[bytesRead] = '\0';
// Print the contents of the buffer
printf("File contents:\n%s\n", buffer);
// Close the file handle
CloseHandle(fileHandle);
return 0;
}
Step 1: click the filter button
Step 2. click the "Reset" button to make sure you have the default filters.
Step 3: Choose "Process name" from the drop down list
Step 4: Choose "is" from the drop down list
Step 5: Enter the name of the executable
Step 6: Choose "Include" from the drop down list
Step 7: Click "Add"
Result:
Step 8 to 12: Do it similarly for the other filter, starting from Step 3.
Step 13: Click "Ok" to apply the filters