Is there any way to monitor kernel-mode code execution on Windows with a program like Process Monitor or is that something for WinDbg only?

2 Answers 2


The closest thing I'm aware of is DbgKit from Andrey Bazhan. It is not exactly what you are asking for, but it does provide a nice GUI extension on top of WinDbg (which can be used for kernel debugging). It's more like Process Explorer than Procmon.

DbgKit Memory Explorer


What do you mean by monitoring kernel-mode code execution? There's a lot of things happening in kernel mode. For example file and registry operations will still be visible in ProcessMonitor, due to kernel code most of the time is executed in context of the user mode processes, i.e. outside of System process. Yet if you remove a filter on System process in ProcessMonitor, you'll be able to see kernel activity from System process too. Also there are tools like IrpMon or DriverMon which allow you to see IRP traffic/the calls to IRP_MJ_xx functions.

  • 1
    thanks I think that's a start... Basically I have an application I am reversing and it has a usermode client and kernel-mode filter driver. There is functionality that is probably occurring in the driver that I am trying to reverse and typically, I would do some dynamic analysis with procmon and watch what an app does... However, in procmon, the activity was not showing up for the driver like it would with a user-mode application under its proc name. Was j/w if there were steps to get similar functionality. Will try your suggestions thanks.
    – the_endian
    Commented Dec 2, 2017 at 9:38
  • This is not strange since proc mon is designed to listen on desktop applications with UI's, it sets a windows hook on dll calls in order to capture r/w handles on registery and files/folders, ie famous user32.dll, if driver has its own endogenic tools to manipulate reg then procmon is way far to be in current of what's happening.
    – Abr001am
    Commented Mar 5, 2018 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.