2

I running procmon to monitor my process, and see that my process uses ReadFile API.

How can I see which data the process received when it uses ReadFile?

3

TLDR; you can't.

ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like API Monitor may be more suitable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.