I running procmon
to monitor my process, and see that my process uses ReadFile
API.
How can I see which data the process received when it uses ReadFile
?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityTLDR; you can't.
ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like API Monitor may be more suitable.