如何在windows中捕获命名管道流量

Question

i wanted to check the named pipe which i am using between two of my processes is safe or not. Though many says it is possible to sniff the named pipe traffic. i didn't find any concrete method to capture the named pipe traffic.

Answer 1

You can use " Pipe Monitor " which lets you see what is flowing through Windows named pipes.

Also, to restrict the access to your named pipe, you can specify a security descriptor for a named pipe when you call the CreateNamedPipe function. The security descriptor controls access to both client and server ends of the named pipe. See MSDN doc .

Answer 2

You can use api hooking. Did you try with process monitor?

Answer 3

Sysmon 事件 ID 17 和 18 是您捕获和查找此信息的位置。