嗅探进程间通信
我有两个应用程序（.exe）在同一台计算机（Windows XP x86）上运行，并且我知道它们正在相互通信（我不知道如何，我没有编写它们）。我想找到一种方法来嗅探应用程序之间的通信。有办法做到这一点吗？
我已经对 ProMon 做了一些混乱，我可能可以从那里弄清楚，但我想知道是否有一些更具体的东西可以达到这个目的。 ProMon 可能有点吓人。
I have two applications (.exe) that are running on the same machine (Windows XP x86) and I know are communicating with eachother (I dont know how, I didn't write them). I would like to find a way to sniff the communication between the applications. Is there a way to do this?
I've done some messing with ProMon and i can probably figure it out from there but I'm wondering if there is something a little more specific to this purpose. ProMon can be a bit intimidating.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
首先，您可以使用系统调用跟踪器来监视两个应用程序，例如 StraceNT（或查看此问题）。如果运气好的话，您应该能够确定进程是否通过本地套接字、TCP 连接（无疑是通过 localhost）、管道、命名文件或共享内存进行通信。
您还可以在应用程序运行时运行
netstat以查看它们是否打开任何网络端口。一旦您知道自己在寻找什么，您就可以选择更具体的监控工具。如果是网络通信（即使是通过环回接口），您可以尝试使用 WinDump。如果通信是通过共享内存进行的，您可以将调试器附加到两个进程之一并定期检查共享内存。
First, you could watch your two applications with a system call tracer like StraceNT (or see this question). With some luck, you should be able to figure out whether the processes communicate through a local socket, a TCP connection (via
localhostundoubtedly), a pipe, a named file, or shared memory.You can also run
netstatwhile the applications are running to see if they are opening any network ports.Once you know what you're looking for, you can choose a more specific monitoring tool. If it's network communication (even over a loopback interface), you could try capturing the data with something like WinDump. If the communication is via shared memory, you could attach a debugger to one of the two processes and inspect the shared memory periodically.