Command Line Interface

Command Line Interface

Accessing IRPMon functionality through the GUI IRPMon.exe application is nice for those who like the manual approach, or are just used to programs like Process Monitor from SysInternals. Others may take advantage of the command-line interface implemented as the irpmonc.exe console application. Its functionality matches the GUI application with exception of request filters; they are simply not present.

More precisely, the console application is capable of the following tasks:

• hooking and unhooking drivers and devices,
• registering and unregistering driver name watches,
• reading and modifying global driver settings,
• retrieving requests (from the driver or a file) and sending them to other places (standard output or a file) in different formats (binary, text or JSON).

Specifying Input

The input is a place from where the application can retrieve requests in order to process them further. This can be a control device of the IRPMon driver (usually named \\.\IRPMon), an IP address and port where the IRPMon server service listents, or a binary log file generated previously. In the first two cases, it is also possible to hook or unhook drivers and devices, register or unregister driver name watches etc. If the file is specified, irpmonc just reads requests stored there and processes them.

Exactly one input must be specified. To do that, use the --input argument in one of the following ways:

• --input=D:\\.\IRPMon connects to the IRPMon driver running on the local machine.
• --input=N:IP:port attempts to connect to an instance of the IRPMon server listening at IP:port. Both IPv4 and IPv6 are protocols supported.
• --input=L:C:\log\irpmon.log opens a log file C:\log\irpmon.log.

Specifying Outputs

irpmonc is capable of writting processed requests into multiple areas, called outputs, at the same time. Use the --output argument repeatedly to define all outputs. The syntax is

--output=B:<filename>
--output=J:<filename>
--output=T:<filename>

The output format is determined by the letter before the colon:

• B stands for the IRPMon binary request format. Such a file can later be specified either as an input to another irpmonc instance, or can be opened in the IRPMon graphics application. No other format can do that.
• T is a simple text format where each line contains one name-value pair. This format is easily readable by human users, however, is hardly useful for anything also.
• J instructs irpmonc to output each request as a JSON object. One request is printed per line. This format is expected to be useful in some automatic post-processing.

To output to the standard output, specify - as file name.

Hooking Drivers and Devices

Driver Name Watches

GLobal Driver Settings

Example