Question: Switching 'Process Monitor' for a third-party tool about spartacus

[michaellrowley]

Hi Pavel,

That's perfect, the --generate-proxy argument looks like it should do what I need as long as my tool calls it correctly.

Thanks!

[sadreck]

Hi Michael,

At the moment there isn't a way to switch parsers as it's quite tightly build around ProcMon (tbh I don't think that will be changing in v2).

But I think what you can use is the --generate-proxy feature to create proxies to whichever functions you like?

--generate-proxy --ghidra C:\ghidra\support\analyzeHeadless.bat --dll C:\Windows\System32\userenv.dll --output-dir C:\Projects\spartacus-wtsapi32 --verbose --only-proxy "ExpandEnvironmentStringsForUserW"

The above will generate a proxy only for ExpandEnvironmentStringsForUserW and redirect all other functions to the legitimate one.

If I misunderstood your end goal and this suggestion doesn't work for you, please let me know!

Thanks,
Pavel