DEV Community: Bored

Building a High-Performance Live Network Sniffer in Rust (Without Kernel Drivers)

Bored — Sat, 22 Nov 2025 19:05:44 +0000

Network traffic analysis is a superpower. Whether you are debugging a distributed system, reverse-engineering a legacy protocol, or performing security auditing, you usually end up opening Wireshark.

But what if you want to automate that detection? What if you need to trigger a specific action the moment a specific text sequence—like a specific username, a specialized API key, or a magic header—hits the network card?

Writing a kernel-level driver to capture packets is painful and dangerous (one bug = Blue Screen of Death). Using raw socket libraries (like libpcap) is powerful but can be a nightmare regarding cross-platform compilation (Windows headers vs. Linux headers).

In this article, I’ll explain how I built a Rust-based CLI tool that wraps the power of TShark (Wireshark) to monitor live traffic, filter by IP, and detect hidden ASCII and Wide-Character signatures in real-time.

The Goal

I needed a tool that could:

Run on Windows and Linux.
Require no custom drivers (piggyback off an existing Wireshark installation).
Filter for a specific target IP.
Scan packet payloads for a specific signature (e.g., "BunnyName123").
Sanitize the messy binary data into clean, readable UTF-8 logs.

The Architecture: "The Sidecar Pattern"

Instead of implementing the full TCP/IP stack in Rust, I used the "Sidecar" approach. We spawn TShark (the command-line version of Wireshark) as a child process and pipe its output directly into our Rust application's standard input.

TShark: Handles the interface selection, promiscuous mode, and raw capture.
Rust: Handles the stream buffering, parsing, signature matching, and file logging.

This gives us the stability of Wireshark’s dissection engine with the safety and speed of Rust.

Challenge #1: Finding the Binary (Windows Pathing)

The first hurdle in cross-platform development is that Linux users have tshark in their global PATH, but Windows users usually don't (it sits in C:\Program Files\...).

If you simply run Command::new("tshark") on a standard Windows install, it will panic. I solved this with a robust resolver function that checks the system PATH first, and then iterates through standard installation directories:

fn resolve_tshark_path() -> String {
    let common_paths = [
        r"C:\Program Files\Wireshark\tshark.exe",
        r"C:\Program Files (x86)\Wireshark\tshark.exe",
        "/usr/bin/tshark", 
    ];

    // 1. Try the PATH
    if Command::new("tshark").arg("-v").stdout(Stdio::null()).status().is_ok() {
        return "tshark".to_string();
    }

    // 2. Fallback to hardcoded paths
    for path in common_paths {
        if Path::new(path).exists() { return path.to_string(); }
    }

    "tshark".to_string() // Hope for the best
}

Challenge #2: The TShark Command Arguments

To make parsing efficient, we can't just take the default output. We need specific flags to make it machine-readable and real-time:

let mut child = Command::new(binary)
    .args([
        "-i", interface,
        "-l",           // Flush stdout after every packet (CRITICAL)
        "-n",           // Disable DNS resolution (Prevents lag)
        "-x",           // Output Hex and ASCII dump
        "-Y", filter    // Wireshark display filter 
    ])
    .stdout(Stdio::piped())
    .spawn()?;

The Importance of -l:
Without -l, TShark buffers its output. Your Rust tool will sit silently compiling 4KB of data and then suddenly vomit 50 packets at once. For live analysis, we need line-buffering to process packets the millisecond they arrive.

Challenge #3: Parsing the Hex Dump

TShark's -x output provides a hexdump that looks like this:

0000  00 50 56 c0 00 08 00 0c 29 f0 23 11 08 00 45 00   .PV.....).#...E.
0010  00 34 1e 3c 40 00 40 06 b5 92 c0 a8 01 0a 14 4c   .4.<@.@........L

The Rust application reads this line-by-line using BufReader. The trick is to ignore the offset (0010) and the ASCII preview on the right, extracting only the middle column to build a pure hex string like 00341e3c....

The Signature Detection (ASCII vs Wide Char)

Data on the wire is messy. Sometimes strings are sent in ASCII, but often—especially in Windows environments or .NET applications—strings are sent in UTF-16LE (Wide Char).

If you search for "BunnyName123" (ASCII), you will miss the packet if it is sent technically as B.u.n.n.y.N.a.m.e.1.2.3 (where . represents a null byte 00).

My tool generates two signatures from the config constants. Here is the math for our target "BunnyName123":

// Hex representation of "BunnyName123"
const SIG_ASCII: &str = "42756e6e794e616d65313233"; 

// Hex representation of "B.u.n.n.y.N.a.m.e.1.2.3" (Wide Char)
const SIG_WIDE: &str  = "420075006e006e0079004e0061006d0065003100320033";

By converting the incoming packet to a continuous hex string, we can search for both formats simultaneously without complex decoding logic.

The Final Polish: Sanitized Logging

One requirement was to save a readable log file. Raw packets contain binary garbage and control characters that ruin text files.

I implemented a sanitizer function that converts the Hex stream back into ASCII, but filters out non-printables:

fn hex_to_clean_ascii(hex_str: &str) -> String {
    // If byte is between 32 (Space) and 126 (~), keep it.
    // Otherwise, replace with '.'
    // This turns binary soup into readable text.
}

The Full Code

Here is the complete, single-file Rust implementation. It uses clap for argument parsing and ctrlc for graceful shutdowns.

Dependencies:

[dependencies]
clap = { version = "4.0", features = ["derive"] }
ctrlc = "3.0"

The Source (main.rs):

use clap::Parser;
use std::fs::{File};
use std::io::{self, BufRead, BufReader, Write};
use std::path::Path;
use std::process::{Command, Stdio};
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::Arc;

// ================= CONFIGURATION =================
// Target: "BunnyName123"
const SIG_ASCII: &str = "42756e6e794e616d65313233";               
// Target: "B.u.n.n.y.N.a.m.e.1.2.3" (Wide Char)
const SIG_WIDE: &str  = "420075006e006e0079004e0061006d0065003100320033";  
const TARGET_IP: &str = "192.168.1.50";                    // Replace with target
const LOG_FILENAME: &str = "captured_traffic.txt";       
// =================================================

#[derive(Parser, Debug)]
struct Args {
    #[arg(short, long)]
    interface: Option<String>,
}

fn resolve_tshark_path() -> String {
    let common_paths = [
        r"C:\Program Files\Wireshark\tshark.exe",
        r"C:\Program Files (x86)\Wireshark\tshark.exe",
        "/usr/bin/tshark",
        "/usr/local/bin/tshark",
    ];
    if Command::new("tshark").arg("-v").stdout(Stdio::null()).stderr(Stdio::null()).status().is_ok() {
        return "tshark".to_string();
    }
    for path in common_paths {
        if Path::new(path).exists() { return path.to_string(); }
    }
    "tshark".to_string()
}

fn choose_interface(tshark_path: &str) -> String {
    println!("[*] Querying interfaces...");
    let output = match Command::new(tshark_path).arg("-D").output() {
        Ok(o) => o,
        Err(_) => panic!("Could not run tshark. Is Wireshark installed?"),
    };
    let stdout = String::from_utf8_lossy(&output.stdout);
    println!("{}", stdout);

    loop {
        print!("Select interface number (e.g. 1): ");
        io::stdout().flush().unwrap();
        let mut input = String::new();
        if io::stdin().read_line(&mut input).is_ok() {
            let trimmed = input.trim();
            if !trimmed.is_empty() { return trimmed.to_string(); }
        }
    }
}

fn main() {
    let args = Args::parse();
    let tshark_binary = resolve_tshark_path();

    let interface = match args.interface {
        Some(i) => i,
        None => choose_interface(&tshark_binary),
    };

    let mut log_file = File::create(LOG_FILENAME).expect("Failed to create log file");

    println!("=================================================");
    println!("ACTIVE MONITORING");
    println!("Filter IP:   {}", TARGET_IP);
    println!("Target Sig:  BunnyName123");
    println!("Logging to:  {}", LOG_FILENAME);
    println!("Interface:   {}", interface);
    println!("=================================================");

    let running = Arc::new(AtomicBool::new(true));
    let r = running.clone();
    ctrlc::set_handler(move || {
        println!("\nStopping...");
        r.store(false, Ordering::SeqCst);
    }).expect("Error setting Ctrl-C");

    let mut child = Command::new(&tshark_binary)
        .args([
            "-i", &interface,
            "-l", "-n", "-x",
            "-Y", &format!("ip.dst == {} || ip.src == {}", TARGET_IP, TARGET_IP)
        ])
        .stdout(Stdio::piped())
        .stderr(Stdio::inherit())
        .spawn()
        .expect("Failed to start tshark");

    let stdout = child.stdout.take().expect("Failed to capture stdout");
    let reader = BufReader::new(stdout);

    let mut raw_packet_lines: Vec<String> = Vec::new();
    let mut searchable_hex = String::new();
    let mut packet_count = 0u64;

    for line in reader.lines() {
        if !running.load(Ordering::SeqCst) { break; }

        if let Ok(text) = line {
            let trimmed = text.trim();

            if trimmed.is_empty() || text.starts_with("Frame ") {
                if !raw_packet_lines.is_empty() {
                    process_packet(
                        &mut packet_count,
                        &searchable_hex,
                        &mut log_file
                    );
                    raw_packet_lines.clear();
                    searchable_hex.clear();
                }
            }

            if !trimmed.is_empty() {
                raw_packet_lines.push(text.clone());
                if is_hex_dump_line(&text) {
                    searchable_hex.push_str(&extract_hex_bytes(&text));
                }
            }
        }
    }
    let _ = child.kill();
    println!("\n[Done] Total packets captured: {}", packet_count);
}

fn process_packet(count: &mut u64, clean_hex: &str, file: &mut File) {
    *count += 1;

    // Convert to ASCII for logging
    let ascii_content = hex_to_clean_ascii(clean_hex);
    if !ascii_content.is_empty() {
        let _ = writeln!(file, "{}", ascii_content);
    }

    // Real-time alerts
    let found_ascii = clean_hex.contains(SIG_ASCII);
    let found_wide = clean_hex.contains(SIG_WIDE);

    if found_ascii || found_wide {
        println!("\n[!!!] TARGET FOUND in Packet #{}", count);
        if found_ascii { println!("      -> Matched ASCII: BunnyName123"); }
        if found_wide  { println!("      -> Matched WIDE:  B.u.n.n.y.N.a.m.e..."); }
    }
}

fn is_hex_dump_line(line: &str) -> bool {
    if line.len() < 6 { return false; }
    let start = &line[..4];
    if !start.chars().all(|c| c.is_ascii_hexdigit()) { return false; }
    true
}

fn extract_hex_bytes(line: &str) -> String {
    let mut hex_string = String::new();
    let end_idx = if line.len() > 54 { 54 } else { line.len() };
    let start_idx = if line.len() > 6 { 6 } else { 0 };
    if start_idx >= end_idx { return String::new(); }

    let sub = &line[start_idx..end_idx];
    for c in sub.chars() {
        if c.is_ascii_hexdigit() {
            hex_string.push(c.to_ascii_lowercase());
        }
    }
    hex_string
}

fn hex_to_clean_ascii(hex_str: &str) -> String {
    let mut ascii = String::with_capacity(hex_str.len() / 2);
    let chars: Vec<char> = hex_str.chars().collect();

    for chunk in chars.chunks(2) {
        if chunk.len() == 2 {
            let s: String = chunk.iter().collect();
            if let Ok(byte) = u8::from_str_radix(&s, 16) {
                if byte >= 32 && byte <= 126 {
                    ascii.push(byte as char);
                } else {
                    ascii.push('.');
                }
            }
        }
    }
    ascii
}

Conclusion

This project demonstrates the power of Rust as "Glue Code." We didn't need to handle complex C++ pointers or write kernel drivers. We leveraged the industry-standard tool (Wireshark) and wrapped it in Rust's memory safety, powerful string manipulation primitives, and concurrency models.

The result is a tool that runs anywhere, captures live traffic, and alerts us immediately when our bunny hops onto the network.

I Built a Command-Line Spy++ to Log Windows Messages. Here's How.

Bored — Mon, 28 Jul 2025 23:02:51 +0000

If you've ever done serious Windows development, you've probably used or at least heard of Spy++. It's a classic tool, bundled with Visual Studio, that lets you see the torrent of window messages flying around an application in real-time. It's an indispensable utility for debugging stubborn UI problems.

But it has one major limitation that always bothered me: you can't easily export the message stream.

You can watch messages go by, but you can't save them to a file for later analysis, comparison, or to use as the basis for an automation script. I wanted a tool that could do just that—a "Spy++ for the terminal."

So, I built NotSpy++. This is the story of how it works, the problems I solved along the way, and where it could go next.

The Goal: A "Message Logger"

The mission was simple:

Target any running application by its Process ID (PID).
Hook the process and start capturing its window messages.
On exit (Ctrl+C), dump all captured messages to a file.
Offer both a high-performance binary format and a human-readable JSON format.

How It Works: The Architecture

You can't just "read" messages from another process. Windows security boundaries prevent that. To get inside, you need a legitimate mechanism to execute your own code within the target's memory space. For this, we use the Win32 API's global hooks.

The architecture has two main components:

The Controller (NotSpy.exe): This is the user-facing command-line tool. It finds the target process, sets up the communication channel, and installs the hook.
The Hook DLL (Hook.dll): This is a small dynamic library that Windows automatically injects into the target application's process when the hook is set. This DLL contains the code that actually runs alongside the target, capturing its messages.

The flow looks like this:

[ You ] ---> Runs `NotSpy64.exe <PID>`
   |
   +-----> [ NotSpy64.exe (Controller) ]
             | 1. Creates a Shared Memory block.
             | 2. Gets a handle to the Hook DLL and the address of the hook procedure within it.
             ` 3. Calls SetWindowsHookEx(..., hookProcAddress, dllHandle, threadId)
                    |
                    V
        [ Target Process (e.g., notepad.exe) ]
          | 1. The Windows OS sees the hook, finds `Hook64.dll` on disk, and loads it into Notepad's process space.
          | 2. The Hook Procedure inside the DLL starts executing on every message.
          | 3. It writes the captured message data into the Shared Memory block.
          `--------------------------------------------------+
                                                             |
             <-- Reads data from Shared Memory on exit <--+

The Communication: Shared Memory

The hook DLL is running inside the target process, and the controller is running in its own. How do they talk? Standard output (printf, cout) from the DLL won't go to your console.

The classic solution is Shared Memory. The controller uses CreateFileMapping and MapViewOfFile to create a block of memory that can be accessed by both processes. The DLL gets a handle to this same memory block and writes the MessageInfo structs directly into it.

// From Shared.h - The data structure we pass back and forth
const int MAX_MESSAGES = 100000; // Buffer for 100k messages

struct MessageInfo {
    char   type;         // 'P' for Pre-processing, 'R' for Result (post-processing)
    HWND   hwnd;
    UINT   message;
    WPARAM wParam;
    LPARAM lParam;
    LRESULT result;      // Only used for post-processing messages
};

struct SharedData {
    int count; // How many messages have we captured?
    MessageInfo messages[MAX_MESSAGES];
};

Hurdles & Evolutions

Building this wasn't a straight line. Here are some of the key challenges that shaped the final program.

Challenge 1: The 32-bit vs. 64-bit Divide

This was the first major roadblock. I compiled my tool as 64-bit and tried to spy on a 32-bit application. It failed silently. SetWindowsHookEx returned NULL, and GetLastError() wasn't much help. Why?

The Golden Rule: The architecture of your injected DLL must match the architecture of the target process.

A 32-bit process can only load 32-bit DLLs.
A 64-bit process can only load 64-bit DLLs.

My 64-bit Controller was trying to use a hook that would require loading a 64-bit DLL into a 32-bit process. Windows correctly forbids this.

The Solution: Compile everything twice. The project now produces two full sets of binaries:

NotSpy32.exe & Hook32.dll for spying on 32-bit targets.
NotSpy64.exe & Hook64.dll for spying on 64-bit targets.

The C++ source code is identical for both; we just use the different Visual Studio command prompts to compile for each architecture.

At this point i could already log Messages from the target process, but i wanted to get more info from the stream

Hook installed. Capturing messages...
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3943046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3943062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3944031,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3944062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3945046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3945062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3946046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3946062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3947046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3947062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":14,"message_name":"MSG_ID_14","time":3947359,"wParam":0},
{"hwnd":656982,"lParam":50126892,"message_id":13,"message_name":"MSG_ID_13","time":3947359,"wParam":7},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3948046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3948046,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3949046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3949078,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3950046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3950062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3951046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3951062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3952046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3952062,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":14,"message_name":"MSG_ID_14","time":3952375,"wParam":0},
{"hwnd":656982,"lParam":50126892,"message_id":13,"message_name":"MSG_ID_13","time":3952375,"wParam":7},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3953031,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3953031,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3954031,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3954046,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3955046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3955046,"wParam":0},
{"hwnd":919308,"lParam":50131860,"message_id":70,"message_name":"MSG_ID_70","time":3955937,"wParam":0},
{"hwnd":329592,"lParam":50131860,"message_id":70,"message_name":"MSG_ID_70","time":3955937,"wParam":0},
{"hwnd":656982,"lParam":50131860,"message_id":70,"message_name":"MSG_ID_70","time":3955937,"wParam":0},
{"hwnd":919308,"lParam":50131860,"message_id":71,"message_name":"MSG_ID_71","time":3955937,"wParam":0},
{"hwnd":329592,"lParam":50131860,"message_id":71,"message_name":"MSG_ID_71","time":3955937,"wParam":0},
{"hwnd":656982,"lParam":50131860,"message_id":71,"message_name":"MSG_ID_71","time":3955937,"wParam":0},
{"hwnd":919308,"lParam":7720,"message_id":28,"message_name":"MSG_ID_28","time":3955937,"wParam":1},
{"hwnd":329592,"lParam":7720,"message_id":28,"message_name":"MSG_ID_28","time":3955937,"wParam":1},
{"hwnd":656982,"lParam":7720,"message_id":28,"message_name":"MSG_ID_28","time":3955937,"wParam":1},
{"hwnd":656982,"lParam":0,"message_id":134,"message_name":"MSG_ID_134","time":3955937,"wParam":1},
{"hwnd":656982,"lParam":0,"message_id":6,"message_name":"MSG_ID_6","time":3955937,"wParam":1},
{"hwnd":329592,"lParam":656982,"message_id":647,"message_name":"MSG_ID_647","time":3955937,"wParam":23},
{"hwnd":656982,"lParam":-1073741809,"message_id":641,"message_name":"MSG_ID_641","time":3955937,"wParam":1},
{"hwnd":329592,"lParam":1073741824,"message_id":641,"message_name":"MSG_ID_641","time":3955937,"wParam":1},
{"hwnd":919308,"lParam":1073741824,"message_id":641,"message_name":"MSG_ID_641","time":3955937,"wParam":1},
{"hwnd":656982,"lParam":0,"message_id":642,"message_name":"MSG_ID_642","time":3955937,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":7,"message_name":"WM_SETFOCUS","time":3955937,"wParam":0},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3956046,"wParam":2},
{"hwnd":656982,"lParam":0,"message_id":127,"message_name":"MSG_ID_127","time":3956046,"wParam":0},
{"hwnd":656982,"lParam":49480547,"message_id":132,"message_name":"MSG_ID_132","time":3956109,"wParam":0},
{"hwnd":656982,"lParam":49415011,"message_id":132,"message_name":"MSG_ID_132","time":3956109,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956109,"wParam":656982},
{"hwnd":656982,"lParam":48890728,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":48890728,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956125,"wParam":656982},
{"hwnd":656982,"lParam":48104301,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":48104301,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956125,"wParam":656982},
{"hwnd":656982,"lParam":47514482,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":47514482,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956125,"wParam":656982},
{"hwnd":656982,"lParam":47055733,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":47055733,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956125,"wParam":656982},
{"hwnd":656982,"lParam":46465915,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":46465915,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956125,"wParam":656982},
{"hwnd":656982,"lParam":45482882,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":45220741,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956125,"wParam":656982},
{"hwnd":656982,"lParam":45089670,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":44827527,"message_id":132,"message_name":"MSG_ID_132","time":3956125,"wParam":0},
{"hwnd":656982,"lParam":33554433,"message_id":32,"message_name":"MSG_ID_32","time":3956140,"wParam":656982},

Challenge 2: Making the Output Truly Useful

A raw binary dump is fast but unreadable. For debugging, I needed something I could actually look at. This led to adding a JSON output option.

When the user runs NotSpy.exe 1234 --json, the program sets a flag. On exit, instead of just dumping the messages.dat file, it iterates through the captured MessageInfo structs and builds a beautiful JSON array using the fantastic nlohmann/json single-header library. This also includes mapping the integer message codes (like 512) to their string names (WM_MOUSEMOVE) for maximum readability.

This gives the user the best of both worlds:

messages.dat: Super-fast, low-overhead binary capture. Perfect for performance-critical logging or for a replay tool to read.
messages.json: Human-readable, detailed output. Perfect for manual inspection and analysis.

[
    {
        "type": "P",
        "hwnd": 131362,
        "message_id": 512,
        "message_name": "WM_MOUSEMOVE",
        "wParam": 0,
        "lParam": 12583546,
        "decoded_params": {
            "x": 602,
            "y": 192
        }
    },
    {
        "type": "R",
        "hwnd": 131362,
        "message_id": 132,
        "message_name": "WM_NCHITTEST",
        "wParam": 0,
        "lParam": 12583546,
        "result": 1,
        "decoded_params": {
            "x_screen": 602,
            "y_screen": 192,
            "result_name": "HTCLIENT"
        }
    }
]

How to Use It

The project is available on GitHub: https://github.com/qwerty32123/NotSpy

You can either build it yourself or grab a pre-compiled version from the Releases page.

1. Build (from source):
You'll need Visual Studio's command-line tools.

REM --- For 32-bit ---
cl /LD src\Hook.cpp src\Hook.def user32.lib /Fe:Hook32.dll
cl /EHsc /Iinclude src\NotSpy.cpp /Fe:NotSpy32.exe user32.lib gdi32.lib

REM --- For 64-bit ---
cl /LD src\Hook.cpp src\Hook.def user32.lib /Fe:Hook64.dll
cl /EHsc /Iinclude src\NotSpy.cpp /Fe:NotSpy64.exe user32.lib gdi32.lib

2. Run:
Find the PID of your target app from Task Manager. Make sure to check its architecture (in the Details tab, right-click the columns header, select "Architecture").

# Spy on a 64-bit app and save to binary (default)
NotSpy64.exe 12345

# Spy on a 32-bit app and save to JSON
NotSpy32.exe 9876 --json

Now, just use the target application. Move the mouse, click, type—all the messages are being logged. When you're done, hit Ctrl+C in the terminal to stop and save the file.

The Future: What's Next?

This tool is functional, but it's also a great foundation for more features. Here are some ideas I've been thinking about:

Message Filtering: Allow the user to specify which messages to include or exclude (e.g., --ignore=WM_MOUSEMOVE) to reduce log file size.
Real-time Streaming: Instead of saving on exit, stream the JSON output to the console in real-time.
A Simple TUI: Use a library like ncurses or FTXUI to build a Text-based User Interface that looks more like the classic Spy++.
An "All-in-One" Launcher: This is the big one. A single launcher (NotSpy.exe) that detects the target process's architecture and automatically runs the correct NotSpy32.exe or NotSpy64.exe helper process. This would eliminate the need for the user to manually check the target's architecture, vastly improving usability.

This project was a fantastic dive into the depths of the Win32 API, and it resulted in a tool I've already found truly useful. If any of these ideas sound interesting, I'd love to see contributions!

Check out the full source code and releases on GitHub:
https://github.com/qwerty32123/NotSpy

Thanks for reading