Skip to main content

Overview

SerialSnoop is a non-intrusive Windows serial port monitoring tool. It captures a target process's COM reads and writes through user-mode API hooks, so it does not occupy the physical port and the program under test keeps running normally.

Capabilities​

  • Hooks CreateFile / ReadFile / WriteFile / CloseHandle and reports OPEN / CLOSE / RX / TX over a named pipe;
  • Single entry point SerialSnoop.exe picks the x64 or x86 injection component based on the target bitness;
  • Looks up which process holds a COM port, or waits until the port is opened and starts monitoring automatically;
  • Monitors several targets at once without interference;
  • HEX / ASCII / Both display modes, with session export.

Where it stops​

ScenarioApplies
Analysing traffic between a third-party program and a deviceYes
Capturing an undocumented serial protocolYes
Acting as a serial terminal to send dataNo, this tool only observes

Next​