Packet capturing with Packet Edit Studio is easy. At the end-user level it works simply by by clicking two buttons: one to start capturing and one to end capturing. First we need to specify a target process to log though.
Packet Edit Studio comes with a Open Process dialog to give an simple yet informative view to process selection.
To get to this dialog you only have to click the "Open Process" button located in the top left of PEStudio:
This will display the Open Process Dialog. Processes will be shown in the left hand list window:
Each process is displayed by its icon, process name, and process id. Double clicking on a process' icon will set Packet Edit Studio to target that process for packet logging.
Single clicking on a process in the list will reveal more information about the process on the right side of the Open Process Dialog:
Probably the most useful feature of this dialog is the "OpenProcess" field on the Porcess Information group. This tells you whether or not Packet Edit Studio will be able to inject itself into the process or not. Most applications will pass this test. Some however, such as those that operate in kernel mode will not.
Another useful feature is the "Associated Windows" list. This will tell you all the open windows that the process created. If you know the window name you want to log, but you do not know the process name, this can help you find the right process.
For a quick alternative to the Open Process Dialog, you can use the drop down list, located on the "Open Process" button:
After a process is selected (I chose firefox.exe) you can instruct Packet Edit Studio to begin capturing packets. This is accomplished with the toolbar on the "Trace Console". To begin capturing press the "play" button":
Once this button is clicked its state will either be down if PEStudio successfully hooked the process, or it will be up if there was a failure. There are two major reasons for a failure:
If it was successful the button should look like:
Notice that the pause button and stop button have also been enabled. The pause button will allow you to temporarily stop capturing packets, however it will not cause the current logging session to be ended. When you hit play again the logging session will be resumed.
The stop button will cause the current logging session to end, however the PEStudio dll will remain inside the target process until a new logging session is created for a new application or if the PEStudio application exits.
After selecting a process and starting the logger as described above, play around with the target application in some way that would cause data to be sent across the network. For my example I have selected firefox.exe, so I am going to go into firefox and visit www.google.com.
Now looking back to the PEStudio application we can see in the "Trace Console" that packets were captured:
When you are done logging, and want to analyze the packets click the stop button:
This will bring up a packet list document containing all the packets that were captured.