sysinternals的dbgview想必大家都用过，我写了一个简单的，只监视user层OutputDebugString的输出，原理都包含在代码里了，希望对你有帮助，没有的话就算了：P
// DBMntor.cpp : Little dbgview。。。。
// Coder Jozu
//
#include <windows.h>
#include <tchar.h>
#include <stdio.h>
#include <stdlib.h>
#define PAGE_SIZE 4096
#define DBWIN_MAP "DBWIN_BUFFER"
#define DBWIN_WRITEVENT "DBWIN_BUFFER_READY"
#define DBWIN_READEVENT "DBWIN_DATA_READY"
typedef struct _tag_DBMap
{
DWORD dwProcessId;
CHAR szString[PAGE_SIZE - sizeof(DWORD)];
} DB_MAP, *PDB_MAP;
int main(int argc, char* argv[])
{
HANDLE hMap;
PDB_MAP pDBMap;
HANDLE hEventRead;
HANDLE hEventWrite;
HANDLE hMutex;
hMutex = CreateMutex(NULL, FALSE, "DBWinMutex");
hEventRead = CreateEvent(NULL, TRUE, FALSE, DBWIN_READEVENT);
hEventWrite = CreateEvent(NULL, TRUE, FALSE, DBWIN_WRITEVENT);
if(!hEventRead || !hEventWrite)
{
return 0;
}
hMap = CreateFileMapping(INVALID_HANDLE_VALUE,
NULL,
PAGE_READONLY,
0,
PAGE_SIZE,
DBWIN_MAP);
if(!hMap)
return 0;
pDBMap = (PDB_MAP)MapViewOfFile(hMap,
FILE_MAP_READ,
0,
0,
0);
if(!pDBMap)
{
CloseHandle(hMap);
return 0;
}
SetEvent(hEventWrite);
while(TRUE)
{
WaitForSingleObject(hEventRead, INFINITE);
printf("%d==>%s\n", pDBMap->dwProcessId, pDBMap->szString);
}
return 0;
}