Logging Printer Activity

Hooking spoolsv.exe

Printers in an organization are an easy target for abuse. Developing an application to log printer activity requires expertise in Microsoft Windows internals. The simple code below allows you to quickly use our Deviare Interception Engine to log printer activity. The application runs on the computer the printer is connected to and logs all print jobs.

We can hook the undocumented PrvStartDocPrinterW function, similar to StartDocPrinter, inside the spoolsv.exe and use it to retrieve the name of the document being printed. If we want additional information beyond the name of the document, we can also potentially hook functions such as YSetJob, similar to SetJob, also undocumented. This requires further research. Assuming the research is done we can retrieve among other information, printer name, computer name, username, and total number of pages. This is the complete JOB_INFO_1 data structure:

  1. DWORD JobId
  2. LPTSTR pPrinterName
  3. LPTSTR pMachineName
  4. LPTSTR pUserName
  5. LPTSTR pDocument
  6. LPTSTR pDatatype
  7. LPTSTR pStatus
  8. DWORD Status
  9. DWORD Priority
  10. DWORD Position
  11. DWORD TotalPages
  12. DWORD PagesPrinted

Hooks can also be added to the GDI functions to capture document content. Documents are rendered internally in a DC (Device Context). The process must wait for all rendering operations to finish before dumping the entire DC to a file for later reviewing.

There is a market for printer loggers. If you do a quick search of this market you will find that most commercial applications log information that is similar to the one logged with this simple code. You can use the Deviare interception engine to develop your own product for this market or to rapidly customize a solution. Deviare is in charge of the complex task of intercepting binary applications. This works both on 32 and 64 bit platforms. If you want an advantage over the competition you can add GDI hooking to log all content being printed.
Microsoft Windows also adds event logging for printing services. See Enable or disable logging of printing events. To log additional information you will need to use hooking.

The above techniques can also be used to develop other interesting printer applications such as:

  1. User-based print job quotas can be used to enforce organizational policies related to printer usage.
  2. Ink usage can be monitored. Organizations with large printing facilities can statistically correlate the ink consumption of their different printer models. Google did a similar study with hard drives and published it online as Failure Trends in a Large Disk Drive Population.

Code

This code is for 64 bit systems. Follow these steps:

  1. Download and install the Nektra’s Deviare interception engine
  2. Retrieve the code
  3. Copy the following Deviare files to binx64Debug and binx64Release

Nektra.Deviare2.dll
DeviareCOM64.dll
DeviareCOM64.X.manifest
DvAgent.dll
DvAgent64.dll
Deviare32.db
Deviare64.db

  1. Run Visual Studio as Administrator (Visual Studio 2008 and Visual Studio 2010 solutions included)
  2. Run the project
  3. Print something

Additional Resources

  1. Deviare hook engine quickstart
  2. GDI Print API Functions
  3. StartPage function
  4. Windows 2003 Print Log Parsing Script

Related Services

  1. Reverse Engineering
  2. Interception and Filter Drivers Services
  3. Application Virtualization and Packaging
  • http://blog.databigbang.com Sebastian Wain

    Good comment thread on Windows Management Instrumentation and other printer logging functions at: 
    http://www.reddit.com/r/ReverseEngineering/comments/ttp9u/logging_printer_activity_using_a_hook_engine/

  • Jacob Swanner

     

    I high appreciate this post. It’s hard to find the good from
    the bad sometimes but I think you’ve nailed it! would you mind updating your
    blog with more information?

    http://scarprin.biz/

  • For more info click here

    Lots of Good information in your post,

    I favorited your blog post so I can

    visit again in the future, Thanks.

  • For more info click here

    Hi – It’s good to read such interesting

    stuff on the Internet as I have been

    able to discover here. I agree with

    much of what is written here and I’ll

    be coming back to this website again.

    Thanks again for posting such great

    reading material!!

    For more info http://www.scarprin.com/

  • mena99260

    How to Export suggested contacts to an excel file from Outlook 2007 Also Custom Fields !

    cookware
    sets

    http://www.danscookware.com

  • mena99260

    How to Export suggested contacts to an excel file from Outlook 2007 Also Custom Fields !
    grigoro
    adynatisma

  • mena99260

    I would like to thank you for your best written post, its informative and your writing style helped me to read it till end.
    Discover More Here

  • mena99260

    In November 2012, the task force published a report calling for action
    on better engagement between business schools, MSBs, Government and the
    wider business community.

    Ft
    Lauderdale Escorts

    http://www.mazemodels.com/ft-lauderdale-escorts.php

  • mena99260

    In November 2012, the task force published a report calling for action
    on better engagement between business schools, MSBs, Government and the
    wider business community.
    natural
    cures allergies

  • mena99260

    In November 2012, the task force published a report calling for action
    on better engagement between business schools, MSBs, Government and the
    wider business community.
    twitter account

  • Ashar Arain

    Hi – It’s good to read such interesting

    stuff on the Internet as I have been

    able to discover here. I agree with

    much of what is written here and I’ll

    be coming back to this website again.

    Thanks again for posting such great

    reading material!!..
    Free PDF Links

  • Imtiaz Ali

    i cant get it working for some reason and that
    is a bloody shame as its a very clean theme
    http://www.check-this-out.eu/

  • Imtiaz Ali

    working for some reason and that
    is a bloody shame as its a very clean theme .
    Printerest account

  • Aisha Malik

    business get started with a successful social networking campaign.
    punching heavy bag

  • Imtiaz Ali

    indows Management Instrumentation and other printer logging functions at:
    delhi to jaipur
    cab

  • Imtiaz Ali

    Management Instrumentation and other printer logging functions at:.
    what is
    shared hosting

  • Imtiaz Ali

    It will always be interesting to read articles from other writers and practice something from other sites…

    car rental
    jaipur

  • Imtiaz Ali

    Want
    Higher Ranking In Google?? Nothing Is Better Than HIGH PR BLOG COMMENTING
    SERVICE. Google Love These Kinds Of Back Links Because Your Website Is
    Linking To Authority Site That Is Already Index In Search Engines. This
    Service Is A WIN For Both Your Site, And Sites Where We Will Place Your Link
    With Additional Unique Content.

    backlinks service

  • Ashar Arain

    Thank you very much! My friends and family members will be happy after hearing about this…
    free credit reports from all 3 bureaus

  • Imtiaz Ali

    Already Index In Search Engines. This
    Service Is A WIN For Both Your Site,

    one piece

  • Imtiaz Ali

    Advanced settings, under Hidden files and folders, click Show hidden files and folders.Click the View tab,
    northern kentucky divorce attorney

  • imtiaz

    The second is our worker thread where we create an output window to
    print our messages and a Deviare Event Proxy to process functions’
    calls.

    email lists

  • imtiaz

    API calls so you can see what modules is slowing down an application…
    car from delhi to
    jaipur

  • https://twitter.com/SeoComenting SEO Commenting

    The state should be providing all of this from the start. Veterans should not be struggling with this for so long. They deserve all the best from their country. psd-loft.com

  • imtiaz

    All the Bundesliga promises a large amount of action the year of 2010,
    with nearly four teams in a position to competing for those prize.
    Germany’s potent showing inside the 2006 Country Cup helped enhance the
    league on the eyes of spectators,
    start a blog
    on wordpress

  • imtiaz

    It warms my heart to hear a father express his emotions for his child
    and the examples his father gave him. All children and fathers deserve
    special memories.

    drug and alcohol
    rehab

  • imtiaz

    The state should be providing all of this from the start. Veterans should not be struggling with this for so long.
    bulk email lists

  • peterseo

    either brushing on a clear coat material or spraying the clear coat
    evenly around the clay item. You should always clean the clay project
    thoroughly before applying
    .
    business email list

  • https://twitter.com/SeoComenting John SEO

    I appreciate everything you have added to my knowledge base.Admiring the
    time and effort you put into your blog and detailed information you
    offer Thanks.
    Grami
    Dermatology Club

  • https://twitter.com/SeoComenting John SEO

    I appreciate everything you have added to my knowledge base.Admiring the
    time and effort you put into your blog and detailed information you
    offer Thanks.
    salvia for sale

  • https://twitter.com/SeoComenting CanadiaN WeB HosT

    I was looking at some of your posts on this website and I conceive this web site is really instructive! Keep putting up.
    top blogging sites

  • robinjack529

    Nice site. On your blogs very interest and i will tell a friends.Now we know who the ssebnile one is here…..
    Logo

  • imtiiz seo

    Veterans should not be struggling with this for so long.

    car
    from delhi to jaipur

  • robinseo

    We Are A
    Full-Service Provider Of High Quality Backlinks That Help Boost Traffic,
    Increase Rankings, And Build Authority. With Years Of Experience We Know
    Exactly What Type Of Manual Dofollow Blog Comments It Takes To Quickly
    Increase Your Online Visibility

    manual backlinks

  • Anas Qureshi

    come across your excellent blog. Your blog brings me
    carpet cleaning mesa
    a great deal of fun.. Good luck with the site

  • AJ seo1

    for my needs. It contains wonderful and helpful posts. ..

    custom home builders in rexburg idaho

  • anasqureshi

    These kinds of blog posts maintains the people interest on the website, and keep on writing a little more.
    official
    website

  • AJ seo1

    maintains the people interest on the website, and keep on writing a little more…
    vector logo

  • Jack Man

    Deviare Interception Engine to log printer activity. The application runs on the computer the printer is connected
    euromillions

  • robinjack529

    HFTs add substantially to the price formation process as they tend to follow a price reversal strategy (irrespective of whether
    do
    you want blog comments

  • robinjack529

    It is an open secret that the Spanish jobless rate – double the European
    average – is a fiction. Hundreds of thousands of people claim
    unemployment benefit when they actually have some kind of work; millions
    are not registered as working, which means that neither they nor their
    employers are paying social security contributions. One proof, say
    employers,
    blog comments back
    links

  • johnjohn

    Starting your own house Based Business is extremely easy to complete and may take the stress off your own already more than burdened earnings. http://www.americanbusinessicon.net
    Small as well as medium businesses around the globe have numerous issues as well as challenges they face every day, with room often becoming quite at the top of the checklist. http://www.businesser.net
    Honeymoon visit on cruise is really a dream of a lot of us. This post describes a few useful ideas and recommendations on ways to get cheap luxury cruise deals for the honeymoon. http://www.advancetourandtravel.net

  • johnjohn

    This simple veg parmesan cheese wrap is the greatest and trendy method to make your kids eat veggies. This home-made cover is full of nutrients and lower in fat as well as sodium content material. Healthy for those ages. http://www.veghealth.net

  • jesus phrak

    great share for logging printer. I use printer so I think I will need this help. It looks perfect. dungeon trackers hack apk

  • loferboy

    What I love the most in your writing style is, the simplicity of your
    language. You’ve mastered to write great blog posts.. You always shared
    some useful info..
    More Bonuses