Intercepting data sent to a Windows printer (using RedMon)

Question

I need to intercept data being sent to a ESC/POS printer on Windows and analyze it.

So I wanted to get the data in plain text, so that I can extract and make sense of information being sent to the printer.

Currently, I have tried using RedMon to get the data stream being sent to the printer port. But the data being sent is in the form of raster graphics i.e. dots to be printed, embedded within ESC/POS commands.

So I was wondering if somebody can suggest me on how can I get the print data in text format so as to be able to extract some information from it.

Answer 1

The data which is sent to a ESC/POS printer IS raster data embedded with ESC/POS commands. This is what the ESC/POS printer driver generates from its input. And that's what RedMon catched for you.

Seems you want to see the input sent to the printer driver. That means you'll have to find out which applications do use the printer and you have to intercept what arrives at the printer driver.

You do not say if you want to set up your interception in a 'live' environment, or if it is for temporary testing only. If you want to test temporarily, you could alternatively do the following steps:

1. Pause the print queue (upper screenshot, below).
2. Optionally: change the driver away from ESC/POS to, say PostScript or Microsoft XPS. Do this on the same "Advanced" tab on the printer properties dialog as mentioned above. (lower screenshot on the right, below).
3. Print.
4. Retrieve the spoolfile waiting in the spool directory. On Windows 8 this is by default C:\Windows\System32\spool\PRINTERS. The spoolfile is named NNNNN.spl where NNNNN is the number of the current printjob.
5. Analyze the PostScript or XPS data.

See these 3 screenshots:

  

---

However, it would be much easier (instead of using RedMon) if you...

• ...simply enable the printer driver setting called "Keep printed documents": go to print queue properties => select "Advanced" tab => enable respective checkbox (see left screenshot, above);

• ...fish spooled printjob from the windows print spool directory;

• ...analyze your NNNNN.spl file:

  • on Windows 8 this will be an XPS file. Re-name it to NNNNN.xps and you can open it with the builtin XPS viewer.

  • on previous version of Windows, the NNNNN.spl will have the file format of the respective printer driver (PostScript for PostScript drivers, XPS for Microsoft XPS printer, ESC/POS for your printer, ...). Rename it accordingly and open it in XPS or PostScript viewer.