Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Tools for Windows API Monitoring

Topic created on: October 30, 2006 22:08 CST by kris .

Can anyone recommend a tool for performing API monitoring on Windows?

I basically just want ltrace...with the ability to easily filter on the particular libraries/calls that I care about.

I've tried several, each of which has some fatal flaw:
1. rohitab.com API Monitor (Misses calls, crashes some processes on XP)
2. apimonitor.com API Monitor (Misses many calls)
3. autodebug.com Auto Debug (Can't custom define sets of calls, can't save results in free version, but probably the best I've found so far)
4. iDefense SysAnalyzer (limited API calls that it monitors, can't specify args for program being launched. Open source though, I should fix it instead of complaining ;-))

I've thought about building on top of PaiMei's hooking functionality to build my own, but before I go down that road I'd like to make sure I'm not reinventing the wheel.  

Thanks,
-Kris

  dennis     October 31, 2006 01:15.47 CST
I like the following:

http://www.nruns.com/contentarchiv/eng/nbug.zip

regards,

Dennis

  AlexIonescu     October 31, 2006 15:04.03 CST
> kris: Can anyone recommend a tool for performing API monitoring on Windows?
>

I use Detours:

http://research.microsoft.com/sn/detours/

It's hands down the best, imo.

Best regards,
Alex Ionescu

  JasonGeffner     November 1, 2006 00:14.38 CST
Though I haven't used API monitors in a long time, I used to like AutoDebug (you listed it above) and API Spy (http://www.matcode.com/apis32.htm).

  pedram     November 1, 2006 00:58.58 CST
If I recall correctly WinDbg ships with an executable, logger.exe, that can accomplish this task. I think I may have used it once in the past so don't quote me on it.

  sa7ori     November 1, 2006 11:37.51 CST
Hey Kris,
  For this purpose, I generally use windbg's logexts.dll. Logext's is really good for doing stuff that might bottleneck (like logging allocations/free's) but, it also has an module which will log specific calls into libraries you are interested in. I have included a snippit of the windbg logexts output below:
<snip>

0:003> !load logexts
0:003> !logexts.help

Windows API Logging Extensions  v2.09

Main control:
  !loge [dir]                 Enable logging. Output directory optional.
  !logi [dir]                 Initialize but don't enable logging.
  !logd                       Disable logging.

Output:
  !logo                       List output settings.
  !logo [e|d] [d|t|v]         Enable/disable output:
                                d - Debugger
                                t - Text file
                                v - Verbose log

Categories:
  !logc                       List all categories.
  !logc p #                   List APIs in category #.
  !logc [e|d] *               Enable/disable all categories.
  !logc [e|d] # [#] [#] ...   Enable/disable category #.

Buffer access:
  !logb p                     Print buffer contents to debugger.
  !logb f                     Flush buffer to log files.

Module inclusion/exclusion:
  !logm                       Display module inclusion/exclusion list.
  !logm [i|x] [DLL] [DLL] ... Specify module inclusion/exclusion list.
</snip>

  sa7ori     November 1, 2006 11:51.10 CST
> sa7ori: Hey Kris,
>   For this purpose, I generally use windbg\'s logexts.dll. Logext\'s is really good for doing stuff that might bottleneck (like logging allocations/free\'s) but, it also has an module which will log specific calls into libraries you are interested in. I have included a snippit of the windbg logexts output below:
> <snip>
>
> 0:003> !load logexts
> 0:003> !logexts.help
>
> Windows API Logging Extensions  v2.09
>
> Main control:
>   !loge [dir]                 Enable logging. Output directory optional.
>   !logi [dir]                 Initialize but don\'t enable logging.
>   !logd                       Disable logging.
>
> Output:
>   !logo                       List output settings.
>   !logo [e|d] [d|t|v]         Enable/disable output:
>                                 d - Debugger
>                                 t - Text file
>                                 v - Verbose log
>
> Categories:
>   !logc                       List all categories.
>   !logc p #                   List APIs in category #.
>   !logc [e|d] *               Enable/disable all categories.
>   !logc [e|d] # [#] [#] ...   Enable/disable category #.
>
> Buffer access:
>   !logb p                     Print buffer contents to debugger.
>   !logb f                     Flush buffer to log files.
>
> Module inclusion/exclusion:
>   !logm                       Display module inclusion/exclusion list.
>   !logm [i|x] [DLL] [DLL] ... Specify module inclusion/exclusion list.
> </snip>

P.S. I have often wondered the most efficient way to do this (since we really cant set break on access for the whole range of a dll's mapped memory). I suspect that what most tools do is set break on access at base of the export table (or dllbase), but this makes me wonder if stuff might 'cache' resolved addresses to exports in the dll we wanna monitor, and if so how to monitor those calls. especially .NET stuff...

  sa7ori     November 1, 2006 11:52.55 CST
oops, sorry didnt meant to include quoted response in that last post.... i suck at computers.

  nezumi     November 1, 2006 18:58.45 CST
did you hear about kerberos? this is very small (~96 kb) but quite powerful API-monitor able to handle the programs try to defeat any spy, monitor or debugger. check it out: http://www.wasm.ru/baixado.php?mode=tool&id=313. it's free.

  kris   November 1, 2006 20:48.01 CST
Thanks for all the replies...

Plenty of new stuff to play with!  I'll be exploring all the links (probably over the weekend) and post an update of my experiences...

  ColdWinterWind     December 31, 2006 03:36.19 CST
Try API Monitor from http://kakeeware.com - select individual/multiple API by system dll or by 'groups' (by function type).  Free, fast.  Shows API call, caller, some args.  Only thing I've seen better is TracePlus/Win32 ($$!!!!).

  xz     January 12, 2007 07:59.30 CST
If you need something more flexible:

#needs pefile.py (dbkza.org) and hooking.py (utils dir)


from pefile import *
from hooking import *
from pydbg import *
from pydbg.defines import *

import sys

num_args=4

def create_entry(name):
    def hook_entry(dbg,args):
        print "\n>> %s" % name
        for i in range(num_args):
            arg=dbg.get_arg(i)
            print "\targ %i : 0x%x" % (i,arg)
            print "\t\t", dbg.smart_dereference(arg)
        return DBG_CONTINUE
    return hook_entry


def create_return(name):
    def hook_return(dbg,args,retval):
        print "<< %s retval: 0x%x" % (name,dbg.context.Eax)
        return DBG_CONTINUE
    return hook_return


def set_hooks(dbg):
    print "setting hooks"
    hc=hook_container()
    for entry in pe.DIRECTORY_ENTRY_IMPORT:
        for func in entry.imports:
            print 'hook ',func.name," in ",entry.dll
            if entry.dll != 'kernel32.dll':
                hookadd=dbg.func_resolve_debuggee(entry.dll,func.name)
                try:
                    hc.add(dbg,hookadd, 4, create_entry(func.name), create_return(func.name))
                except:
                    print 'failed setting hook for %s' % func.name
                print 'set hook'
    print "done"
    return DBG_CONTINUE


def set_hooks2(dbg):
    print 'setting hooks'
    return DBG_CONTINUE


try:
    prog = sys.argv[1]
    pid = int(sys.argv[2])
except:
    print 'usage: %s [executable] [pid]' % sys.argv[0]
    sys.exit()

pe=PE(prog)
print "pe parsed"
dbg=pydbg()
dbg.attach(pid)
set_hooks(dbg)
dbg.run()

  tagetora   January 12, 2007 09:11.48 CST
> xz: If you need something more flexible:

This code gives me an idea about a problem I had some time ago.  I was loosing hook calls (using the hooking lib) in some API intensive appz. Maybe cross-checking results from different tools would help in the diagnostic process. I'm putting it in my to-do list ;D

  Otacon     January 18, 2007 13:23.17 CST
I recently found a program named WinAPIOverride32 which is very effective in spying on api functions(system and application independent) as well as injecting your own functions in place of the original. Other neat features is that you can choose to spy on only certain functions. This is the feature I like the most because I made a Vulnerable Function file that the program gets the functions to watch from. the file obviously includes functions such as lstrcpy, lstrcmp, sprintf, etc. Also WinAPIOverride32 has VERY good documentation and has a pretty intuitive interface. The documentation also includes some tutorials on how to use the different features (which is too many for me to list here). All-in-all I don't know if you have found the api spy that you/anybody is looking for, but this one is something that should be checked out. You can find it at http://jacquelin.potier.free.fr/winapioverride32/

--Austyn

  srw     April 30, 2007 10:37.34 CDT
Our team has recently launched a free tool to monitor API calls and interact with them (i.e: changing parameters, breaking on the call), we would be glad to hear your opinions for current & next releases. You can see the details on http://www.nektra.com/products/spystudio/index.php

srw

  c1de0x   May 14, 2007 11:31.44 CDT
Hi all,

I checked out kerberos, which seems very nice indeed (thanks nezumi).

All others don't seem to be able to trace all the functions I want, or don't attach to running processes or whatever.

I have a couple of issues with kerberos though:
- So far as I can see, it doesn't deal with multi-threading at all (beyond doing some primitive synchronization by setting a flag).
- It writes directly to a file, so how does it work when tracing file-writing APIs (i.e. how does it avoid infinite recursion?)

There is also a bit of code which I don't get, but I'll post another thread on that.

I've been working on my own hooking engine which uses hot-patch style hooking and my own pure user-mode logging engine (i.e. it never calls out of the hooking module during trace - thereby making infinite recursions impossible), but have run into a number of issues related to stack corruption.

Does anyone have a good detours based engine which can hook all exports of any library?

  b0ne     May 25, 2007 18:50.25 CDT
If you examine the code in kerberos a little more, you see the hook code set that global to 1 for "executing hook" then it changes it to 0 after it is done executing.  If you read a little further into the code, you'll see that when it makes an intercept, it restores every API back to original bytes, then on return, it places the jumps back on top of every API.  Ugly, but prevents recursion when it goes to write.

  dennis     January 28, 2008 08:58.24 CST
is there any "reliable" api monitor for kernel mode?

  modest     May 26, 2009 12:14.40 CDT
http://conus.info/gt/

Note: Registration is required to post to the forums.

There are 31,236 total registered users.


Recently Created Topics
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12
How can i find conne...
Nov/27
How can I write olly...
Oct/05


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit