Monitoring API calls

Question

I am doing some reverse engineering and want to know which APIs are called from the executable. I am mostly interested in the APIs called on a particular Windows system DLL.

I guess one way to do that is to get all APIs exposed from the DLL using dumpbin and put breakpoints on all those from Windbg.

Any other approach? This seems like lot of time if I need to monitor many system DLLs.

BTW, I am working on Windows XP and want to monitor one executable which calls some Windows system DLL functions.

Is there no good tool available to do this? I am sure this is not a rare requirement. — anand, Jun 07 '09 at 12:27

score 7 · Answer 1 · edited Feb 25 '16 at 15:40

7

http://www.rohitab.com/apimonitor/

API Monitor does exactly what you're looking for. However, there are too many API calls listed and it becomes very difficult to analyse.

Here's a downloadable screenshot.

edited Feb 25 '16 at 15:40

RolfBly

3,612
5
32
46

answered Jun 09 '09 at 05:28

Agnel Kurian

57,975
43
146
217

1

+1 the best tool I have encoutered on api hooking. thx. – Jichao Apr 02 '13 at 05:50

score 0 · Answer 2 · answered Jun 07 '09 at 12:10

0

I think you can use dependancy walker

answered Jun 07 '09 at 12:10

Ahmed

7,148
12
57
96

dependency walker list dependencies statically. – anand Jun 07 '09 at 12:12
the latest version does dynamic profiling of DLL loading at run-time – Jun 07 '09 at 12:19

score 0 · Answer 3 · answered Jun 08 '09 at 10:10

0

Use the Win32 Kernel Hooking apis, exported by ordinal since NT4
codeproject 'article' is completely obsolete...

answered Jun 08 '09 at 10:10

I just had a look at your other answers, and what I see inspires complete confidence indeed. – mghie Jun 12 '09 at 10:55

mghie · Answer 4 · 2009-06-07T12:34:46.140

-1

This CodeProject article dealing with API hooking may be helpful to you.

There are also tools available, like APISpy32 or SpyStudio.

edited Jun 07 '09 at 12:34

answered Jun 07 '09 at 12:14

mghie

32,028
6
87
129

Monitoring API calls

4 Answers4

Linked