Description: Keep track of the monitoring programme overview
Author: peng chunhua
When we track and analyze an API function for a target program, according to the tracking target, there are basically several ways to track the API functions:
Write Log analysis
If you have the source code for the target program, you can record the parameters and run results of the API at the entry point and exit points of the key API functions. This method is often seen in the debug program. The downside of this approach is that you must have the source code, and you must recompile the source code every time you modify the Log. Since the programme is different from the target we are talking about, there is no discussion here.
Inject the monitoring code into the target program
The principle of this scheme is to inject the monitoring code into the target program's process space when the target program is running. Monitoring code through the prophase preparation, modify the program to run the code, the target makes the target program calls the specified API functions and operating instructions will jump to the monitoring code, so that the operation of the monitoring code can record the API function parameters, then the monitoring code at run to API function code. After the API function code is used, return to the monitoring code, run the results in the future, and then return to the target program. The working principle is shown here:
On the 32-bit Windows platform, the process Spaces are independent. To run the monitoring code in the target program, you must inject the monitoring code into the target process. One common approach is to compile the monitoring code into a DLL and inject the DLL into the target process. There are many articles about injecting DLL into the target process,
File list (Check if you may need any files):
Download