0

I am trying to monitor Windows API calls. I have read about it and found there is no easier way to monitor API calls system wide than by using kernel drivers. I was wondering if there is any other method to do this system wide? Also if anyone knows of some tutorial on how to monitor API calls using kernel drivers?

I have looked at Microsoft detours and other hooking options but they don't provide for system wide hooking. Also there are other methods which only work for user32.dll

Prathamesh nale
  • 11

2 Answers2

0

Kernel drivers, who have access to all processes and system calls, are one method for monitoring Windows API calls system-wide. However, there are alternative methods, such as the following:

  • ETW (Event Tracing for Windows) - ETW is a high-performance event tracing framework for monitoring various system events, including API calls.
  • Performance Monitoring Counters can track various system performance metrics, such as API call counts and performance.
  • Inline Hooking - Another technique for monitoring API calls is inline hooking, which involves overwriting the first few instructions of an API function to redirect execution to a custom handler.

The Windows Driver Kit (WDK) documentation, which provides a comprehensive guide on writing and deploying kernel drivers in Windows, contains a tutorial on monitoring API calls using kernel drivers.

It is important to note that monitoring API calls can have security implications because it requires access to system-level data and functions. It is advised to use these techniques with caution and to put proper security measures in place.

Here are some resources that you can use to learn more about Windows API call monitoring:

These resources should provide a good starting point for learning about Windows API call monitoring.

2MuchC0ff33
  • 156
  • 4
  • Thanks for the reply. I have used ETW for monitoring file and registry operations. But using crypto provider in ETW doesn't give any output even when API monitor is showing API calls are made. Also I couldn't find anything where inline hooking is used as system wide thing. – Prathamesh nale Feb 02 '23 at 06:00
  • You're very welcome! I have added another answer and found additional resources for you. – 2MuchC0ff33 Feb 02 '23 at 23:55
0

Concerning the use of ETW for monitoring API calls, it is possible that some API calls are not emitted by the system by default and must be enabled manually. If you can't find the API calls you want in the ETW trace, try configuring the trace to include the provider that exposes the events for the desired API calls. To get an output from a crypto provider in ETW, enable it and start a trace session to collect the events emitted by the provider. here are some online references for getting started with ETW and crypto providers:

Windows Driver Kit (WDK) - ETW: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/etw/

MSDN - CryptoAPI: https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptoapi

MSDN - How to Trace Cryptographic Operations with Event Tracing for Windows (ETW): https://docs.microsoft.com/en-us/windows/win32/etw/how-to-trace-cryptographic-operations-with-etw

Code Project - Using Event Tracing for Windows (ETW) to Debug Applications: https://www.codeproject.com/Articles/1000189/Using-Event-Tracing-for-Windows-ETW-to-Debug-App

2MuchC0ff33
  • 156
  • 4