Can I know which function from which dll was called at runtime?

Question

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:

1. which functions are called from which DLL in runtime.
2. Is there a debugger that lets me know what code was executed between two timestamps?

Thanks in advance!

Answer 1

Looks like you're looking for process monitoring tools. Those are tools that use techniques like Hooking (and similar) to generate a runtime list of APIs or events caused by the monitored process.

First, I would like to recommend the set of tools coming with Microsoft's Sysinternals suite. Specifically, Process Monitor, which is a tool that monitors file, network, registry and process manipulation events. It has several filtering abilities and is generally pretty nice and very well known. The sysinternals suite includes many other relevant tools, and you should definitely get comfortable with it if you're interested in reverse engineering.

Second, personally I'm a huge fan of Rohitab's API Monitor. It has multiple API hooking engines and collects full information of each API. It has extensive filtering but might be a bit overwhelming at first if many APIs are selected for monitoring. It's a great place to start investigating a piece of software!

EDIT

Although both tools are extremely helpful, they won't be able to log internal functions, such as functions inside the main executable or accompanying dlls. Or any function that the tool isn't familiar with before hand. This is because in order for API hooking to work, you generally need:

1. The function should be exportable from an executable and
2. The API hooking code should be familiar with the parameters the function accepts.

It appears you indeed need a debugger for this task, if you're after logging internal calls. Most good reverse engineering debuggers (such as ollydbg and x64dbg) come with functionality to trace and log all function calls. This might be a good start.

Answer 2

This isn't an exact match but a while back I wrote this https://github.com/marshalcraft/CheapoDllDependencyTool/blob/master/CheapoDllDependencyTool/bin/Debug/CheapoDllDependencyTool.exe

It's on my GitHub and will list the first generation of dependent DLL's provided an executable or dll. It's pretty basic and can't remember if I list functions or not.

There have to be much better implementations than mine I bet but this minimally works for things like seeing if web browser relies in ws2 WinSock or other things when you want to get an idea of what apis to use to do something.