I want to monitor specific process with API Monitor but I didn't understand how do I do it please.
I will happy to understand that.
By the way, can I monitor process while I debugging it with ida?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Don't forget to set the Breakpoints Before Call
In my example I set a filter on VirtualAlloc from Kernel32.dll
If you are seeing no results you may have to play with "Attach Using" which is by default set to "Static Import"
Another option (although not as good a choice as API Monitor in this scenario) is to use SysInternals' Process Monitor. It will record (in great detail) all activity performed by your application.
Process Monitor is a free tool from Microsoft that displays file system, registry, process, and other activities on the system. It’s an invaluable tool for troubleshooting Windows problems as well as for malware forensics and analysis tasks. The thoroughness of the tool is also weakness, as the amount of data captured by Process Monitor can easily overwhelm the analyst.
Fortunately, you can filter the output of Process Monitor, and some have even created filter-sets that you can download and load into Process Monitor, saving you the time of creating them yourself.