0

I want to monitor specific process with API Monitor but I didn't understand how do I do it please.

I will happy to understand that.

By the way, can I monitor process while I debugging it with ida?

|improve this question
  • Given your last sentence: what is it you want to achieve? (as opposed to what step do you think should be next). Oftentimes others have had to solve similar problems and they may have developed techniques which are beyond the scope of your very narrow question but work well or better than what you're trying right now. – 0xC0000022L♦ Aug 11 '18 at 20:02
  • I want to solve reverseengineering.stackexchange.com/a/19003/23993 so I want to see how my process call to another process, whitch buffer it send to it – Keystone Aug 11 '18 at 21:18
  • Open the binary in any disassembler or decompiler. Check the import functions. With that you can get basic idea about which IPC method is used. – Biswapriyo Aug 12 '18 at 14:20
  • @Biswapriyo I didnt find any function tgat explain which ipc methode is used, so I looking to understand how to monitor process with api monitor – Keystone Aug 12 '18 at 18:42
2
  1. Fire up API Monitor (with the correct architecture fitting your sample)
  2. Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can use ApiLogger (https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger) enter image description here

Don't forget to set the Breakpoints Before Call

enter image description here

In my example I set a filter on VirtualAlloc from Kernel32.dll

  1. Open your sample you want to have a look at: enter image description here

If you are seeing no results you may have to play with "Attach Using" which is by default set to "Static Import"

  1. Run your sample and if everything works well you'll hit your breakpoint and you can stat to edit (and dump) the corresponding memory:

enter image description here

enter image description here

|improve this answer
  • Thank you, is there a way only record all the api call that my exe do without set any breakpoint?? – Keystone Aug 13 '18 at 18:13
  • Sure use Api Logger: aldeid.com/wiki/SysAnalyzer/ApiLogger – hariom Aug 13 '18 at 20:14
  • Is that show me api call from spesific process and the value? For example if my process write to file text: abc withApiLogger will I see the abc? Api monitor is for dynamic monitor and ApiLogger is for static monitor? Thanks – Keystone Aug 13 '18 at 21:07
  • Not sure about API logger but with API Monitor you can see the parameters and buffers passed to a function (See Point 4 of my answer). You can even export the buffer to disk and proceed from there. – hariom Aug 14 '18 at 4:13
  • @harion , I don't see the process I want to monitor in the process list bellow even this process running – Keystone Aug 14 '18 at 19:38
0

Another option (although not as good a choice as API Monitor in this scenario) is to use SysInternals' Process Monitor. It will record (in great detail) all activity performed by your application.

Process Monitor is a free tool from Microsoft that displays file system, registry, process, and other activities on the system. It’s an invaluable tool for troubleshooting Windows problems as well as for malware forensics and analysis tasks. The thoroughness of the tool is also weakness, as the amount of data captured by Process Monitor can easily overwhelm the analyst.

Fortunately, you can filter the output of Process Monitor, and some have even created filter-sets that you can download and load into Process Monitor, saving you the time of creating them yourself.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.