I want to monitor specific process with API Monitor but I didn't understand how do I do it please.

I will happy to understand that.

By the way, can I monitor process while I debugging it with ida?

  • Given your last sentence: what is it you want to achieve? (as opposed to what step do you think should be next). Oftentimes others have had to solve similar problems and they may have developed techniques which are beyond the scope of your very narrow question but work well or better than what you're trying right now.
    – 0xC0000022L
    Commented Aug 11, 2018 at 20:02
  • I want to solve reverseengineering.stackexchange.com/a/19003/23993 so I want to see how my process call to another process, whitch buffer it send to it
    – Keystone
    Commented Aug 11, 2018 at 21:18
  • Open the binary in any disassembler or decompiler. Check the import functions. With that you can get basic idea about which IPC method is used.
    – Biswapriyo
    Commented Aug 12, 2018 at 14:20
  • @Biswapriyo I didnt find any function tgat explain which ipc methode is used, so I looking to understand how to monitor process with api monitor
    – Keystone
    Commented Aug 12, 2018 at 18:42

2 Answers 2

  1. Fire up API Monitor (with the correct architecture fitting your sample)
  2. Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can use ApiLogger (https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger) enter image description here

Don't forget to set the Breakpoints Before Call

enter image description here

In my example I set a filter on VirtualAlloc from Kernel32.dll

  1. Open your sample you want to have a look at: enter image description here

If you are seeing no results you may have to play with "Attach Using" which is by default set to "Static Import"

  1. Run your sample and if everything works well you'll hit your breakpoint and you can stat to edit (and dump) the corresponding memory:

enter image description here

enter image description here

  • Thank you, is there a way only record all the api call that my exe do without set any breakpoint??
    – Keystone
    Commented Aug 13, 2018 at 18:13
  • Sure use Api Logger: aldeid.com/wiki/SysAnalyzer/ApiLogger
    – hariom
    Commented Aug 13, 2018 at 20:14
  • Is that show me api call from spesific process and the value? For example if my process write to file text: abc withApiLogger will I see the abc? Api monitor is for dynamic monitor and ApiLogger is for static monitor? Thanks
    – Keystone
    Commented Aug 13, 2018 at 21:07
  • Not sure about API logger but with API Monitor you can see the parameters and buffers passed to a function (See Point 4 of my answer). You can even export the buffer to disk and proceed from there.
    – hariom
    Commented Aug 14, 2018 at 4:13
  • @harion , I don't see the process I want to monitor in the process list bellow even this process running
    – Keystone
    Commented Aug 14, 2018 at 19:38

Another option (although not as good a choice as API Monitor in this scenario) is to use SysInternals' Process Monitor. It will record (in great detail) all activity performed by your application.

Process Monitor is a free tool from Microsoft that displays file system, registry, process, and other activities on the system. It’s an invaluable tool for troubleshooting Windows problems as well as for malware forensics and analysis tasks. The thoroughness of the tool is also weakness, as the amount of data captured by Process Monitor can easily overwhelm the analyst.

Fortunately, you can filter the output of Process Monitor, and some have even created filter-sets that you can download and load into Process Monitor, saving you the time of creating them yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.