Monitor all changes done by function

Question

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the debugger before a function is executed and compare with the changes after.

How can it be accomplished?

Thank you,

Answer 1

Set hooks at all memory allocation functions, mark all writeable memory pages as guard pages. Handle all the STATUS_GUARD_PAGE_VIOLATION exceptions caused by the code when it tries to write.

Answer 2

Let's assume You only need to see the changes, and not to understand what they are and how/why they were made

You can do something like this:

1. Start process under debugger and run to the specific start of the function. Put breakpoint on the end of function as well Suspend all other threads.

2. Perform full process memory dump

   2.1 For windows - use windbg command .writemem c:\output\start_address.dmp start_address end_address. Or use procdump: https://docs.microsoft.com/en-us/sysinternals/downloads/procdump

   2.2 For linux - use cat /dev/[pid]/maps and then from GDB make dumps:

   dump memory /output/memory_start_address start_address end_address

3. Run to the end of function, perform [2] again in another directory

4. Compare between two dumps to see all the changes [Notepad++]
5. If needed - confirm your findings with RE of the function.

Good luck

D.L.