Runtime memory reading with injection

Question

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application.

My desired values of that function are:

• [ESP + 4] which is the length of a buffer
• [ESP + 8] which is a pointer to a string buffer

Then I want to read the buffer and write it into a file.

First thing I was told to use is Immunity's LogBpHook, which worked great, but it stops the application and it becomes really slow due to this, because it's a frequently called function.

Then I tried to setup FastLogHook which sounds more like what I'm after. It injects a log stub and stores encountered values, but as far as I know it can not perform further memory readings like the one I described above anyway (if it can please tell me). Also it constantly crashed my application so it's out of the question.

So I left with the idea of injecting a customized code stub that would take care of further readings and logging of the values into a file. Is there any tool that could do this, or I have to manually write+inject this assembly?

How can I log function parameters runtime, without stopping the application?

Answer 1

1. You can write your hooking library (DLL) which will patch the API you are targeting. This patch will just print to file/console the parameters and continue back to the original function. There will be no stops on the way. To actually hook the APIs you will need to inject the DLL into the target application. You can use Detours from Microsoft as and example which is a software package for re-routing Win32 APIs underneath applications.
   1. API hooking revealed - an article on CodeProject with examples. But you can find on the net endless examples for this technique.
   2. API Hooking with MS Detours
2. API Monitor - API Monitor is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.
3. Process instrumentation - instrumentation refers to an ability to monitor or measure the level of a product's performance, to diagnose errors and to write trace information.
   1. Pin is a platform for creating analysis tools - A pin tool comprises instrumentation, analysis and callback routines. Here you can find an intro to writing pintool which you can extend to your needs. This is pretty powerful technique and more hard to adapt among all that I've listed here. The original site from Intel and specifically at Finding the Value of Function Arguments can help you with what you are looking for.