Tracing Win32 API while debugging a process
Wednesday, January 3rd, 2007Load an executable or attach WinDbg to an existing process and use logexts debugging extension (in output below all API parameters and return values are omitted for visual clarity):
0:001> !logexts.loge
0:001> !logc e *
All categories enabled.
0:001> !logo e d
Debugger Enabled
Text file Disabled
Verbose log Enabled
0:001> g
Thrd 7c0 77555B59 BeginPaint( 0x001103AA) ...
Thrd 7c0 77555B65 GetClientRect( 0x001103AA) ...
Thrd 7c0 77555B96 DrawEdge( 0x01010072 ...) ...
Thrd 7c0 77555C8A DrawFrameControl( 0x01010072 ...) ...
Thrd 7c0 77555CE1 EndPaint( 0x001103AA ... ) ...
Thrd 7c0 004165F2 TlsGetValue( 0x00000006) ...
Thrd 7c0 4B8D54B5 CallNextHookEx( ... ) ...
Thrd 7c0 0040D7CC GetMessageW( ... ) ...
You can break in and put a breakpoint at a return address:
0:001> bp 0040D7CC
0:001> g
Thrd 7c0 0040D7CC GetMessageW( ... ) ...
Breakpoint 0 hit
ProcessHistory+0xd7cc:
0040d7cc 85c0 test eax,eax
0:000> u 0040D7C0 0040D7CC
ProcessHistory+0xd7c0:
0040d7c0 50 push eax
0040d7c1 50 push eax
0040d7c2 8d7730 lea esi,[edi+30h]
0040d7c5 56 push esi
0040d7c6 ff15f8434300 call dword ptr
[ProcessHistory+0x343f8 (004343f8)]
0:000> dd 004343f8
004343f8 3c001950 3c0018c4 3c00193c 3c0014dc
0:000> u 3c001950
3c001950 b889020000 mov eax,289h
3c001955 e98e410014 jmp logexts!LogHook
(50005ae8)
3c00195a b88a020000 mov eax,28Ah
3c00195f e984410014 jmp logexts!LogHook
(50005ae8)
3c001964 b88b020000 mov eax,28Bh
3c001969 e97a410014 jmp logexts!LogHook
(50005ae8)
3c00196e b88c020000 mov eax,28Ch
3c001973 e970410014 jmp logexts!LogHook
(50005ae8)
Here we can see that logexts patches import table.
And you can trace different API categories:
0:001> !logexts.logc
Categories:
1 AdvApi32 Enabled
2 AtomFunctions Enabled
3 AVIFileExports Enabled
4 Clipboard Enabled
5 ComponentObjectModel Enabled
6 DebuggingAndErrorHandling Enabled
7 DeviceFunctions Enabled
8 Direct3D Enabled
9 DirectDraw Enabled
10 DirectPlay Enabled
11 DirectSound Enabled
12 GDI Enabled
13 HandleAndObjectFunctions Enabled
14 HookingFunctions Enabled
15 IOFunctions Enabled
16 MemoryManagementFunctions Enabled
17 Multimedia Enabled
18 Printing Enabled
19 ProcessesAndThreads Enabled
20 RegistryFunctions Enabled
21 Shell Enabled
22 StringManipulation Enabled
23 ThreadLocalStorage Enabled
24 User32 Enabled
25 User32StringExports Enabled
26 Version Enabled
27 WinSock2 Enabled
- Dmitry Vostokov -