Monitoring application calls to DLL

问题

In short: I want to monitor selected calls from an application to a DLL.

We have an old VB6 application for which we lost the source code (the company wasn\'t using source control back then..). This application uses a 3rd party DLL.

I want to use this DLL in a new C++ application. Unfortunately the DLL API is only partially documented, so I don\'t know how to call some functions. I do have the functions signature.

Since the VB6 application uses this DLL, I want to see how it calls several functions. So far I\'ve tried or looked at -

1. APIHijack - requires me to write C++ code for each function. Since I only need to log the values, it seems like an overkill.
2. EasyHook - same as 1, but allows writing in the code in .NET language.
3. OllyDbg with uHooker - I still have to write code for each function, this time in Python. Also, I have to do many conversions in Python using the struct module, since most functions pass values using pointers.

Since I only need to log functions parameters I want a simple solution. Is there any automated tool, for which I could tell which functions to monitor and their signature, and then get a detailed log file?

回答1:

A "static" solution (in the sense it can capture a stack trace on demand) would be Process Monitor.

A more dynamic solution would be ApiMonitor, but it may be too old to be compatible with the applications to monitor. Worth a try though.

回答2:

Some more Google searching found what I was looking for: WinAPIOverride32. It allows writing text files such as:

CustomApi.dll|void NameOfFunction(long param1, double& param2);

Later on, these files can be used inside the program to log all calls to NameOfFunction. Now I just need to figure out how to log arrays and structs parameters.

回答3:

Visual Studio Addin Runtime Flow here:

Runtime Flow in real time monitors and logs function calls and function parameters in your running .NET application and shows a stack trace tree. No instrumentation or source code required for monitoring.

来源：https://stackoverflow.com/questions/311268/monitoring-application-calls-to-dll