?
Solved

monitor API calls directed at an application

Posted on 2003-03-31
15
Medium Priority
?
215 Views
Last Modified: 2010-04-04
Hi, I need help from the best....

If I want to monitor notpad.exe and detect any API calls directed at it, how do I do that?

For instance, lets say I want to know if any application is trying to kill notpad.exe. I want to know the applications name, handle and procid trying to kill notpad.exe. Then I want to intercept the kill command and stop it from happening. How do I do that?

Next. How do I make my application un-killable?
Please if you could send me some example code of how this is done I would forever be in your debt.

Thank you

horatio@presles.co.za
0
Comment
Question by:HoratioH
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 6
  • 2
15 Comments
 
LVL 1

Expert Comment

by:Wax0r
ID: 8246957
As for the API hooking bit for notepad - dunno. Try madshi stuff.

If you run your program as a SYSTEM service it should be unkillable (via the taskmanager)
0
 
LVL 20

Expert Comment

by:Madshi
ID: 8260544
Thanks Wax0r!

Horatio, for what purpose do you need this? On which OS must it run?
0
 

Author Comment

by:HoratioH
ID: 8261420
I want to create an api monitor that can monitor all api calls
Then I want to highlight the api calls I do not want to allow on my system.

I want to use this in win95/98/2000/xp
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 20

Expert Comment

by:Madshi
ID: 8261475
I can tell you how to hook selected APIs, but not *all* APIs. I can only tell you how to hook APIs where you know the parameters and calling convention.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 8261477
Does that still serve your needs? If not I can't help.
0
 

Author Comment

by:HoratioH
ID: 8261531
I think that might melp :)

If you vould maybe e-mail me a pas or example I would be sooooo happy :)

Thanks

horatio@presles.co.za
0
 

Author Comment

by:HoratioH
ID: 8261564
I think that might melp :)

If you vould maybe e-mail me a pas or example I would be sooooo happy :)

Thanks

horatio@presles.co.za
0
 
LVL 20

Expert Comment

by:Madshi
ID: 8262188
I'm currently working on making system wide API hooking as easy as possible. This stuff is still in beta, but you can try it out, if you like. Here's the direct download:

http://madshi.bei.t-online.de/madCollectionBeta.exe

Here are some little demos which show you how to use it:

http://madshi.net/SysHook.zip

The package you need is named "madCodeHook". It's free for non-commercial purpose (only).

Regards, Madshi.
0
 

Author Comment

by:HoratioH
ID: 8267537
Thanks I will try it today. This is an interest to me and I would like it if we could communicate on this matter.

If you dont mind I would like to stay in contact via e-mail so that we can swap out ideas.

Thanks so far for the info.

Horatio
0
 

Author Comment

by:HoratioH
ID: 8267542
Thanks I will try it today. This is an interest to me and I would like it if we could communicate on this matter.

If you dont mind I would like to stay in contact via e-mail so that we can swap out ideas.

Thanks so far for the info.

Horatio
0
 
LVL 20

Expert Comment

by:Madshi
ID: 8268362
We could communicate via email, but perhaps the communication would be interesting for others to read, too?
0
 

Author Comment

by:HoratioH
ID: 8269266
Yea but I want to give you the points and still need to chat to you.

:)

Thanks a lot for the stuff. I will look at it tonight.;
0
 
LVL 20

Accepted Solution

by:
Madshi earned 1200 total points
ID: 8269316
Giving me the points does not lock this question, we can still continue to chat here afterwards.
0
 
LVL 1

Expert Comment

by:Wax0r
ID: 8767367
Just a thought that was crossing my mind earlier..

Would this be viable / doable @ all:

- List all running processes
- Use API to retrieve all the DLL's it uses (import tab.)
- Check all the functions those DLL's publish
- Create hooks for all of them  

Does #3 actually provide enough information to hook them?

I realise that even if it would work it would be very cumbersome but it -would- allow for a somewhat automatic system wide hook..

Just a thought - I could be way off here or even delusional :)

0
 
LVL 20

Expert Comment

by:Madshi
ID: 8767801
In order to *easily* hook something you need to know the parameter of the to-be-hooked function. And there's no way to automatically get the parameters, which are used by any exported DLL function.

There are possibilities to hook code, even when you don't know the parameters. But it's more difficult and not so straightforward. madCodeHook doesn't support that.

Also please note, that kernel32.dll alone has several hundreds of exported functions. If you want to hook them all in all processes, you can wait a few minutes, until all the hooks are installed...   :-)
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to create forms/units independent of other forms/units object names in a delphi project. Have you ever created a form for user input in a Delphi project and then had the need to have that same form in a other Delphi proj…
In my programming career I have only very rarely run into situations where operator overloading would be of any use in my work.  Normally those situations involved math with either overly large numbers (hundreds of thousands of digits or accuracy re…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
Suggested Courses
Course of the Month14 days, 12 hours left to enroll

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question