monitor API calls directed at an application

Hi, I need help from the best....

If I want to monitor notpad.exe and detect any API calls directed at it, how do I do that?

For instance, lets say I want to know if any application is trying to kill notpad.exe. I want to know the applications name, handle and procid trying to kill notpad.exe. Then I want to intercept the kill command and stop it from happening. How do I do that?

Next. How do I make my application un-killable?
Please if you could send me some example code of how this is done I would forever be in your debt.

Thank you

horatio@presles.co.za
HoratioHAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Wax0rCommented:
As for the API hooking bit for notepad - dunno. Try madshi stuff.

If you run your program as a SYSTEM service it should be unkillable (via the taskmanager)
0
MadshiCommented:
Thanks Wax0r!

Horatio, for what purpose do you need this? On which OS must it run?
0
HoratioHAuthor Commented:
I want to create an api monitor that can monitor all api calls
Then I want to highlight the api calls I do not want to allow on my system.

I want to use this in win95/98/2000/xp
0
Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

MadshiCommented:
I can tell you how to hook selected APIs, but not *all* APIs. I can only tell you how to hook APIs where you know the parameters and calling convention.
0
MadshiCommented:
Does that still serve your needs? If not I can't help.
0
HoratioHAuthor Commented:
I think that might melp :)

If you vould maybe e-mail me a pas or example I would be sooooo happy :)

Thanks

horatio@presles.co.za
0
HoratioHAuthor Commented:
I think that might melp :)

If you vould maybe e-mail me a pas or example I would be sooooo happy :)

Thanks

horatio@presles.co.za
0
MadshiCommented:
I'm currently working on making system wide API hooking as easy as possible. This stuff is still in beta, but you can try it out, if you like. Here's the direct download:

http://madshi.bei.t-online.de/madCollectionBeta.exe

Here are some little demos which show you how to use it:

http://madshi.net/SysHook.zip

The package you need is named "madCodeHook". It's free for non-commercial purpose (only).

Regards, Madshi.
0
HoratioHAuthor Commented:
Thanks I will try it today. This is an interest to me and I would like it if we could communicate on this matter.

If you dont mind I would like to stay in contact via e-mail so that we can swap out ideas.

Thanks so far for the info.

Horatio
0
HoratioHAuthor Commented:
Thanks I will try it today. This is an interest to me and I would like it if we could communicate on this matter.

If you dont mind I would like to stay in contact via e-mail so that we can swap out ideas.

Thanks so far for the info.

Horatio
0
MadshiCommented:
We could communicate via email, but perhaps the communication would be interesting for others to read, too?
0
HoratioHAuthor Commented:
Yea but I want to give you the points and still need to chat to you.

:)

Thanks a lot for the stuff. I will look at it tonight.;
0
MadshiCommented:
Giving me the points does not lock this question, we can still continue to chat here afterwards.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Wax0rCommented:
Just a thought that was crossing my mind earlier..

Would this be viable / doable @ all:

- List all running processes
- Use API to retrieve all the DLL's it uses (import tab.)
- Check all the functions those DLL's publish
- Create hooks for all of them  

Does #3 actually provide enough information to hook them?

I realise that even if it would work it would be very cumbersome but it -would- allow for a somewhat automatic system wide hook..

Just a thought - I could be way off here or even delusional :)

0
MadshiCommented:
In order to *easily* hook something you need to know the parameter of the to-be-hooked function. And there's no way to automatically get the parameters, which are used by any exported DLL function.

There are possibilities to hook code, even when you don't know the parameters. But it's more difficult and not so straightforward. madCodeHook doesn't support that.

Also please note, that kernel32.dll alone has several hundreds of exported functions. If you want to hook them all in all processes, you can wait a few minutes, until all the hooks are installed...   :-)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Delphi

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.