Trace functions from user mode to kernel mode.
Posted on 2006-04-30
Hello EE guys,
I'm looking for a program or a way to write a program (in C) that allow me to trace all calls made from a function in user mode.
Example, when I call FindFirstFile() that is exported in Kernel32.dll, it call NtQueryDirectoryFile() (that is in ntddl.dll?).
What I want is a utility or way to write it in C, that allow me to track a function, for example I create a filter to "FindFirstFile()" and it will describe/output what functions it called and from what .dll, what kernel level functions it called (from where if possible), and if possible what kernel sub-functions it called and if is exported or not....
ps1: How much more information better.
ps2: Good answers will give more points... ;)