views:

94

answers:

3

Hello all, what is the best tool to track the NT API's.

A: 

I don't know if this is on the beam, but try this for Win32. For Native API, I think only about 20% of it is documented.

scope_creep
+1  A: 

If you are in the desired process then you can redirect the IAT ( import address table) for the dll that you want to monitor. If you are not already running code in process then you will also need to find a way to load your code into the desired process.

Mike
+1  A: 

Microsoft's Detours can help you do this, and it's free.

Chris O