Monitoring API calls

Question

I am doing some reverse engineering and want to know which APIs are called from the executable. I am mostly interested in the APIs called on a particular Windows system DLL.

I guess one way to do that is to get all APIs exposed from the DLL using dumpbin and put breakpoints on all those from Windbg.

Any other approach? This seems like lot of time if I need to monitor many system DLLs.

BTW, I am working on Windows XP and want to monitor one executable which calls some Windows system DLL functions.

Answer 1

I think you can use dependancy walker

Answer 2

This CodeProject article dealing with API hooking may be helpful to you.

There are also tools available, like APISpy32 or SpyStudio.

Answer 3

You can find a few tools here: http://stackoverflow.com/questions/299261/hook-processes

Answer 4

Use the Win32 Kernel Hooking apis, exported by ordinal since NT4
codeproject 'article' is completely obsolete...

Answer 5

http://www.autodebug.com

The best api monitor tool (Auto Debug Profressional) can help you to do this. It can monitor all api calls.