Monitoring application calls to DLL

kshahar_33982 0
Viewed 71932

In short: I want to monitor selected calls from an application to a DLL.

We have an old VB6 application for which we lost the source code (the company wasn't using source control back then..). This application uses a 3rd party DLL.

I want to use this DLL in a new C++ application. Unfortunately the DLL API is only partially documented, so I don't know how to call some functions. I do have the functions signature.

Since the VB6 application uses this DLL, I want to see how it calls several functions. So far I've tried or looked at -

  1. APIHijack - requires me to write C++ code for each function. Since I only need to log the values, it seems like an overkill.
  2. EasyHook - same as 1, but allows writing in the code in .NET language.
  3. OllyDbg with uHooker - I still have to write code for each function, this time in Python. Also, I have to do many conversions in Python using the struct module, since most functions pass values using pointers.

Since I only need to log functions parameters I want a simple solution. Is there any automated tool, for which I could tell which functions to monitor and their signature, and then get a detailed log file?

monitor hook monitoring dll
4 Answers

A "static" solution (in the sense it can capture a stack trace on demand) would be Process Monitor.

Process Monitor

A more dynamic solution would be ApiMonitor, but it may be too old to be compatible with the applications to monitor. Worth a try though.

http://www.rohitab.com/gallery/api-monitor-2-0/main-window.png

VonC_63090

Some more Google searching found what I was looking for: WinAPIOverride32. It allows writing text files such as:

CustomApi.dll|void NameOfFunction(long param1, double& param2);

Later on, these files can be used inside the program to log all calls to NameOfFunction. Now I just need to figure out how to log arrays and structs parameters.

kshahar_339820

If you just want to see the function interfaces of the DLL, you could try "Dependecies" (https://lucasg.github.io/Dependencies/). This is a nice remake of the DependencyWalker in as OpenSource.

This only allows you to see the dependencies of the DLL, with the corresponding function names (however, not the calling structure). Unfortunately, I don't believe it will tell you which specific functions in a DLL are being used by the calling DLL/EXE.

user_28007010
Related