How to log application API calls using import module addresses
2007-08-26 23:52
519 查看
Let’s log all the calls that Excel makes to open or create a file.
Start Visual Studio (any version), choose File->Open->Projects. In the dialog, change the “Files of Type” to “Executable Files (*.exe)”
Choose any application like Excel: C:/Program Files/Microsoft Office/OFFICE11/EXCEL.EXE
Hit Ctrl-B to bring up the Breakpoints dialog. Paste in 0x7C810760 (which is the address of CreateFileW on WinXP (below). On Vista, use 0x75F2866C)
Hit F5 to start Excel
The debugger will stop when Excel calls the API. Put this expression in the Watch Window:
(char *)(*(int *)((esp+4))),su
The ESP register is the stack pointer. At the breakpoint it points to the return address of the caller. The next stack entry (esp+4) is the first parameter to the function. (There are four 8 bit bytes per 32 bit word.) The watch expression dereferences (“*(int *)”)the value and casts it as a string (“char *”)so you can see the value. The “,su” means to format it as a Unicode string. We know the first parameter is the file name from the CreateFileW documentation.
My debugger shows
"C:/Program Files/Microsoft Office/OFFICE11/1033/xlintl32.dll"
Right click the bpt, choose BreakPoint->When Hit->Print a Message -> “CFileUnicode {(char *)(*(int *)((esp+4))),su}”
(The When Hit feature is VS 2005 only)
Now watch the output window as you run the target application.
I see these file names passed to the CreateFileW function as Excel runs:
CFileUnicode "C:/Program Files/Microsoft Office/OFFICE11/1033/xlintl32.dll"
CFileUnicode "C:/WINDOWS/WindowsShell.Manifest"
... ...
--------------------------
see this article
Start Visual Studio (any version), choose File->Open->Projects. In the dialog, change the “Files of Type” to “Executable Files (*.exe)”
Choose any application like Excel: C:/Program Files/Microsoft Office/OFFICE11/EXCEL.EXE
Hit Ctrl-B to bring up the Breakpoints dialog. Paste in 0x7C810760 (which is the address of CreateFileW on WinXP (below). On Vista, use 0x75F2866C)
Hit F5 to start Excel
The debugger will stop when Excel calls the API. Put this expression in the Watch Window:
(char *)(*(int *)((esp+4))),su
The ESP register is the stack pointer. At the breakpoint it points to the return address of the caller. The next stack entry (esp+4) is the first parameter to the function. (There are four 8 bit bytes per 32 bit word.) The watch expression dereferences (“*(int *)”)the value and casts it as a string (“char *”)so you can see the value. The “,su” means to format it as a Unicode string. We know the first parameter is the file name from the CreateFileW documentation.
My debugger shows
"C:/Program Files/Microsoft Office/OFFICE11/1033/xlintl32.dll"
Right click the bpt, choose BreakPoint->When Hit->Print a Message -> “CFileUnicode {(char *)(*(int *)((esp+4))),su}”
(The When Hit feature is VS 2005 only)
Now watch the output window as you run the target application.
I see these file names passed to the CreateFileW function as Excel runs:
CFileUnicode "C:/Program Files/Microsoft Office/OFFICE11/1033/xlintl32.dll"
CFileUnicode "C:/WINDOWS/WindowsShell.Manifest"
... ...
--------------------------
see this article
相关文章推荐
- How To Troubleshoot Oracle Redo Log Reading Extract Slow Performance Issue using TESTMAPPINGSPEED (文
- How to send custom http_headers for RPC calls using python xmlrpclib?
- How to Create Modifiers Using the API QP_MODIFIERS_PUB.PROCESS_MODIFIERS
- java使用rest api登录salesforce | How to do authentication to salesforce from java class using Rest API
- android gradle: how to import a library module
- How To Import Standard PO Using the Purchase Document Open Interface[转]
- How to make fundamental Winsock calls to set up communication using the internet Protocol
- How to assign the priority when using rspc_api_chain_start?
- How to execute an application on Windows using Python.
- HOW-TO: Handling cookies using the java.net.* API
- How to Integrate Excel in a Windows Form Application using the WebBrowser
- How to use an ASP.NET application to query an Indexing Service catalog by using Visual Basic .NET
- How To Iterate SharePoint Attachments Using The API
- how to select edge using maya API
- How to import gms to our project - using Android.mk
- How to log in to Amazon EC2 using PEM format from SecureCRT
- How do I get ASP.NET Web API to return JSON instead of XML using Chrome
- javascript - C++, Qt, QtWebKit: How to create an html rendering window so that your application would get callbacks from JS calls? - Stack Overflow
- How to make a full-screen application using Symbian C++, 怎样在Sysmbian C++中制作全屏应用程序
- How to write event log(Event Viewer) using C++ - 用C++如何写事件日志(事件查看器)