Table of Contents
There are a couple of tools that allow us to look into program behavior at a more closer level. Lets look at some of these:
This section is really only relevant for to our efforts under UNIX, as Windows system calls change regularly from version to version, and have unpredictable entry points.
Now we're starting to get to the more interesting stuff. Tracing library calls is a very powerful method of system analysis. It can give us a *lot* of information about our target.
This utility is extremely useful. It traces ALL library calls made by a program.
Useful options:
-S (display syscalls too)
-f (follow fork)
-o filename (output trace to filename)
-C (demangle C++ function call names)
-n 2 (indent each nested call 2 spaces)
-i (prints instruction pointer of caller)
-p pid (attaches to specified pid)
API Monitor is incredible. It will let you watch .dll calls in real time, filter on type of dll call, view