Monitoring tools

Without manually digging deeper into the program's algorithm, simply running the program can give plenty of information about its behavior. Monitoring tools usually work by placing sensors in common or specific system library functions, then logging the parameters used. Using monitoring tools is a fast way to produce an initial behavior analysis of a program:

  • SysInternals Suite's Procmon or Process Monitor: Running only on Windows, this is a real-time monitoring tool that monitors processes, thread, filesystem, and registry events. It can be downloaded from https://docs.microsoft.com/en-us/sysinternals/downloads/procmon and is a part of the SysInternals Suite package.
  • API Monitor: This powerful tool helps reverse engineering by monitoring API calls as the program runs. The analyst has to set which API the tool needs to hook. Once an API is hooked, all user-mode processes using the API will be logged. API Monitor can be downloaded from http://www.rohitab.com/apimonitor.
  • CaptureBAT: In addition to what Process Monitor can do, this command-line tool is also capable of monitoring network traffic.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.144.116.159