CODEWITHSUNDEEP
windowswinapisystem-calls
Jamil
Jamil

Reputation: 2160

Recording Syscalls in windows

I have been searching for some time now on ways to get syscalls in realtime on windows. I have looked at couple of posts here at stackoverflow and elsewhere but could not find anything easy enough that I could follow. I have looked at procmon but its output has been pretty unstable. Same binary on two systems has generated different number of entries. Perhaps I lack the pre-requisite knowledge to do such stuff. Any help/recommendation is welcome.

I have looked at these link before:

Regards

Upvotes: 0

Views: 1571

Answers (2)

Roland Pihlakas
Roland Pihlakas

Reputation: 4573

If You are satisfied with sampling approach then You could try this:

typedef struct _THREAD_LAST_SYSCALL_INFORMATION
{
    PVOID FirstArgument;
    USHORT SystemCallNumber;

} THREAD_LAST_SYSCALL_INFORMATION, *PTHREAD_LAST_SYSCALL_INFORMATION;

THREAD_LAST_SYSCALL_INFORMATION lastSystemCall;
NtQueryInformationThread(
    hThread,
    ThreadLastSystemCall,
    &lastSystemCall,
    sizeof(THREAD_LAST_SYSCALL_INFORMATION),
    NULL
);

where ThreadLastSystemCall = 21

Upvotes: 0

canzar
canzar

Reputation: 340

Depending on the version of Windows you are using, the answer to your question is probably Event Tracing for Windows (ETW) which can do syscall logging [link]

Upvotes: 0

Related Questions