CODEWITHSUNDEEP
winapiprocesstrace
JesperE
JesperE

Reputation: 64424

Low-overhead I/O monitoring on Windows

I would like a low-overhead method of monitoring the I/O of a Windows process.

I got several useful answers to Monitoring certain system calls done by a process in Windows. The most promising was about using Windows Performance Toolkit to get a kernel event trace. All necessary information can indeed be pulled from there, but the WPT is a massive overkill for what I need and subsequently has a prohibitive overhead.

My idea was to implement an alternative approach to detecting C/C++ dependency graphs. Usually this is done by passing an option to the compiler (-M, for example). This works fine for compilers and tools which have such an option, but not all of them do, and those who do often implement them differently. So, I implemented an alternative way of doing this on Linux using strace to detect which files are opened. Running gcc (for example) in this way has a 50% overhead (ballpark figure), and I was hoping to figure out a way to do this on windows with a similarish overhead.

The xperf set of tools have two issues which prevents me from using them in this case:

I really don't need events at the kernel level; I suppose I could manage just as well if I could just monitor, say, the Win32 API call CreateFile(), and possibly CreateProcess() if I want to catch forked processes.

Any clever ideas?

Upvotes: 3

Views: 1861

Answers (3)

JesperE
JesperE

Reputation: 64424

It seems like Dr. Memory's System Call Tracer for Windows is exactly what I was looking for. It is basically a strace implementation for Windows.

Upvotes: 0

Ben Schwehn
Ben Schwehn

Reputation: 4565

Use API hooking. Hooking NtCreateFile and a few other calls in ntdll should be enough. I've had good experience using easyhook as a framework to do the hooking itself - free and open source. Even supports managed hooking (c# etc) if you wanted to do that. It's quite easy to set up.

It's at located at http://easyhook.codeplex.com

Edit: btw detours does not allow 64 bit hooking (unless you buy a license for a nominal price of 10,000USD) EasyHook does not allow native hooks across a WOW64 boundary. It allows managed hooking across WOW64 boundaries though.

Upvotes: 3

Tobiesque
Tobiesque

Reputation: 762

I used Microsoft's Detours in the past to track memory allocations by intercepting particular API calls. You could use it to track CreateFile and CreateProcess.

Upvotes: 0

Related Questions