Monitoring certain system calls done by a process in Windows

Question

I would like to be able to monitor certain system calls made by a process, primarily file I/O calls. On Linux I can probably get away using strace with suitable parameters, but how can I do this on Windows?

I'm primarily interested in running a process and figuring out which files it has read and written.

I want to do this programmatically from another process. I'm aware of Process Monitor, but I would like to receive the data in a form which I can import into another program for further analysis.

If I narrow down my requirements even further, it is probably enough to be able to monitor calls to CreateFile(). I'm really only interested in what files are opened, and if they are opened for read/write or just read. Another requirement which I didn't really state is that speed is fairly important; I was planning on doing this for things like compiling a C++-file, and pulling up a full GUI which generates a 20 MB logfile will have prohibitive overhead.

It would also be nice if it did not require administrative privileges.

Interesting. Isn't there something similar to linux ptrace syscall in Windows? All the answers are about using other programs but with something like ptrace() you could do it yourshelf. — cort, May 14 '09 at 18:38
In case you're interested in a different approach I've asked about a windows equivalent to ptrace : http://stackoverflow.com/questions/865106/is-there-something-like-linux-ptrace-syscall-in-windows — cort, May 14 '09 at 19:30

score 35 · Accepted Answer · edited Jul 22 '21 at 06:03

35

There are several options on Windows.

Windows Performance Toolkit can be used to enable tracing of various system events, including file I/O, and includes tools for processing and viewing these events. You can use xperf to begin trace variously classes of events and save to an ETL file that you can then process or view using the same tools later.

Process Monitor from Sysinternals is another, very easy to use, option, and enables you to quickly see all file and registry accesses any process on the system is doing. You can also run Process Monitor in an automated fashion.

If you'd like to do this completely programmatically, you can use the ETW functions (StartTrace, EnableTrace, etc.) to snap file I/O events and save to an ETL file. Sample code here.

edited Jul 22 '21 at 06:03

fzbd

477
2
8

answered May 14 '09 at 18:09

Michael

54,279
5
125
144

Thanks, I'll look into WPT. Does ProcessMonitor have any support for running without a GUI? – JesperE May 14 '09 at 18:25
Updated answer with a link showing how to automated Process Monitor. – Michael May 14 '09 at 18:29
Is there a way to get the xperf set of tool without downloading a whopping 1.3GB (!) iso-image? – JesperE May 15 '09 at 18:27
The command line use of ProcessMonitor falls a little short: it still opens a window, and I couldn't find a way to specify filters on the command line. Also, ProcessMonitor has be run as administrator (at least on my Vista machine), which makes it rather unusable for my purposes. – JesperE May 15 '09 at 18:38
http://msdn.microsoft.com/en-us/performance/default.aspx, under downloads, has several downloads of just the toolkit for under 5 MB. – Michael May 15 '09 at 18:39
That link to WPF is broken, I found it here: https://msdn.microsoft.com/en-us/library/windows/hardware/hh162945.aspx – Wheezil Feb 04 '15 at 17:46
The link in the third paragraph is (effectively) broken. It redirects to a generic page, *"Archived MSDN and TechNet Blogs"*. – Peter Mortensen Jan 30 '20 at 22:58
Undead link: https://www.cloudnotes.io/how-to-automate-process-monitor/ – Miscreant Oct 17 '20 at 02:04

score 11 · Answer 2 · edited Dec 16 '19 at 22:13

11

On Windows, you can use Process Monitor to monitor process activity (I/O and registry). I guess this fits your need if you don't really want to know the system calls.

And you can use winapioverride32 to monitor API calls.

edited Dec 16 '19 at 22:13

Peter Mortensen

30,738
21
105
131

answered May 14 '09 at 18:14

kcwu

6,778
4
27
32

How to do this in order to modify the parameter used by a specific system call ? – user2284570 Mar 10 '19 at 20:56

score 7 · Answer 3 · edited Dec 16 '19 at 22:21

7

API Monitor by Rohitab Batra is very good for system calls.

edited Dec 16 '19 at 22:21

Peter Mortensen

30,738
21
105
131

answered Jul 03 '13 at 15:01

ds-bos-msk

780
9
13

score 3 · Answer 4 · edited Jan 30 '20 at 23:02

Another way is to use Deviare API Hook and intercept all user-mode system calls that you want. Using this framework you can code a generic handler for all calls since the parameters can be read using COM interfaces (for example, each parameter is an INktParam, and you can get the value using INktParam.Value).

Another alternative, but it will cost some money, is to use SpyStudio from the same company. This product has a command-line option that is useful to collect logs without a GUI.

score 3 · Answer 5 · edited Dec 16 '19 at 22:14

3

Use FileMon (now integrated into Process Monitor).

There is also NtTrace, similar to strace.

edited Dec 16 '19 at 22:14

Peter Mortensen

30,738
21
105
131

answered May 14 '09 at 18:16

2

NtTrace fails on my Vista x64 with lots of "Cannot trap ... wrong signature". It hasn't been updated since 2007, though. – JesperE May 15 '09 at 18:43

score 3 · Answer 6 · edited Dec 16 '19 at 22:17

3

Another Windows API tracing tool: logexts.dll (part of the Debugging Tools for Windows), which can be run from inside WinDbg/ntsd/cdb or through a standalone logger.exe program.

edited Dec 16 '19 at 22:17

Peter Mortensen

30,738
21
105
131

answered May 14 '09 at 18:21

bk1e

23,871
6
54
65

score -7 · Answer 7 · edited Dec 16 '19 at 22:18

-7

Use strace. Example output:

open(".", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
fcntl64(3, F_GETFD)                     = 0x1 (flags FD_CLOEXEC)
getdents64(3, /* 18 entries */, 4096)   = 496
getdents64(3, /* 0 entries */, 4096)    = 0
close(3)                                = 0
fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f2c000
write(1, "autofs\nbackups\ncache\nflexlm\ngames"..., 86autofsA

edited Dec 16 '19 at 22:18

Peter Mortensen

30,738
21
105
131

answered Sep 14 '10 at 03:52

Matt Joiner

112,946
110
377
526

@matt anyway, there is [strace in cygwin](http://cygwin.com/cygwin-ug-net/using-utils.html). – wnrph Oct 17 '12 at 12:33
1

@Matt it is expected that the answer is for Windows. strace is mainly a Linux utility. – Ayman Salah Feb 15 '21 at 13:10

Monitoring certain system calls done by a process in Windows

7 Answers7

Linked