How to log application API calls using import module addresses

Let’s log all the calls that Excel makes to open or create a file.

 

Start Visual Studio (any version), choose File->Open->Projects. In the dialog, change the “Files of Type” to “Executable Files (*.exe)”

Choose any application like Excel: C:/Program Files/Microsoft Office/OFFICE11/EXCEL.EXE

 

Hit Ctrl-B to bring up the Breakpoints dialog. Paste in 0x7C810760 (which is the address of CreateFileW on WinXP (below). On Vista, use 0x75F2866C)

Hit F5 to start Excel

 

The debugger will stop when Excel calls the API. Put this expression in the Watch Window:

(char *)(*(int *)((esp+4))),su

 

The ESP register is the stack pointer. At the breakpoint it points to the return address of the caller. The next stack entry (esp+4) is the first parameter to the function. (There are four 8 bit bytes per 32 bit word.) The watch expression dereferences (“*(int *)”)the value and casts it as a string (“char *”)so you can see the value. The “,su” means to format it as a Unicode string.  We know the first parameter is the file name from the CreateFileW documentation.

 

My debugger shows

 "C:/Program Files/Microsoft Office/OFFICE11/1033/xlintl32.dll"

 

Right click the bpt, choose BreakPoint->When Hit->Print a Message -> “CFileUnicode {(char *)(*(int *)((esp+4))),su}”

(The When Hit feature is VS 2005 only)

Now watch the output window as you run the target application.

I see these file names passed to the CreateFileW function as Excel runs:

 

CFileUnicode "C:/Program Files/Microsoft Office/OFFICE11/1033/xlintl32.dll"

CFileUnicode "C:/WINDOWS/WindowsShell.Manifest"
... ...
--------------------------
see this article