Windows监听程序访问了哪些资源

Winternals公司的SysInternals提供了很多方便工具，后来被微软收购，微软提供了该系列的工具

https://docs.microsoft.com/en-us/sysinternals/

监听进程访问的资源用ProcessMonitor就可以了，但是数据太多了，后来发现ProcessExplorer用起来更方便，可以监听资源的访问，还可以监听User Object和GDI Object的数量 比较好用

勾选Show Low Pane，就会在底部显示一个进程信息的窗格，里面默认是按type排序的，type里面有section、file、reg、event等信息，这里以file里面的device为例，按照name排序，就获取到\Device\开头的file，但是调用顺序和次数看不出来，

如果想看更细节的调用顺序，需要用到ProcessMonitor

 这里按照时间顺序展示了所有的调用，所以有相当多的重复，用ProcessExplorer会简洁一些

这里只看到了访问的资源，没有调用的api和参数，如果想知道一个程序访问的所有系统api和参数，可以使用一个叫做Api Monitor的工具

 左侧的Api filter表示要过滤哪些模块的ap，一个模块包含很多子模块，子模块里包含若干dll，这个看自己关心哪些api调用，可以自行选择，因为对自己关心的api调用还不够了解，所以先选择了所有，打开32位的apimonitor之后，再打开其他32位进程就会自动拦截，并提示是否监听。建议自己用中间的Monitor Processes选择要监听的程序，

 如果直接启动失败的话，主要修改Attach Using的选项，总有一个能成功的

然后就可以看到api的调用顺序了

 注意summary窗格中，显示calls的数量，这个数量跟左边api filter的模块设置有关，这里勾选了所有模块，所以比较多，有些模块根本就没使用过，有些模块不重要，这个需要自行判断。api多了也没关系，summary窗格中有一个望远镜，点击一下可以搜索，搜索自己觉得重要的数据，不仅api的名字，api的参数也可以被搜索，还比较方便，就是数据量太大了。

api monitor默认会连子进程一起监控，还是比较方便的

如果只想知道程序调用了哪些动态库和函数，可以使用visual studio提供的dumpbin工具查看

D:\Program Files (x86)\Microsoft Visual Studio 9.0\VC>dumpbin /dependents f:\acad.exe
Microsoft (R) COFF/PE Dumper Version 9.00.21022.08
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file f:\acad.exe

File Type: EXECUTABLE IMAGE

  Image has the following dependencies:

    gdiplus.dll
    MSIMG32.dll
    ac1st23.dll
    AcGe23.dll
    acdb23.dll
    acui23.dll
    adui23.dll
    anav.dll
    dswhip.dll
    heidi15.dll
    UserData.dll
    IMM32.dll
    MPR.dll
    acbol.dll
    adhostableui.dll
    WTSAPI32.dll
    AcPal.dll
    UIAutomationCore.DLL
    AcUt.dll
    ADCtrls.dll
    accore.dll
    MSVCP140.dll
    mfc140u.dll
    KERNEL32.dll
    USER32.dll
    GDI32.dll
    COMDLG32.dll
    ADVAPI32.dll
    SHELL32.dll
    COMCTL32.dll
    SHLWAPI.dll
    ole32.dll
    OLEAUT32.dll
    oledlg.dll
    CRYPT32.dll
    VCRUNTIME140.dll
    api-ms-win-crt-runtime-l1-1-0.dll
    api-ms-win-crt-math-l1-1-0.dll
    api-ms-win-crt-time-l1-1-0.dll
    api-ms-win-crt-filesystem-l1-1-0.dll
    api-ms-win-crt-string-l1-1-0.dll
    api-ms-win-crt-environment-l1-1-0.dll
    api-ms-win-crt-heap-l1-1-0.dll
    api-ms-win-crt-stdio-l1-1-0.dll
    api-ms-win-crt-convert-l1-1-0.dll
    api-ms-win-crt-utility-l1-1-0.dll
    api-ms-win-crt-locale-l1-1-0.dll
    api-ms-win-crt-process-l1-1-0.dll
    CRYPTUI.dll

  Image has the following delay load dependencies:

    ShareMFC.dll
    plotcfg15.dll
    color.dll
    AcSceneOE.dbx
    AdApplicationFrame.dll
    AdWebServicesUI.dll
    AdIntImgServices.dll
    AdImaging.dll
    AdDownloaderCore.dll
    AcDrawBridge.dll

  Summary

        1000 .acMemLo
       24000 .data
       28000 .pdata
      1D2000 .rdata
       1A000 .reloc
       3D000 .rsrc
      300000 .text
        1000 .tls
        1000 ACAD_STA

apimonotor查看的是api调用顺序，重复太多，动辄几十万几百万次的总调用量，如果只想查看依赖哪些api，也可以使用dumpbin查看

dumpbin /imports f:\FNPLicensingService64.exe
Microsoft (R) COFF/PE Dumper Version 9.00.21022.08
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file f:\FNPLicensingService64.exe

File Type: EXECUTABLE IMAGE

  Section contains the following imports:

    KERNEL32.dll
             1402114B0 Import Address Table
             1402EAC00 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          D7 DeleteFileW
                         1F1 GetFileAttributesW
                         406 RemoveDirectoryW
                         1EE GetFileAttributesExW
                         362 MoveFileExW
                          15 AreFileApisANSI
                         1CD GetDateFormatA
。。。。。。。。。。。。。。。。。。。。。。。。。
                         534 WriteFile
                         2AB GetVersionExA
                         208 GetLastError
                         474 SetFilePointer
                         3C3 ReadFile
                          88 CreateFileA
                          E1 DeviceIoControl
                          52 CloseHandle
                         29C GetTimeFormatA

    USER32.dll
             140211BB8 Import Address Table
             1402EB308 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          C8 DrawIconEx
                          CB DrawStateA
                         211 MessageBeep
                         268 ReleaseCapture
                         284 SetCapture
                         17F GetSystemMenu
                         1FB LoadMenuW
                         288 SetClassLongPtrA
。。。。。。。。。。。。。。。。。。。。。。。。。
                         22A OpenClipboard
                         189 GetUpdateRect
                          FD FrameRect
                         15E GetMessageTime
                         1CE IsClipboardFormatAvailable

    GDI32.dll
             140211188 Import Address Table
             1402EA8D8 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                         20D GetStockObject
                         278 SelectPalette
                         1FC GetObjectType
                          4B CreatePen
                          54 CreateSolidBrush
。。。。。。。。。。。。。。。
                         2A6 SetTextColor
                          29 CreateBitmap
                          31 CreateDCA
                         25C RealizePalette
                         1CB GetDeviceCaps
                          27 CopyMetaFileA

    MSIMG32.dll
             140211AA0 Import Address Table
             1402EB1F0 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                           0 AlphaBlend
                           3 TransparentBlt

    COMDLG32.dll
             140211178 Import Address Table
             1402EA8C8 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                           9 GetFileTitleA

    WINSPOOL.DRV
             1402122D0 Import Address Table
             1402EBA20 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          4D DocumentPropertiesA
                          8F OpenPrinterA
                          1D ClosePrinter

    ADVAPI32.dll
             140211000 Import Address Table
             1402EA750 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                         156 GetSidLengthRequired
                         26D RegQueryValueExA
。。。。。。。。。。。。。
                         124 GetAclInformation
                         176 InitializeAcl
                          16 AddAce
                         223 QueryServiceConfigA
                         24E RegEnumKeyExA

    SHELL32.dll
             140211B30 Import Address Table
             1402EB280 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          BC SHGetFileInfoA
                          B6 SHGetDesktopFolder
                          D5 SHGetPathFromIDListA
                          DF SHGetSpecialFolderLocation
                             Ordinal   680
                          7A SHBrowseForFolderA
                          72 SHAppBarMessage
                          1D DragQueryFileA
                          1B DragFinish
                         11E ShellExecuteA

    COMCTL32.dll
             140211168 Import Address Table
             1402EA8B8 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          64 ImageList_GetIconSize

    SHLWAPI.dll
             140211B88 Import Address Table
             1402EB2D8 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          6C PathIsUNCA
                          48 PathFindFileNameA
                          46 PathFindExtensionA
                          96 PathStripToRootA
                          8B PathRemoveFileSpecW

    ole32.dll
             140212430 Import Address Table
             1402EBB80 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                         15D OleDestroyMenuDescriptor
                         15B OleCreateMenuDescriptor
                          43 CoInitializeEx
                          70 CoUninitialize
                          42 CoInitialize
                          14 CoCreateInstance
                         160 OleDuplicateData
                          6B CoTaskMemAlloc
                         18C ReleaseStgMedium
                         17C OleTranslateAccelerator
                         18D RevokeDragDrop
                          4B CoLockObjectExternal
                         18B RegisterDragDrop
                         163 OleGetClipboard
                         102 IsAccelerator
                         16C OleLockRunning
                          8A CreateStreamOnHGlobal
                          90 DoDragDrop
                          44 CoInitializeSecurity
                          67 CoSetProxyBlanket
                          6C CoTaskMemFree

    OLEAUT32.dll
             140211AD8 Import Address Table
             1402EB228 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                             Ordinal     9
                             Ordinal    12
                             Ordinal     4
                             Ordinal   185
                             Ordinal   184
                             Ordinal   114
                             Ordinal     8
                             Ordinal     2
                             Ordinal     7
                             Ordinal     6

    WS2_32.dll
             1402122F0 Import Address Table
             1402EBA40 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                             Ordinal   111
                             Ordinal    16
                             Ordinal   115
                             Ordinal   116
                             Ordinal     9
                             Ordinal    11
                             Ordinal    23
                             Ordinal     4
                             Ordinal     3
                             Ordinal    18
                             Ordinal   151
                             Ordinal     7
                             Ordinal    10
                             Ordinal    19

    OLEACC.dll
             140211AB8 Import Address Table
             1402EB208 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                           3 AccessibleObjectFromWindow
                           4 CreateStdAccessibleObject
                          14 LresultFromObject

    gdiplus.dll
             140212378 Import Address Table
             1402EBAC8 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                         121 GdipGetImageGraphicsContext
                          2E GdipBitmapUnlockBits
                          2B GdipBitmapLockBits
                          50 GdipCreateBitmapFromScan0
                          51 GdipCreateBitmapFromStream
                         125 GdipGetImagePalette
                         126 GdipGetImagePaletteSize
                         127 GdipGetImagePixelFormat
                         122 GdipGetImageHeight
                         12C GdipGetImageWidth
                          36 GdipCloneImage
                          B8 GdipDrawImageRectI
                         218 GdipSetInterpolationMode
                          5B GdipCreateFromHDC
                         274 GdiplusShutdown
                         275 GdiplusStartup
                          4D GdipCreateBitmapFromHBITMAP
                          98 GdipDisposeImage
                          90 GdipDeleteGraphics
                          21 GdipAlloc
                          ED GdipFree
                          B0 GdipDrawImageI

    IMM32.dll
             140211490 Import Address Table
             1402EABE0 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          68 ImmReleaseContext
                          38 ImmGetContext
                          4A ImmGetOpenStatus

    WINMM.dll
             1402122C0 Import Address Table
             1402EBA10 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                           7 PlaySoundA

    dhcpcsvc.DLL
             140212368 Import Address Table
             1402EBAB8 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                          31 DhcpRequestParams

  Summary

       2B000 .data
       1A000 .pdata
       DE000 .rdata
       18000 .reloc
        A000 .rsrc
      1F6000 .text
       1A000 .textidx
        5000 data
        2000 text

这里列举了依赖哪些动态库里面的哪些接口。顺序不固定

如果只想看其中依赖的一个dll里面的接口

dumpbin /imports:kernel32.dll f:\acad.exe

最好提前看一下是否依赖这个dll，免得自以为依赖了，结果什么都没找到