TracePlus Win32 5.37.000

TracePlus/Win32 will provide information on application usage of the Win32, ODBC, RAS, MAPI, TAPI and Win32 Internet APIs.
TracePlus Win32 traces 32 categories of API functions, comprising nearly 1350 API calls.
The API categories are:
- Access Control
- Profile Functions
- Application related (Kernel)
- Registry
- Common Controls
- Remote Access (RAS)
- Date and Time
- Resource Management
- DDEML
- Serial Communications
- Windows NT Event Log
- Service Manager
- File I/O
- Shell
- File System
- Simple MAPI
- Memory Management
- System Related
- Multimedia APIs
- TAPI
- Network (WNetxxx() functions)
- Threads
- ODBC (Full ODBC 3.x support)
- Timers
- OLE (Base)
- Tokens
- OLE (COM)
- Win32 Internet API (Expanded support)
- Pipes and Mailslots
- Windows GUI (Expanded support)
- Processes
Using its unique visual realtime display of Win32 activity, you can spot timing-sensitive API issues, view error codes for failed Win32 functions, reverse engineer other Win32 applications without source code, locate DLLs loaded by an application, and discover what registry keys are used by an application.
TracePlus/Win32 has proprietary technology called Cyclone Plus which detects and hooks API functions both inside and outside of the process being spied upon. Thus Java applications, Active X controls, out of process OLE servers, and child processes will be detected and traced automatically.
TracePlus can prevent an application from detecting that it is being run in a debugger. Some well known applications have code in them that prevent applications such as TracePlus from revealing the way that they operate. Such applications abort immediately after they are launched, or disable certain features of the application when a debugger is detected.
TracePlus is aware of several different methods by which applications can detect whether they are being debugged. Via these same techniques, TracePlus indicates to the application that in fact it is not being debugged. Such applications will then run normally inside of TracePlus.
Main features:
- Supported API functions that fail are indicated in the Diagnostics View along with the Win32 error code describing the failure
- Displays API calls originating from ActiveX controls and COM objects instanced by an application
- Displays API and ODBC calls originating from a child process
- Displays ODBC calls originating from the Microsoft Jet Database Engine, and Active Data Objects (ADO)
- Works with most commercial Win32 applications (release versions) with no modifications to the target application
- Compatible with Microsoft Terminal Server and Remote Desktop (Windows NT 4.x, Windows 2000, Windows 2003 Server)
- Supports Win32 .EXE files from all languages and compilers (including Visual C++, Visual Basic, Visual C#, Microsoft Access, MASM, Borland Delphi and C++ Builder, Sybase PowerBuilder)
- Works with most Win32 Services on platforms that support services (Windows NT 4.x, Windows 2000, Windows XP, Windows 2003 Server)
- The Registry View displays accesses made to the Windows registry by one or more processes. Using a unique algorithm, TracePlus determines the full key name as well as displaying the value of the key.
- Registry accesses that fail are indicated in the Registry View along with the Win32 error code describing the failure
- User-definable filters limit what is displayed in the Registry View to the types of Registry accesses that interest you
- The text of SQL statements transmitted via the ODBC API is displayed in the SQL View
- Contents of result columns displayed in the SQL View along with the SQL statement
- Displays the contents of all variables bound to parameters in a SQL Statement. This information is displayed inside the ODBC functions SQLExecute() or SQLExecDirect() in the Diagnostics View.
- Execution time is profiled in the SQL View for each SQL statement
- SQL statements that fail are indicated in the SQL View along with full ODBC error information describing the failure
- File opening, closing, creation, deletion, copying, moving, and renaming by an application are detailed in the File I/O View
- File reads, writes, locks, and unlocks are detailed in the File I/O View
- Manipulation of mapped files (open, create, close, read, write, flush) are detailed in the File I/O View
- The referenced filename is displayed for every file open or create appearing in the File I/O View
- Mapped Views are supported in the File I/O View
- User-definable filters limit what is displayed in the File I/O View to the types of File I/O that interest you
- The status of COM object creation via CoCreateInstance() and CoCreateInstanceEx() is detailed in Status View
- DLL loading and unloading is profiled in the Status View. DLL load events contain version information (if available) for the module being loaded.
- The text of messages sent via OutputDebugString() appears in the Status View
- User definable filter profiles enable separate API configurations for different capture sessions