win32 api monitor

R API Monitor description
API Monitor is a software that monitors and displays API calls made by applications. API Monitor is a software that monitors and displays API calls made by applications. Its a powerful tool for seeing how Windows and other applications work or tracking down problems that you have in your own applications.

API Monitor also includes useful Filters to monitor the following API Categories.

Since API Monitor is a User-Mode application, it can only monitor APIs called by User-Mode applications. APIs called by drivers will not be monitored. NT Services cannot be monitored using this version of API monitor

Here are some key features of "R API Monitor":

· API Filter - APIs can be filtered based on their category. Only APIs from the selected categories will be monitored. All other APIs will be bypassed
· Process Filter - A process filter is used to select processes that are to be monitored. You can either specify an include process filter or an exclude process filter. The process filter can also be disabled, so that API Monitor will include all processes
· Detailed API Information
· Unicode and ANSI Support - Besides displaying the API called, API Monitor also displays information about the encoding used by the API. For Unicode APIs the character "W" is appended to the name of the API. For ANSI APIs the character "A" is appended to the API. For e.g. if an application calls the Unicode version of CreateFile, API Monitor displays CreateFileW. If the ANSI version is called instead, API Monitor displays CreateFileA.
· Message Log - When a capture is started, API Monitor displays the process name and process ID of each process it finds. It also displays information about whether the process is being monitored or not
· Error Code Lookup - API Monitor includes an Error Code lookup tool that can be used to get a description of an error, given the error code. It provides description for the following types of errors: Standard Win32 Network NTSTATUS - Windows NT Only Windows Sockets - Only English Messages
· IOCTL Decoder - A tool to decode IOCTL codes. It gives full information about the IOCTL, which includes the IOCTL Name, Device Type, Function Code, Access Type and Method. You can also try our online IOCTL Decoder.
· NT Native API: - Support for NTs Native API Calls. More calls have been added in this version. Parameter Information, Return Type and Error Codes have been included for most of the Ntxxx APIs and some Rtlxxx APIs. For undocumented Native APIs, a stack dump of 10 (possible) arguments is displayed
· Process Loader - API Monitor includes a process loader that can be used to monitor APIs called by console mode applications or to monitor APIs called very early in the program. It can also be used to monitor APIs in programs like RUNDLL32
· Monitor Running Process: - This version of API Monitor includes a Monitor Running Process tool that can be used to monitor APIs in a background or console process that is already running. A complete list of processes that are currently running in the system is displayed, and you can select the one that you want to monitor. DO NOT try to monitor NT Services using this method as they will hang. It is highly recommended that you use till tool only when all other methods of monitoring the process fail.s
· GetProcAddress Hook - A new option has been added, where in, you can select if APIs called using LoadLibrary-GetProcAddress are hooked or not.
· API Details - Double-clicking or pressing the return key on an API opens up the API Details window, which displays the details of the API in a easy to read format. It also provides a description of the error if the API call failed
· Buffer Display - For some API calls like WriteFile, ReadFile, send, RegSetValueExW, etc. buffers can be displayed using the display buffer button in API Details.
· Integrated MSDN Help - This feature allows you to view MSDN context-sensitive help for the currently selected API. You need to have MSDN library installed for this to work.
· Standard Features - API Monitor allows a capture to be saved for later viewing. If a capture is started when a capture while is open, monitored calls are appended to the file. This feature allows you to view MSDN context-sensitive help for the currently selected API. You need to have MSDN library installed for this to work.

Java Application Monitor (JAMon) project is a free, simple, high performance, thread safe, Java API that allows developers to easily monitor production applications. JAMon can be used to determine application performance bottlenecks, user/application interactions, and application scalability.

JAMon gathers summary statistics such as hits, execution times (total, average, minimum, maximum, standard deviation), and simultaneous application requests. JAMon statistics are displayed in the clickable JAMon Report. Click JAMon report to see a live demo of JAMon.

JAMon was developed primarily for monitoring J2EE applications, however it can be used in any JDK 1.2 or higher environment. JAMon can be used in Servlets, JSPs, EJBs and Java Beans in various J2EE Application Servers (Sybases EAServer, and BEAs WebLogic, ), and can also be used in other programming environments that can call Java code (ColdFusion, PowerBuilder, BroadVision, ...).

Feel free to continue reading the users guide or download JAMon and read the Java Docs.

Using JAMon is easy. Place JAMon.jar (90K) in your classpath, and surround the code that you wish to monitor with the JAMon APIs start() and stop() methods. See the code sample below:

import com.jamonapi.*;
...
Monitor mon=MonitorFactory.start("myFirstMonitor");
...Code Being Timed...
mon.stop();

For example, to collect statistics for all JSP pages in a Web Application, a developer would place a call to the start() method at the top of every JSP, and a call to the stop() method at the bottom. With a few minutes work the developer will have statistics for all application pages. The statistics will include number of page hits, average page execution times, and the number of users simultaneously accessing each page. The statistics can be displayed as an HTML table by calling the getReport() method, or using JAMonAdmin.jsp.

JAMon requires no special administration accounts. Many monitoring tools require administrative accounts to install monitoring software, and to view statistics. Due to the complexity of these tools, developers typically go through specially trained administrators to access monitoring statistics. Many of these monitoring tools also require holes punched in firewalls.

JAMon has none of these problems. Statistics gathered via JAMon are available to all developers via JAMonAdmin.jsp. No administrative accounts, rights, or set-up are required for gathering and viewing statistics. Because the JAMon API is part of the application code, developers can switch J2EE App Servers and monitoring will continue to work. JAMonAdmin.jsp is accessed via HTTP and so can be viewed without punching any additional holes in firewalls.

JAMon can be used to monitor production systems. Monitoring production systems is important because it is the only way we can see the frequency that our code is being executed by real users. Also, many times the configuration of the production environment is different from the test environment, so the performance numbers between the two environments may be considerably different. For both these reasons monitoring only the test environment is not enough.

Unlike many monitoring tools, JAMon, due to its minimal performance overhead and multi-threaded capabilities, can be used in production systems. JAMon can be disabled at runtime (using JAMonAdmin.jsp), further reducing performance overhead. On a 2 Ghz Pentium IV, JAMons start(), and stop() methods execute 500,000 times per second. After disabling, the methods execute 30,000,000 times per second.

To test JAMons performance download JAMon.jar and execute the following command. The number represents how many times start(), and stop() should be called in the various tests (100,000 will be used as the default if a number is not provided).

java -cp JAMon.jar com.jamonapi.TestClassPerformance 500000

The last label ("Full Factory TimingMonitor()") in the output indicates how long it takes to run when monitoring is enabled, and the label starting with "NullMonitor2()" indicates how long it takes to run when monitoring is disabled.

JAMon is flexible. Many monitoring tools specialize in monitoring specific parts of an application. This can force a developer to resort to using multiple monitoring tools to cover all of their monitoring needs. For example, a developer may have to use different tools to monitor each of the following: page hits, EJB invocations, method calls and database connections,... .

JAMons start() method takes a string as an argument. This string can be a JSP page name, an EJB name, a method name or any other code or concept that can be represented by a string.

Also, because strings are passed to the start() method, a developer can decide what to monitor based on runtime data. Using this technique we can monitor trends as well as performance bottlenecks. Some examples of JAMons flexibility:

Keep statistics for a JSP home page
- Monitor mon=MonitorFactory.start("HomePage");
Keep statistics for a DataAccess classs openConnection() method (which opens a database connection)
- Monitor mon=MonitorFactory.start("DataAccess.openConnection()");
Keep statistics for each user that logs into our system
- Monitor mon=MonitorFactory.start(getUserName());
Keep statistics for all page accesses by date. For example, "pageAccesses.05/10/02"
- Monitor mon=MonitorFactory.start("pageAccesses."+getTodaysDate());

Whats New in This Release:

· This release adds a JAMon log4j Appender that will allow developers to keep aggregate statistics on log4j messages.
· For example, they will be able to use a JAMon Web page to view how many errors have been sent to log4j.
· They will also be able to tail the log4j log file via a JAMon Web page.
· All of this can be configured via the log4j XML or properties configurator.
· No code changes are required in your application.

Do you want to feel the speed and flexibility of Windows API programming? Then this tool will help you to incorporate all the Window API 32-bit directly into your Visual Basic application.

Monitoring API project is a multi-user programming interface designed to simplify the development of network monitoring software and allows users to express their monitoring needs in a device-independent way.

The main abstraction provided by MAPI is the network flow. Although flows have been used before in network monitoring systems, MAPI gives flows a first-class status. Applications that uses MAPI can specify what flows or flow statistics they are interested in by applying functions to flows.

A MAPI function can be a BPF filter, string search, packet counter or more advanced like a NetFlow generator. These function will automatically run in hardware if there is support for it on the hardware being used.

MAPI currently supports the following hardware:

- Normal NICs through libpcap
- DAG cards without co-processor
- SCAMPI adapter

Whats New in This Release:

· This release includes support for distributed monitoring, several new MAPI functions, demo applications, and a lot of bugfixes.

Win32 APIDOS is a free and useful Win API utility.

JAMon API description
JAMon API is a free, high performance, simple, thread safe, Java API that allows developers to easily monitor applications JAMon API (Java Application Monitor API) is a free, high performance, simple, thread safe, Java API that allows developers to easily monitor production applications.

JAMon was developed primarily for monitoring J2EE applications, however JAMon 1.0/2.0 can be used in any JDK 1.2 or higher environment, and JAMon 2.1 can be used in any JDK 1.4 or higher environment.

JAMon can be used in Servlets, JSPs, EJBs and Java Beans in various J2EE Application Servers (Sybases EAServer, and BEAs WebLogic, WebSphere ), and can also be used in other programming environments that can call Java code (ColdFusion, PowerBuilder, BroadVision, ...).

JAMon is particularly useful in multithreaded software like a database engine.

The BoogieBounce API (84kb Win32 DLL) enables your application to recognize hundreds (600+) of email bounce formats. Easy to use, robust, extremely fast, and powerful, the BoogieBounce API was designed for professional developers who demand the best.

KaKeeware Application Monitor is a very small API monitor that will allow the user to monitor the APIs called by the given application.

KAM supports 2378 different APIs as for now. KAM works as an API spy that may help the developers and localization engineers to find the bugs in the release versions of the software. It can be also used by malware analysts to check which APIs are used by the sample they analyze.

Hook API SDK is a useful Software Development Kit for easy and quickly develop Windows system wide hooking program. It helps you hooking Windows system functions or functions in 3rd applications, this means you can call your own functions instead of some Windows system APIs or functions of other appliction, intercepts Windows system or 3rd applications functions and re-writing target function to easily customize and extend System or other existing application, whether an executable, or a library. Hook API SDK can be used in VC++,VB,C++ Builder or Delphi, etc.

Hook API SDK gives you the ability to intercept existing system or applications function dynamically at runtime. Hook API SDK enables a large class of innovative extensions to existing binary software or existing System functions. Hook API SDK offers a dynamic link library for intercept and re-writing Win32 functions of system or applications, No need of drivers, No need of restarting windows, It makes you do innovative system deep-level funtions in your normal applictions easily.

Using Hook API SDK, you can do things as: monitor and control system file access, monitor and control registry access, monitor and control network access, monitor and control programs behavior, hide program from Task Manager, hide directory and files from Explorer...

TracePlus Win description
It shows you the interaction between your Win32 application and multiple Win32 APIs TracePlus/Win32 will provide information on application usage of the Win32, ODBC, RAS, MAPI, TAPI and Win32 Internet APIs.

TracePlus Win32 traces 32 categories of API functions, comprising nearly 1350 API calls.

The API categories are:
· Access Control
· Profile Functions
· Application related (Kernel)
· Registry
· Common Controls
· Remote Access (RAS)
· Date and Time
· Resource Management
· DDEML
· Serial Communications
· Windows NT Event Log
· Service Manager
· File I/O
· Shell
· File System
· Simple MAPI
· Memory Management
· System Related
· Multimedia APIs
· TAPI
· Network (WNetxxx() functions)
· Threads
· ODBC (Full ODBC 3.x support)
· Timers
· OLE (Base)
· Tokens
· OLE (COM)
· Win32 Internet API (Expanded support)
· Pipes and Mailslots
· Windows GUI (Expanded support)
· Processes

Using its unique visual realtime display of Win32 activity, you can spot timing-sensitive API issues, view error codes for failed Win32 functions, reverse engineer other Win32 applications without source code, locate DLLs loaded by an application, and discover what registry keys are used by an application.

TracePlus/Win32 has proprietary technology called Cyclone Plus which detects and hooks API functions both inside and outside of the process being spied upon. Thus Java applications, Active X controls, out of process OLE servers, and child processes will be detected and traced automatically.

TracePlus can prevent an application from detecting that it is being run in a debugger. Some well known applications have code in them that prevent applications such as TracePlus from revealing the way that they operate. Such applications abort immediately after they are launched, or disable certain features of the application when a debugger is detected.

TracePlus is aware of several different methods by which applications can detect whether they are being debugged. Via these same techniques, TracePlus indicates to the application that in fact it is not being debugged. Such applications will then run normally inside of TracePlus.

Here are some key features of "TracePlus Win":

· Supported API functions that fail are indicated in the Diagnostics View along with the Win32 error code describing the failure
· Displays API calls originating from ActiveX controls and COM objects instanced by an application
· Displays API and ODBC calls originating from a child process
· Displays ODBC calls originating from the Microsoft Jet Database Engine, and Active Data Objects (ADO)
· Works with most commercial Win32 applications (release versions) with no modifications to the target application
· Compatible with Microsoft Terminal Server and Remote Desktop (Windows NT 4.x, Windows 2000, Windows 2003 Server)
· Supports Win32 .EXE files from all languages and compilers (including Visual C++, Visual Basic, Visual C#, Microsoft Access, MASM, Borland Delphi and C++ Builder, Sybase PowerBuilder)
· Works with most Win32 Services on platforms that support services (Windows NT 4.x, Windows 2000, Windows XP, Windows 2003 Server)
· The Registry View displays accesses made to the Windows registry by one or more processes. Using a unique algorithm, TracePlus determines the full key name as well as displaying the value of the key.
· Registry accesses that fail are indicated in the Registry View along with the Win32 error code describing the failure
· User-definable filters limit what is displayed in the Registry View to the types of Registry accesses that interest you
· The text of SQL statements transmitted via the ODBC API is displayed in the SQL View
· Contents of result columns displayed in the SQL View along with the SQL statement
· Displays the contents of all variables bound to parameters in a SQL Statement. This information is displayed inside the ODBC functions SQLExecute() or SQLExecDirect() in the Diagnostics View.
· Execution time is profiled in the SQL View for each SQL statement
· SQL statements that fail are indicated in the SQL View along with full ODBC error information describing the failure
· File opening, closing, creation, deletion, copying, moving, and renaming by an application are detailed in the File I/O View
· File reads, writes, locks, and unlocks are detailed in the File I/O View
· Manipulation of mapped files (open, create, close, read, write, flush) are detailed in the File I/O View
· The referenced filename is displayed for every file open or create appearing in the File I/O View
· Mapped Views are supported in the File I/O View
· User-definable filters limit what is displayed in the File I/O View to the types of File I/O that interest you
· The status of COM object creation via CoCreateInstance() and CoCreateInstanceEx() is detailed in Status View
· DLL loading and unloading is profiled in the Status View. DLL load events contain version information (if available) for the module being loaded.
· The text of messages sent via OutputDebugString() appears in the Status View
· User definable filter profiles enable separate API configurations for different capture sessions


Requirements:

· Compatible with the WOW64 subsystem on Windows XP x64, Windows 2003 Server x64, and Windows Vista x64
· Pentium 3 or AMD Athlon 1 GHZ or greater
· 192 MB RAM
· 10 MB disk space

Limitations:

· Function details in the Diagnostics View will be fully visible for the first 20 items.
· Certain statistics in all views will be fully visible for the first 20 items

TracePlus/Win32 will provide information on application usage of the Win32, ODBC, RAS, MAPI, TAPI and Win32 Internet APIs.

TracePlus Win32 traces 32 categories of API functions, comprising nearly 1350 API calls.

The API categories are:
· Access Control
· Profile Functions
· Application related (Kernel)
· Registry
· Common Controls
· Remote Access (RAS)
· Date and Time
· Resource Management
· DDEML
· Serial Communications
· Windows NT Event Log
· Service Manager
· File I/O
· Shell
· File System
· Simple MAPI
· Memory Management
· System Related
· Multimedia APIs
· TAPI
· Network (WNetxxx() functions)
· Threads
· ODBC (Full ODBC 3.x support)
· Timers
· OLE (Base)
· Tokens
· OLE (COM)
· Win32 Internet API (Expanded support)
· Pipes and Mailslots
· Windows GUI (Expanded support)
· Processes

Using its unique visual realtime display of Win32 activity, you can spot timing-sensitive API issues, view error codes for failed Win32 functions, reverse engineer other Win32 applications without source code, locate DLLs loaded by an application, and discover what registry keys are used by an application.

TracePlus/Win32 has proprietary technology called Cyclone Plus which detects and hooks API functions both inside and outside of the process being spied upon. Thus Java applications, Active X controls, out of process OLE servers, and child processes will be detected and traced automatically.

TracePlus can prevent an application from detecting that it is being run in a debugger. Some well known applications have code in them that prevent applications such as TracePlus from revealing the way that they operate. Such applications abort immediately after they are launched, or disable certain features of the application when a debugger is detected.

TracePlus is aware of several different methods by which applications can detect whether they are being debugged. Via these same techniques, TracePlus indicates to the application that in fact it is not being debugged. Such applications will then run normally inside of TracePlus.

Here are some key features of "TracePlus Win":

· Supported API functions that fail are indicated in the Diagnostics View along with the Win32 error code describing the failure
· Displays API calls originating from ActiveX controls and COM objects instanced by an application
· Displays API and ODBC calls originating from a child process
· Displays ODBC calls originating from the Microsoft Jet Database Engine, and Active Data Objects (ADO)
· Works with most commercial Win32 applications (release versions) with no modifications to the target application
· Compatible with Microsoft Terminal Server and Remote Desktop (Windows NT 4.x, Windows 2000, Windows 2003 Server)
· Supports Win32 .EXE files from all languages and compilers (including Visual C++, Visual Basic, Visual C#, Microsoft Access, MASM, Borland Delphi and C++ Builder, Sybase PowerBuilder)
· Works with most Win32 Services on platforms that support services (Windows NT 4.x, Windows 2000, Windows XP, Windows 2003 Server)
· The Registry View displays accesses made to the Windows registry by one or more processes. Using a unique algorithm, TracePlus determines the full key name as well as displaying the value of the key.
· Registry accesses that fail are indicated in the Registry View along with the Win32 error code describing the failure
· User-definable filters limit what is displayed in the Registry View to the types of Registry accesses that interest you
· The text of SQL statements transmitted via the ODBC API is displayed in the SQL View
· Contents of result columns displayed in the SQL View along with the SQL statement
· Displays the contents of all variables bound to parameters in a SQL Statement. This information is displayed inside the ODBC functions SQLExecute() or SQLExecDirect() in the Diagnostics View.
· Execution time is profiled in the SQL View for each SQL statement
· SQL statements that fail are indicated in the SQL View along with full ODBC error information describing the failure
· File opening, closing, creation, deletion, copying, moving, and renaming by an application are detailed in the File I/O View
· File reads, writes, locks, and unlocks are detailed in the File I/O View
· Manipulation of mapped files (open, create, close, read, write, flush) are detailed in the File I/O View
· The referenced filename is displayed for every file open or create appearing in the File I/O View
· Mapped Views are supported in the File I/O View
· User-definable filters limit what is displayed in the File I/O View to the types of File I/O that interest you
· The status of COM object creation via CoCreateInstance() and CoCreateInstanceEx() is detailed in Status View
· DLL loading and unloading is profiled in the Status View. DLL load events contain version information (if available) for the module being loaded.
· The text of messages sent via OutputDebugString() appears in the Status View
· User definable filter profiles enable separate API configurations for different capture sessions

Windows API hooking SDK helps you hooking Windows APIs or functions in other Dlls, and replace the API function or Dlls function to your own function, That is to say, intercepts Win32 functions and re-writing target function to easily custom and extend existing system or applications function, whether in an executable application, a library, or the systems DLLs... and it can be used in VC++,VB,C++ Builder,Delphi, etc.

Windows API hooking SDK gives you the ability to intercept and then custom and extend existing system or applications function dynamically at runtime easily. Windows API hooking SDK enables a large class of innovative extensions to existing binary software or existing system functions. Windows API hooking SDK offers a dynamic link library for intercept and re-writing Win32 functions of system or applications. No need of drivers, No need of restarting windows, It makes you do innovative system deep-level funtions in your normal applictions easily.

By using Windows API hooking SDK, you can do many many things, such as: monitor and control programs; monitor and control file access; monitor and control registry access; monitor and control network access; hide private directory and files...

Windows API hooking SDK helps you hooking Windows APIs or functions in other Dlls, and replace the API function or Dlls function to your own function, That is to say, intercepts Win32 functions and re-writing target function to easily custom and extend existing system or applications function, whether in an executable application, a library, or the systems DLLs... and it can be used in VC++,VB,C++ Builder,Delphi, etc.

Windows API hooking SDK gives you the ability to intercept and then custom and extend existing system or applications function dynamically at runtime easily. Windows API hooking SDK enables a large class of innovative extensions to existing binary software or existing system functions. Windows API hooking SDK offers a dynamic link library for intercept and re-writing Win32 functions of system or applications. No need of drivers, No need of restarting windows, It makes you do innovative system deep-level funtions in your normal applictions easily.

By using Windows API hooking SDK, you can do many things, such as: monitor and control file access, monitor and control programs, monitor and control network access, monitor and control registry access, hide private directory and files...