Programmers' Tools - hook, spy

WinAPIOverride32

Fri, 15 Aug 2008 05:14:45 -0700

Version:
5.0.0

News:

WinAPIOverride :
  - New hooking way
       No stack pointer change (no stack hooking algorithm)
       No base pointer change (allow to hook functions compiled with /Oy optimization)
       Exceptions are not catch and rethrown but just spied, and exception registers are logged
       Call analysis doesn't require the "try to retrieve call stack" option
...

Description:

This software allows you to monitor and/or override any function of a process.
This can be done for API functions, executable internal functions COM or ActiveX methods.

WinAPIOverride is more than a standard API monitoring software.
It can break targeted application before or after a function call, allowing memory or registers changes; and it can directly call functions of the targeted application.

These features allows to fill the gap between classical API monitoring softwares and debuggers.

Main differences between over API hooker :
  - You can define filters on parameters or function result
  - You can define filters on dll to discard calls from windows system dll
  - You can hook functions inside the target process not only API
  - You can hook asm functions with parameters passed through registers
- Pre and Post API call hooking chain (you can install multiple hooks for the same function)
  - Monitor hardware and software exceptions
- COM / ActiveX hooking support
  - Double and float results are logged
  - You can easily override any API, any process internal function, any COM or ActiveX method
  - You can break process before or/and after function call to change memory or registers
  - You can call functions which are inside the remote processes
  - All is is done like modules : you can log or override independently for any function

Daphne

Fri, 15 Aug 2008 04:29:45 -0700

Version:
1.36

News:

Process list highlighting with colors for custom, system and high CPU-consumption processes.
Corrected a bug: Save configuration on session end or system shutdown.
Corrected a bug: Process with more than 100% CPU at startup.

Description:

Daphne is a small (system tray) application for killing, controlling and debuging window's processes. You can kill a process by dragging the mouse over the windows, by right-clicking the process in the main process list, or by typing its name with the "Kill all by name" command. You can set a any window to be always on top, to be transparent, to be enable, et cetera. The main window displays a list of currently running process with detailed information about:

Window Hack

Thu, 18 Jan 2007 13:44:21 -0800

Version:
3.0

News:

Added Extended Window/Window/Control style names
Added Action -> Set Transparent (for NT only)
Added HWND_BROADCAST to Send Message
Fixed Set Window Pos

Description:

Window Hack is a program to spy any windows and can modify windows.

Regmon

Mon, 11 Dec 2006 17:27:47 -0800

Version:
7.04

Description:

Regmon is a Registry monitoring utility that will show you which applications are accessing your Registry, which keys they are accessing, and the Registry data that they are reading and writing - all in real-time. This advanced utility takes you one step beyond what static Registry tools can do, to let you see and understand exactly how programs use the Registry. With static tools you might be able to see what Registry values and keys changed. With Regmon you'll see how the values and keys changed..

Regmon works on Windows NT/2000/XP/2003, Windows 95/98/Me and Windows 64-bit for Itanium and x64.

Filemon

Mon, 11 Dec 2006 17:27:09 -0800

Version:
7.04

Description:

FileMon monitors and displays file system activity on a system in real-time. Its advanced capabilities make it a powerful tool for exploring the way Windows works, seeing how applications use the files and DLLs, or tracking down problems in system or application file configurations. Filemon's timestamping feature will show you precisely when every open, read, write or delete, happens, and its status column tells you the outcome. FileMon is so easy to use that you'll be an expert within minutes. It begins monitoring when you start it, and its output window can be saved to a file for off-line viewing. It has full search capability, and if you find that you're getting information overload, simply set up one or more filters.

FileMon works on NT 4.0, Windows 2000, Windows XP, Windows XP and Windows Server 2003 64-bit Edition, Windows 2003 Server, Windows 95, Windows 98 and Windows ME.

TracePlus/Win32

Mon, 17 Jul 2006 13:10:05 -0700

Version:
5.0

Description:

TracePlus®/Win32 provides information on application usage of the Win32, ODBC, and DB-Library APIs. It traces 25 categories of API functions, comprising nearly 1200 API calls.

Using its unique visual realtime display of Win32 activity, you can spot timing-sensitive API issues, view error codes for failed Win32 functions, reverse engineer other Win32 applications without source code, locate DLLs loaded by an application, and discover what registry keys are used by an application.

Detours

Thu, 8 Jun 2006 11:07:48 -0700

Version:
2.1

Description:

Detours is a library for instrumenting arbitrary Win32 functions on x86 machines. Detours intercepts Win32 functions by re-writing target function images. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.

WinID

Sat, 1 Apr 2006 01:30:35 -0800

Version:
3.1

Description:

WinID is controls & windows identification utility that is both powerful and compact. Its main purpose is to give an easy way to retrieve information about Microsoft Windows controls visually right off the screen. WinID resembles Spy++ from the Microsoft Visual Studio toolset but it also incorporates lots of its own handy features.

API Mon

Sat, 25 Feb 2006 08:21:33 -0800

Version:
2.0.0

Description:

You can monitor all imported API of any process. Without problems works on Win XP. Framework v2 needed

UsaMimi Hurricane

Fri, 16 Dec 2005 02:56:21 -0800

Version:
0.07

Description:

Easy-to-use GUI
Multi Document Interface
Real-time process memory edit
Copy and Paste
Search, Change Search, Search & Replace
Dump memory as file

ATM

Fri, 16 Dec 2005 02:56:15 -0800

Version:
3.0

Description:

ATM is a Windows9x/ME-only application ideated for power-users who actually want to handle their systems. It offers all the features provided by a good task manager, and many other useful functions. Real-time capability to monitor all processes and threads, their CPU usage, execution time, etc. Complete management of the system priority of all running processes and threads. Ability to define "actions" (User Actions) ATM will execute when your defined conditions will take place. CPU cooler. System information, ...

ProcessENG

Fri, 16 Dec 2005 02:56:14 -0800

Version:
1.6

Description:

The program lists all running processes and allows you to kill/dump them. Furthermore you can get all OEPs (OriginalEntryPoints) of the running processes an you can view the modules of a process. In addition it can list all WindowClassNames! You will also find a MessageMonitor, which lists all windowsmessages a process sends and gets! Source code included.

Process Memory Manipulator

Fri, 16 Dec 2005 02:56:06 -0800

Version:
0.2

Description:

Process memory manipulator is a win32 application which allows to map the memory of a specified currently running process.

zero Dump

Fri, 16 Dec 2005 02:54:33 -0800

Version:
0.1

Description:

It is able to hook window controls and modify them. It catches handle of target window by mouse navigation and it captures victim. You can modify properties of target handle. Source Code is available.

Spy & Capture

Fri, 16 Dec 2005 02:54:26 -0800

Version:
2.7

Description:

Spying tool for Windows 9x/NT. It uses direct mouse positioning to get window properties and all it's objects, styles, classes and process information. If the window is a control you get it's control styles. Also included: