PnigoSpy[任意进程API监控工具]
希望能求个邀请码Thx,自己写的小Demo,发了源码,共同学习,Any comment is welcomed.
PnigoSpy:
开发环境：Win7 x64 VS2010 Detours3.0
本程序可以对正在运行的任意进程的API调用进行监控，并在当前目录生成日志文件便于查看。
执行程序查看帮助：
[图片:152151741.jpg]screen.width*0.6) {this.width=screen.width*0.6;this.alt='';this.onmouseover=this.style.cursor='pointer';this.onclick=function(){window.open('http://img1.51cto.com/attachment/201111/152151741.jpg')}}" />
-l 列出当前运行的进程信息。
-p 指定要监控的进程PID。
-o 在程序退出后结束程序。
-q 采用安静模式,不将监控信息显示到cmd中。
-h 查看帮助。
[图片:152701322.png]screen.width*0.6) {this.width=screen.width*0.6;this.alt='';this.onmouseover=this.style.cursor='pointer';this.onclick=function(){window.open('http://img1.51cto.com/attachment/201111/152701322.png')}}" />
查找到calc.exe的PID:5768
[图片:153824389.png]screen.width*0.6) {this.width=screen.width*0.6;this.alt='';this.onmouseover=this.style.cursor='pointer';this.onclick=function(){window.open('http://img1.51cto.com/attachment/201111/153824389.png')}}" />
下面我们开始进行监控：
PnigSpy.exe -p 5768 /q /o log.txt
[图片:154044378.png]screen.width*0.6) {this.width=screen.width*0.6;this.alt='';this.onmouseover=this.style.cursor='pointer';this.onclick=function(){window.open('http://img1.51cto.com/attachment/201111/154044378.png')}}" />
查看 log.txt
[图片:154247479.png]screen.width*0.6) {this.width=screen.width*0.6;this.alt='';this.onmouseover=this.style.cursor='pointer';this.onclick=function(){window.open('http://img1.51cto.com/attachment/201111/154247479.png')}}" />