监视 Windows 中进程执行的某些系统调用
我希望能够监视进程进行的某些系统调用，主要是文件 I/O 调用。 在 Linux 上，我可能可以使用带有合适参数的 strace 来摆脱困境，但是我如何在 Windows 上执行此操作？
我主要感兴趣的是运行一个进程并找出它已读取和写入的文件。
我想从另一个进程以编程方式执行此操作。 我知道 进程监视器，但我希望以我希望的形式接收数据可以导入到另一个程序中进行进一步分析。
如果我进一步缩小需求范围，那么能够监视对 CreateFile() 的调用可能就足够了。 我真的只对打开哪些文件以及打开它们进行读/写还是只是读取感兴趣。 我没有真正说明的另一个要求是速度相当重要； 我计划这样做是为了编译 C++ 文件之类的事情，并拉出一个生成 20 MB 日志文件的完整 GUI，这将产生令人望而却步的开销。
如果不需要管理权限，那就太好了。
I would like to be able to monitor certain system calls made by a process, primarily file I/O calls. On Linux I can probably get away using strace with suitable parameters, but how can I do this on Windows?
I'm primarily interested in running a process and figuring out which files it has read and written.
I want to do this programmatically from another process. I'm aware of Process Monitor, but I would like to receive the data in a form which I can import into another program for further analysis.
If I narrow down my requirements even further, it is probably enough to be able to monitor calls to CreateFile(). I'm really only interested in what files are opened, and if they are opened for read/write or just read. Another requirement which I didn't really state is that speed is fairly important; I was planning on doing this for things like compiling a C++-file, and pulling up a full GUI which generates a 20 MB logfile will have prohibitive overhead.
It would also be nice if it did not require administrative privileges.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
DTRACE
我想提一下这个工具，它是专门为监视 Solaris 中的系统调用而创建的，但后来被移植到了 Windows。
https://learn.microsoft.com/en-us/ windows-hardware/drivers/devtest/dtrace
不幸的是：
需要管理权限。
不过，我认为可以编写该程序的脚本来准确显示正在执行的 CreateFile() 系统调用。
DTRACE
I want to mention this tool that was intentionally created for monitoring system calls in Solaris but later was ported to windows.
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace
Unfortunately:
Requires administrative privileges.
However I think it is possible to script this program to display exactly the CreateFile() syscall being executed.
使用
strace。 输出示例：open(".", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3 fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) getdents64(3, /* 18 entries */, 4096) = 496 getdents64(3, /* 0 entries */, 4096) = 0 close(3) = 0 fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f2c000 write(1, "autofs\nbackups\ncache\nflexlm\ngames"..., 86autofsAUse
strace. Example output:open(".", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3 fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) getdents64(3, /* 18 entries */, 4096) = 496 getdents64(3, /* 0 entries */, 4096) = 0 close(3) = 0 fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f2c000 write(1, "autofs\nbackups\ncache\nflexlm\ngames"..., 86autofsAWindows 上有多个选项。
Windows Performance Toolkit 可用于启用对各种系统的跟踪事件，包括文件 I/O，并包括用于处理和查看这些事件的工具。 您可以使用 xperf 开始跟踪各种类型的事件并保存到 ETL 文件，然后您可以稍后使用相同的工具处理或查看该文件。
进程监视器来自 Sysinternals 是另一个非常易于使用的选项，它使您能够快速查看系统上任何进程正在执行的所有文件和注册表访问。 您还可以以自动化方式运行 Process Monitor。
如果您想完全以编程方式执行此操作，则可以使用 ETW 函数（StartTrace、EnableTrace 等）来捕获文件 I/O 事件并保存到 ETL 文件。 示例代码此处。
There are several options on Windows.
Windows Performance Toolkit can be used to enable tracing of various system events, including file I/O, and includes tools for processing and viewing these events. You can use xperf to begin trace variously classes of events and save to an ETL file that you can then process or view using the same tools later.
Process Monitor from Sysinternals is another, very easy to use, option, and enables you to quickly see all file and registry accesses any process on the system is doing. You can also run Process Monitor in an automated fashion.
If you'd like to do this completely programmatically, you can use the ETW functions (StartTrace, EnableTrace, etc.) to snap file I/O events and save to an ETL file. Sample code here.
在 Windows 上，您可以使用进程监视器来监视进程活动（I/O 和注册表）。 如果您真的不想知道系统调用，我想这符合您的需求。
您可以使用 winapioverride32 来监控 API 调用。
On Windows, you can use Process Monitor to monitor process activity (I/O and registry). I guess this fits your need if you don't really want to know the system calls.
And you can use winapioverride32 to monitor API calls.
Rohitab Batra 的 API Monitor 非常适合系统调用。
API Monitor by Rohitab Batra is very good for system calls.
使用 FileMon （现已集成到 进程监视器）。
还有NtTrace，类似于strace。
Use FileMon (now integrated into Process Monitor).
There is also NtTrace, similar to strace.
另一个 Windows API 跟踪工具：
logexts.dll（Windows 调试工具的一部分），它可以从 WinDbg/ntsd/cdb 内部运行或通过独立的logger.exe< /代码> 程序。Another Windows API tracing tool:
logexts.dll(part of the Debugging Tools for Windows), which can be run from inside WinDbg/ntsd/cdb or through a standalonelogger.exeprogram.另一种方法是使用 Deviare API Hook 并拦截所有用户-您想要的模式系统调用。 使用此框架，您可以为所有调用编写通用处理程序，因为可以使用 COM 接口读取参数（例如，每个参数都是 INktParam，并且您可以使用 INktParam.Value 获取值）。
另一种选择，但需要花费一些钱，是使用 SpyStudio同一家公司。 该产品有一个命令行选项，可用于在没有 GUI 的情况下收集日志。
Another way is to use Deviare API Hook and intercept all user-mode system calls that you want. Using this framework you can code a generic handler for all calls since the parameters can be read using COM interfaces (for example, each parameter is an INktParam, and you can get the value using INktParam.Value).
Another alternative, but it will cost some money, is to use SpyStudio from the same company. This product has a command-line option that is useful to collect logs without a GUI.