From Collaborative RCE Tool Library
SysCall Monitoring Tools
| Tool name: | radare |
| ||
|---|---|---|---|---|
| Author: | pancake | |||
| Website: | http://www.radare.org | |||
| Current version: | 1.4.1 | |||
| Last updated: | November 3, 2009 | |||
| Direct D/L link: | http://radare.nopcode.org/get/radare-1.4.1.tar.gz | |||
| License type: | GPL | |||
| Description: | <nowiki>The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc. The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls. The debugger and disassembler has a code analysis module for x86, mips, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary. The toolchain provides assemblers and disasemblers for x86, arm, mips (Loongson2F), sparc, CSR, m68k, powerpc, msil and java. The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so). The debugger is mainly developed on linux and {Net | |||
| Also listed in: | .NET Disassemblers, Assemblers, Binary Diff Tools, Code Injection Tools, Debuggers, Disassemblers, Hex Editors, Java Disassembler Libraries, Linux Debuggers, Linux Disassemblers, Linux Tools, Memory Dumpers, Memory Patchers, Process Dumpers, Reverse Engineering Frameworks, Ring 3 Debuggers, String Finders, Symbol Retrievers, Tracers | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | KernelSpy |
| ||
|---|---|---|---|---|
| Author: | Anton Bassov | |||
| Website: | http://www.codeproject.com/system/kernelspying.asp | |||
| Current version: | 1.0 | |||
| Last updated: | April 22, 2004 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free / Open Source | |||
| Description: | After having published my article about process-wide API spying, I received plenty of encouraging messages - readers have generally accepted my model of hooking function calls. In this article, we will extend our model to kernel- mode spying, and hook the API calls that are made by our target device driver. We will also introduce a brand-new way of communication between the kernel-mode driver and the user-mode application - instead of using system services, we will implement our own mini-version of Asynchronous Procedure Calls. This task is not as complicated as it may seem - in fact, it is just shockingly easy. Windows flat memory model offers us plenty of exciting opportunities - the only thing we need is a sense of adventure (plus a good knowledge of assembly language, of course). All tips and tricks, described in this article, are 100% of my own design - you would not find anything more or less similar to these tricks anywhere. | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Strace for NT |
| ||
|---|---|---|---|---|
| Author: | Bindview Security Research | |||
| Website: | http://razor.bindview.com/tools | |||
| Current version: | 0.3 | |||
| Last updated: | October 21, 2003 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | Strace for NT is a debugging/investigation utility for examining the NT system calls made by a process. It is meant to be used like the strace (or truss) on linux and other unix OSes. | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Strace for NT (with anti anti debug patch) |
| ||
|---|---|---|---|---|
| Author: | Shub-nigurrath / Bindview Security Research | |||
| Website: | http://arteam.accessroot.com/releases | |||
| Current version: | 1.1a | |||
| Last updated: | July 25, 2006 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | Modified version of Strace NT, with advanced antiantidebugging option to hide it to most packers. | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Syscall Lister |
| ||
|---|---|---|---|---|
| Author: | Omega Red | |||
| Website: | http://omeg.pl/ | |||
| Current version: | ||||
| Last updated: | July 18, 2007 | |||
| Direct D/L link: | bin_Syscall_Lister_2007-10-20_23.59__SysCall_32_and_64.zip | |||
| License type: | Free | |||
| Description: | This program enumerates all NT kernel system calls and matches them with native API functions using dbghelp and MS symbols (internet connection is required to download these symbols). It uses kernel mode driver to access arbitrary memory locations, like System Service Descriptor Tables. | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
Feed containing all updates and additions for this category.
Feed containing all updates and additions for this category, including sub-categories.
