Monitoring Windows API calls using system wide hooks - windows

Question

I am trying to monitor Windows API calls. I have read about it and found there is no easier way to monitor API calls system wide than by using kernel drivers. I was wondering if there is any other method to do this system wide? Also if anyone knows of some tutorial on how to monitor API calls using kernel drivers?
I have looked at Microsoft detours and other hooking options but they don't provide for system wide hooking. Also there are other methods which only work for user32.dll

Answer 1

Kernel drivers, who have access to all processes and system calls, are one method for monitoring Windows API calls system-wide. However, there are alternative methods, such as the following:
ETW (Event Tracing for Windows) - ETW is a high-performance event tracing framework for monitoring various system events, including API calls.
Performance Monitoring Counters can track various system performance metrics, such as API call counts and performance.
Inline Hooking - Another technique for monitoring API calls is inline hooking, which involves overwriting the first few instructions of an API function to redirect execution to a custom handler.
The Windows Driver Kit (WDK) documentation, which provides a comprehensive guide on writing and deploying kernel drivers in Windows, contains a tutorial on monitoring API calls using kernel drivers.
It is important to note that monitoring API calls can have security implications because it requires access to system-level data and functions. It is advised to use these techniques with caution and to put proper security measures in place.
Here are some resources that you can use to learn more about Windows API call monitoring:
Event Tracing for Windows (ETW) - https://docs.microsoft.com/en-us/windows/win32/etw/
Windows Driver Kit (WDK) - https://docs.microsoft.com/en-us/windows-hardware/drivers/
Windows System Programming, 4th Edition by Johnson M. Hart - This book provides a comprehensive guide to Windows system programming, including a chapter on kernel-mode programming, which covers the basics of kernel drivers.
Inline Hooking - https://www.codeproject.com/Articles/2082/API-hooking-revealed
Windows API Hooking Techniques - https://www.codeproject.com/Articles/2050/Windows-API-Hooking-Techniques
These resources should provide a good starting point for learning about Windows API call monitoring.

Answer 2

Concerning the use of ETW for monitoring API calls, it is possible that some API calls are not emitted by the system by default and must be enabled manually. If you can't find the API calls you want in the ETW trace, try configuring the trace to include the provider that exposes the events for the desired API calls. To get an output from a crypto provider in ETW, enable it and start a trace session to collect the events emitted by the provider.
here are some online references for getting started with ETW and crypto providers:
Windows Driver Kit (WDK) - ETW:
https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/etw/
MSDN - CryptoAPI:
https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptoapi
MSDN - How to Trace Cryptographic Operations with Event Tracing for Windows (ETW):
https://docs.microsoft.com/en-us/windows/win32/etw/how-to-trace-cryptographic-operations-with-etw
Code Project - Using Event Tracing for Windows (ETW) to Debug Applications:
https://www.codeproject.com/Articles/1000189/Using-Event-Tracing-for-Windows-ETW-to-Debug-App