Smiley - an interactive tool for monitoring inter-module function calls

Abstract

Applications running under modern operating systems obtain a significant portion of their functionality from code that is distributed in binary modules that are distinct from the application's own executable. This functionality is accessed by load- or run-time linkage from the application executable or by interprocess communication. Examples of such functionality include user interface management, file system access, process and thread creation and synchronization, and network communications. In the Windows NT operating system, an application obtains this functionality through calls on functions exported from shared libraries. Smiley is a monitoring program that can selectively log these calls as they are made by any application. It does so without any modification of the persistent executable images of either the application or the libraries. Logs of library calls provide insight into an application's implementation. By interactively selecting libraries and functions to monitor, an analyst gradually homes in on aspects of an implementation that are relevant to his objectives. Since it requires only the distributed binary form of the application, Smiley can be used as an aid in comprehending the implementation of COTS software.