Share on Facebook Tweet on Twitter Share on LinkedIn Share by email
The VTrace tool: building a system tracer for Windows NT and Windows 2000

Jacob R. Lorch and Alan Jay Smith

Abstract

This article describes the techniques used to construct VTrace, a system tracer for Windows NT and Windows 2000. VTrace collects data about processes, threads, messages, disk operations, network operations, and devices. The technique uses a DLL loaded into the address space of every process to intercept Win32 system calls; establishes hook functions for Windows NT kernel system calls; modifies the context switch code in memory to log context switches; and uses device filters to log accesses to devices.

Details

Publication typeArticle
Published inMSDN Magazine
URLhttp://msdn.microsoft.com/msdnmag/issues/1000/VTrace/default.aspx
Pages86–102
Volume15
Number10
> Publications > The VTrace tool: building a system tracer for Windows NT and Windows 2000