Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from user-land calls NtQuerySystemInformation() (which in turn, will be ZwQuerySystemInformation() but on kernel-land) and I have hooked that (the Zw-func one) specific function from the kernel space. Is there any way of telling if what user-land program did the call to that Nt-function which called the Zw-function (which I hooked)?

I want to be able to log what APIs does a program calls (like an AV).

  • Should be possible to do using CaptureStackBackTrace – fpmurphy May 3 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.