Capture Portable Executable (PE) EXE internal function call

Question

How could i capture/record all local functions call for an EXE file?The API monitor tools capture the windows API functions call, i want to capture the local function call for example when user click a certain button.

Regards,

Answer 1

API monitors work because it's easy to tell when CPU control passes out of the process and into the OS. What you're asking for is to monitor when the CPU instruction pointer moves from place to place inside the same process memory space. The tool that does this is called a debugger. Examples of debuggers on Windows include Visual Studio, WinDbg, or NTSD.

In increasing order of difficulty, you can:

1) Add the telemetry you want to the source code and recompile the executable.

2) If you have build symbols (usually a PDB file), connect a debugger and set breakpoints/tracepoints on the functions you are interested in.

3) If you have no source, then the task is effectively the same as #2, but much more difficult. You still hook up a debugger, but now you will have trace the program yourself to figure out which memory addresses correspond to the functions you want, then set breakpoints.