I want to monitor all calls to the Windows API.
So just to make clear, this would be software that can log/display the API calls made by windowed applications and background services running on a standalone Windows system.
Should preferably be open source, but proprietary software is also OK (I don't want to indicate a max price I am willing to pay as that is open based on if the software has any other functionality).
Would be great if the application was compatible with Windows 10 as well.
I have always used API Monitor from Rohitab. Not only does it do what you want but it also has other functions.
It supports Windows 7, including x64. Windows 10 is not (yet) listed as a supported OS (statements from the main page):
Windows 2000, Windows XP 32-bit, Windows XP 64-bit x64, Windows Vista 32-bit, Windows Vista 64-bit x64, Windows 7 32-bit, Windows 7 64-bit x64, Windows 8 32-bit, Windows 8 64-bit x64
The 64-bit version can only be used to monitor 64-bit applications and the 32-bit version can be only be used to monitor 32-bit applications. To monitor a 32-bit application on 64-bit Windows, you must use the 32-bit version. Note that the 64-bit installer for API Monitor includes both 64-bit and 32-bit versions.
It supports monitoring services (statements from the main page):
API Monitor supports monitoring of 64-bit applications and services.
It is not open source, but available gratis. The license text is not online but displayed during installation and says:
rohitab.com grants you the right to install and use copies of the SOFTWARE PRODUCT on your computer running a validly licensed copy of the operating system for which the SOFTWARE PRODUCT was designed.
All title, including but not limited to copyrights, in and to the SOFTWARE PRODUCT and any copies thereof are owned by rohitab.com or its suppliers.
I'll recommend you Nektra SpyStudio, it can trace Windows API calls and 3rd party calls as seen in the image below. It works great on any Windows, however, I never noticed whether it can trace services.
SpyStudio shows and interprets calls, displaying the results in a structured way which is easy for any IT professional to understand. SpyStudio can show registry keys and files that an application uses, COM objects and Windows the application has created, and errors and exceptions
SpyStudio is the user-mode Procmon complement. Looking for application errors with kernel-mode traces is tedious, and it is very difficult to see the final outcome of a user-mode call. With kernel-mode tools, you get a lot of noise that the application does not see, since a single user-mode call generates lots of kernel-mode events that are not important from the application's perspective. Most application errors are generated by failed user-mode calls which expect a different state of some resources: registry keys and values, files, pipes, services and printers.
SpyStudio is also able to read Process Monitor logs (see Load ProcMon log) and show them in a user friendly interface. It shows registry operations in tree form like Regedit and displays errors in red. File operations are also displayed in tree form.
