Tools of the trade..

Listed below are tools you can use to look at what is going on underneath your operating system. I realize many people probably are unaware of what many of these tools do. However, again when I get a chance I will give a brief tutorial how you can use each tool in a basic way. There are a couple of tools I listed toward the end: debugger and decompiler.. Those two tools require a little more understanding.. If you have some understanding of assembly that may help a bit. The disassembler and debugger I may leave out of the basics. However, after I cover the basics of the other utilities I will go cover the disassembler and debugger later. If you are curious how those utilities work I recommend reading up on assembly language if you want a true understanding.

Here are the tools so you can snoop on whats going on your machine:

Process Explorer:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Process Monitor (like above program but logs information):
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Network Analyzer (Protocol Analyzer - lets you view high level or detail level of all packets going in/out of your machine)
http://www.wireshark.org/

There are other network tools available that are not as detailed as the protocol analyzer. However, I recommend using the above it gives you more details on what is going on. I think even the netstat utility on Windows gives you similar results as the other utilities I am referring to that give you brief view of what ports are open/established/listening/closed per process by command line switch.. (Again.. will go in more detail later about this).

Debuggers:
http://www.ollydbg.de/
Good debugger .. You can attach it to running process and trace/watch what calls are going on etc.. Also, look at the stack.. variables in ram.. etc

Disassemblers:
convert binary executables into readable assembly language with:
http://www.hex-rays.com/idapro/