SpyStudio

SpyStudio is the best product to trace user-mode API calls on Windows. SpyStudio is an Application tracer which shows and interprets calls, displaying the results in a structured way which is easy for any IT professional to understand. SpyStudio can understand the resources that an application uses, track down errors, detect malware and create application layers for virtualization. SpyStudio has a trace comparison tool which is useful for identifying problems in virtualized environments. You can obtain two samples: the native version of the application and the virtual version which has the problems. Using the 'Compare traces' feature, you can see what is missing in the virtual environment. SpyStudio is the user-mode SysInternals Process Monitor's (aka Procmon) complement. Looking for application errors with kernel-mode traces is tedious, and it is very difficult to see the final outcome of a user-mode call. With kernel-mode tools, you get a lot of noise that the application does not see, since a single user-mode call generates lots of kernel-mode events that are not important from the application's perspective. Most application errors are generated by failed user-mode calls which expect a different state of some resources: registry keys and values, files, pipes, services and printers. SpyStudio is also able to load and interpret Procmon logs.

Nektra’s SpyStudio simplifies application virtualization packaging for VMware ThinApp and Symantec Workspace Virtualization. It includes advanced features for application harvesting, and troubleshooting. It is able to package applications with or without installation media in ThinApp environment.