SpyStudio v2.9.2 + x64

Process Monitor Complement
SpyStudio is the user-mode Procmon complement. Looking for application errors with kernel-mode traces is tedious, and it is very difficult to see the final outcome of a user-mode call. With kernel-mode tools, you get a lot of noise that the application does not see, since a single user-mode call generates lots of kernel-mode events that are not important from the application's perspective. Most application errors are generated by failed user-mode calls which expect a different state of some resources: registry keys and values, files, pipes, services and printers.
SpyStudio is also able to read Process Monitor logs (see Load ProcMon log) and show them in a user friendly interface. It shows registry operations in tree form like Regedit and displays errors in red. File operations are also displayed in tree form.

Changes on version 2.7.3.16613 (18-Nov-2013)
FIX: Some fixes in FindResource / LoadResource handlers. Sometimes, they weren't able to get loaded module.
Performance improvements.
Properties in Values now works.
Added Show in Files / Registry / Windows / Com context menu item in trace control.
Compare: lot of improvements and fixes matching events.
Compare: some improvements to match ThinApp applications better.
FIX: Compare Registry: some keys had incorrect result in trace 2.
Asynchronous handlers now available in free version.
Changes on version 2.7.2.16546 (7-Nov-2013)
FIX: Several fixes and performance improvements around harvesting feature.
Performance improvements when applying filters or loading logs.
FIX: Some Window creation times were incorrect in async.
FIX: SpyStudio wasn't working when executed from a shared folder.
FIX: On XP sometimes events are not shown even when processes are hooked.
Database: Reduced space and improved performance.
Changes on version 2.7.1.16515 (1-Nov-2013)
Feature: Improved performance of export dialog.
Feature: Added better automatic algorithm for export dialog.
Feature: Added simple and custom mode to chose files and registry keys.
FIX: Corrected some crashes, wrong paths, errors accessing some files, and general bugs in export dialog.
Changes on version 2.7.0.16437 (24-Oct-2013)
Feature: Event database stores CallEvents in Sqlite database saving memory.
FIX: Filezilla was crashing using Quick Connect feature. NtSetFileInformation function was generating a exception when used for named pipes.
FIX: Crash closing hooked application.
FIX: In different situations the Log compare was failing.
FIX: Compare registry values didn't have Type information.
FIX: Remove unused memory after capturing an application.
FIX: ProcMon logs were not loading.
FIX: Registry tab in Compare dialog: Registry tab wasn't showing RegEnumerate
FIX: Lots of failing RegQueryValue and RegEnumerateKey events were not compared and not shown in the registry tab.
FIX: Registry tab in Compare dialog: Properties wasn't showing only matched events of the second file.
FIX: Ole32.CoGetClassObject wasn't added to the Com tab.
Feature: Big capture performance improvement. Capture time was reduced between 50% and 60%.
Feature: Ability to harvest applications directly from the operating system without installation media.
Feature: Ability to harvest applications executing an installer.
Feature: Export log data to VMware ThinApp.
Changes on version 2.6.0
FIX: Compare: missing class redirection. Different queries to different places that are trying to get the same class information should be merged in the same HKEY_CLASSES_ROOT path.
FIX: AutoSize wasn't working on Tree controls.
Removed tree lines and changed UI.
FIX: Auto search wasn't working as expected.
FIX: Some crashes.
Feature: Merge Wow registry paths.
Feature: Merge COM classes registry paths.
Feature: added Show startup modules and Hide Query attributes options in Compare dialog
Feature: Copy and Select All working on Properties dialogs.
UI: TreeViewAdv: Headers now look like MS TreeView
UI: TreeViewAdv.BorderStyle now is FixedSingle for all controls.
FIX: ThinApp support on Compare dialog.
Feature: Export dialog: Several fixes and new features for Symantec Workspace Virtualization.
Feature: Export dialog: full support for shortcuts.
Feature: Export dialog: full support for local files.
Feature: Export Dialog: Added Isolation Rules.
Feature: Export Dialog: Added load and save from template.
Feature: Export Wizard: Added Load Ldf files.
FIX: Export Wizard: several errors and crashes.
Removed file system events of type C:
Find on Registry tree wasn't working on values
Added NtDeviceIoControlFile hook
QueryDirectory operation wasn't getting file properties if Hide QueryAttributes was set
Added RegQueryKey to the Registry tree
Changes on version 2.5.2
Released in April of 2013

Feature: Go to trace from Properties dialog.
Feature: Merge Wow paths and Show Virtual paths.
Feature: Added QueryDirectory function.
Feature: ExecutionProperties dialog lets you execute an application with parameters and a specific user.
Fix: RegQueryMultipleValues now working.
Fix: some icons were missing in files which access was only Attributes.
Fix: several matching errors in Compare Dialog.
Fix: some exception in Properties dialog.

Changes on version 2.5.1
Released in February of 2013

"Properties" right-click option working for Compare dialog (preliminary version).
Minor fixes.
Changes on version 2.5.0
Released in February of 2013

Fixed issue in which registry entries were not be correctly displayed under Windows XP.
Fixed ProcMon loader.
Now File System and Registry tabs entries do not collapse when receiving new data.
Incremental search working in File Sytem and Registry tabs.
Improved registry usage monitoring performance.
Fixed some memory leaks.
New feature: Export to .reg file.
Fixed File System tab visualization options.
The Compare dialog no longer generates an exception when closed.
Improved log load time (~%50).
Added option to monitor environment variables.
Fixed filtering before compare.
Now Find function can find not visible items.
Fixed "Expand all differences" function.
Added "Show Layer Paths" and "Hide Query Attributes" view options.
Added entry properties visualizer for all tabs.
Fixed bug which would cause erroneously unmatched entries in the Compare dialog.
Known issue: "Properties" right-click option not working for Compare dialog entries (yet!).
Changes on version 2.4.0
Released in January of 2013

File System and Registry are intercepted at ntdll level.
Added all available Registry and File System functions.
File System view mode: Tree and Flat.
Fixed Swv Export Wizzard.
Added different statistics to help driver writers.
Compare statistics.
File System tree can sort by version
Important performance improvements.
Changes on version 2.3.0
Released in October of 2012

New feature: Support for loading and comparing Process Monitor logs.
New feature: "Find" function for all monitoring categories.
New feature: Processes execution with parameters.
New monitoring categories.
Fixed issues related to registry paths not being correctly displayed.
Several bug fixes.
Changes on version 2.0.0
Released in June of 2012

Complete new application oriented to trace applications.
Compare traces.
Filter events in different ways.
Stack trace information.
Find dialog.
Changes on version 1.0.1
Re-released on July of 2008

Fixed: SpyStudio had a wrong version number internally, autoupdate was triggered on an infinite loop.
Fixed: Incorrect runtime dependency made SpyStudio crash on Vista.
Changes from version 1.0.0b to 1.0.1
Released on June of 2008

Fixed: Members of pointers to structs were not displayed in the output.
Performance: Improved for Python scripts output.
Scripts Feature: DStackTrace object lets you inspect the stack in a call.
Fixed: Copy to clipboard from output window was truncating large strings and it did not show if the call was before or after.
Feature: Copy to clipboard shortcut added.
Scripts Fixed: When having more than one hook, each function call triggered HookEvents.OnCall more times than it should.
Feature: Parameter types and names are now displayed on the Output.
Changes from version 0.9.9b to 1.0.0b
Released on February of 2008

New Python tabbed console allows to handle hooks!
Python scripts can be loaded from files.
An initial Python script can be executed on every tab opened.
New Deviare Database Editor allows to expand the modules and functions database!
Breakpoint params browser: The return value and the error code are now editable.
Now SpyStudio can run with SeDebugPrivilege enabled or disabled.
Processes monitoring options are now combinable.
Select all (Ctrl + A) and Copy (Ctrl + C) options are now available for the output window.
'Filters' concept changed to 'Actions'.
Database expanded: wininet.dll added and winternl.h functions of ntdll.dll added.
Fixed: Changing a parameter on the params browser made SpyStudio to crash.
Fixed: Trying to hook a function that was not in the database made SpyStudio to crash when closing.
Fixed: Changing the 'Default hook mode' option was not reflected on the output.
Changes from version 0.9.3b to 0.9.9b
Released on December of 2007

Achieved to hook every categorized function.
Added the capability to hook and wide hook entire categories of functions.
Fixed several bugs.
Significantly improved overall performance.
Significantly improved output display speed.
Changes from version 0.9.1b to 0.9.3b
Released on September of 2007

Added the capability to wide hook functions to intercept calls by every calling process.
Added process monitoring to automatically refresh the process list.
Performance improved.
Several fixes.