  Tracing the sequence of library and system calls that a program makes is very
helpful in the characterization of its interactions with the surrounding
environment and ultimately of its semantics. Due to entanglements of real-world
software stacks, accomplishing this task can be surprisingly challenging as we
take accuracy, reliability, and transparency into the equation. To manage these
dimensions effectively, we identify six challenges that API monitoring
solutions should overcome and outline actionable design points for them,
reporting insights from our experience in building API tracers for software
security research. We detail two implementation variants, based on
hardware-assisted virtualization (realizing the first general-purpose
user-space tracer of this kind) and on dynamic binary translation, that achieve
API monitoring robustly. We share our SNIPER system as open source.
