Systrace for Windows

Question

I m looking for a Windows equivalent of Systrace or at least strace  I m aware of  StraceNT  but wondering if there are any more alternatives out there  Specifically  I m looking for a specific way to programmatically enforce system call policies  though this can be after the fact rather than actively stopping them   Is there a good way to do this currently

User · Accepted Answer

WinDbg s Logger exe is the closest to strace  https   docs microsoft com en-us windows-hardware drivers debugger logger-and-logviewer EDIT  There s also windbg s wt  https   docs microsoft com en-us windows-hardware drivers debugger wt--trace-and-watch-data-

User · Answer

You can use process monitor written by Mark Russinovich   This is a fantastic little application that will allow you to attach to any running process on the system and see all of the system calls that process is currently making   https   technet microsoft com en-us sysinternals processmonitor aspx

User · Answer

strace supported By Git as Michael Fox Mention Maybe not useful for complex windows software

User · Answer

Here is a pretty intersting article  I don t know if it hits the target you are looking for but I think you may find it leading you in the direction you want   http   jbremer org intercepting-system-calls-on-x86 64-windows

User · Answer

There are several tools all built around Xperf   It s rather complex but very powerful -- see the quick start guide   There are other useful resources on the Windows Performance Analysis page

User · Answer

A few options   Process Monitor  Also  see this article about tools built into Windows 7   Core OS Tools

User · Answer

The Dr  Memory  http   drmemory org  tool comes with a system call tracing tool called drstrace that lists all system calls made by a target application along with their arguments  http   drmemory org strace for windows html  For programmatically enforcing system call policies  you could use the same underlying engines as drstrace  the DynamoRIO tool platform  http   dynamorio org  and the DrSyscall system call monitoring library  http   drmemory org docs page drsyscall html    These use dynamic binary translation technology  which does incur some overhead  20 -30  in steady state  but much higher when running new code such as launching a big desktop app   which may or may not be suitable for your purposes

User · Answer

strace is available from Cygwin in the cygwin package  You can download it from a Cygwin mirror  for example   http   mirrors sonic net cygwin x86 64 release cygwin cygwin-2 0 2-1 tar xz                                                                              ----------- ----------                                -- --                                                                                    mirror                                       version   strace is one of the few Cygwin programs that does not rely on the Cygwin DLL  so you should be able to just copy strace exe to where you want and use it

User · Answer

API Monitor looks very useful for this purpose

[windows] Systrace for Windows

Examples related to windows

Examples related to strace