Systrace for Windows

Question

I am looking for the equivalent of Windows Systrace or at least strace . I know StraceNT , but I wonder if there are any other alternatives out there. In particular, I am looking for a specific method for software for system call policies, although this may occur after the fact, and not actively stop them.

Is there a good way to do it now?

Answer 1

WinDbg Logger.exe is closest to strace: http://msdn.microsoft.com/en-us/library/windows/hardware/ff552060(v=vs.85).aspx

EDIT: there is also windbg wt: http://blogs.msdn.com/b/debuggingtoolbox/archive/2009/10/12/special-command-tracing-applications-using-wt.aspx

Answer 2

Several variants:

Process monitor

Also see this article about tools built into Windows 7:

Basic OS tools

Answer 3

Dr. Tool Memory ( http://drmemory.org ) comes with a system call tracking tool called drstrace, which lists all the system calls made by the target application along with its arguments: http://drmemory.org/strace_for_windows.html

For system call policy software, you can use the same basic modules as drstrace: the DynamoRIO tool platform ( http://dynamorio.org ) and the DrSyscall system call monitoring library ( http://drmemory.org/docs/page_drsyscall.html ) They use dynamic binary translation technology, which incurs some overhead (20% -30% in steady state, but much higher when starting new code, for example, launching a large desktop application), which may or may not be suitable for your purposes .

Answer 4

The Monitor API looks very useful for this purpose.

Answer 5

Here is a rather interesting article, I don’t know if it falls into the goal you are looking for, but I think that you can find it leading you in the direction you need.

http://jbremer.org/intercepting-system-calls-on-x86_64-windows/

Answer 6

strace can be obtained from Cygwin in the cygwin package. You can download it from Cygwin mirror , for example:

http://mirrors.sonic.net/cygwin/x86_64/release/cygwin/cygwin-2.0.2-1.tar.xz # | | | | # +-----------+----------+ +--+--+ # | | # mirror version 

strace is one of the few Cygwin programs that does not rely on the Cygwin DLL, so you just need to copy strace.exe to wherever you want and use it.

Answer 7

There are several tools built around Xperf. It is quite complex, but very powerful - see the quick start guide . There are other useful resources on the Windows Performance Analysis page .

Answer 8

You can use a process monitor written by Mark Russinovich. This is a fantastic application that will allow you to connect to any running process in the system and see all the system calls that this process currently makes.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

Answer 9

Strace is supported by Git , as Michael Fox mentioned. Maybe useless for complex programs / windows.