99

I'm looking for a Windows equivalent of Systrace or at least strace. I'm aware of StraceNT, but wondering if there are any more alternatives out there. Specifically, I'm looking for a specific way to programmatically enforce system call policies, though this can be after the fact rather than actively stopping them.

Is there a good way to do this currently?

Bryan
  • 2,068
  • 2
  • 15
  • 18
  • Also related - http://stackoverflow.com/questions/864839/monitoring-certain-system-calls-done-by-a-process-in-windows – sashoalm Oct 21 '15 at 11:45

9 Answers9

43

A few options:

Process Monitor

Also, see this article about tools built into Windows 7:

Core OS Tools

djhaskin987
  • 9,741
  • 4
  • 50
  • 86
  • 3
    I just used ProcessMonitor to find out why a process was hanging - turns out it was trying to access a file which it couldn't delete... would never have figured it out without ProcMon – Jamie Cook May 21 '13 at 07:54
  • 2
    I use strace quite a bit on Linux and came across this question while looking for similar tool on Windows for troubleshooting the issue I was having with NANT. I tried Process Monitor, set filter to include only Nant.exe and excluding everything else, also set filter for register access only where I was having problem, and quickly figure out the issue I was having. I highly recommend Process Monitor. – hshib Sep 13 '13 at 22:13
  • @djhaskin987 : In my case I have a program which load some files ; buffer them to ʀᴀᴍ *(so there’s no handle left)* and crash. As there’s no handle left process monitor is no help. – user2284570 Mar 13 '16 at 01:30
  • @hshib : the problem with process monitor is a process don’t need an handle to access a file. So in a case like mine *(trying to see which config file cause a crash)*, it’s no help. – user2284570 Mar 13 '16 at 01:38
31

WinDbg's Logger.exe is the closest to strace: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer

EDIT: There's also windbg's wt: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-

Bruno Martinez
  • 2,850
  • 2
  • 39
  • 47
  • 7
    However, it's more like ltrace than strace because it captures library calls rather than syscalls. – Michael Feb 09 '13 at 23:12
  • @BrunoMartinez : you don’t need to specify a memory address for using strace. – user2284570 Mar 13 '16 at 01:36
  • The only problem I met was windbg stopped at a certain software breakpoint, not at the startup where I was expected.So there were several syscalls I failed to capture. – linzuojian Feb 17 '23 at 01:55
17

The Dr. Memory (http://drmemory.org) tool comes with a system call tracing tool called drstrace that lists all system calls made by a target application along with their arguments: http://drmemory.org/strace_for_windows.html

For programmatically enforcing system call policies, you could use the same underlying engines as drstrace: the DynamoRIO tool platform (http://dynamorio.org) and the DrSyscall system call monitoring library (http://drmemory.org/docs/page_drsyscall.html). These use dynamic binary translation technology, which does incur some overhead (20%-30% in steady state, but much higher when running new code such as launching a big desktop app), which may or may not be suitable for your purposes.

Derek Bruening
  • 330
  • 2
  • 5
14

API Monitor looks very useful for this purpose.

Isaiah Norton
  • 4,205
  • 1
  • 24
  • 38
  • 1
    This is an excellent program, shows detailed function params/return values, allows you to breakpoint when certain conditions are met, many different hooking method so it can be used on a lot of processes that don't like to be inspected. – Hayley Nov 21 '17 at 14:28
7

Here is a pretty intersting article, I don't know if it hits the target you are looking for but I think you may find it leading you in the direction you want.

http://jbremer.org/intercepting-system-calls-on-x86_64-windows/

w33mhz
  • 360
  • 2
  • 3
  • 2
    Thanks, that's pretty good. I guess it means we're still a long way off a nice and functional strace on Windows... – static_rtti Jul 29 '13 at 09:32
2

You can use process monitor written by Mark Russinovich. This is a fantastic little application that will allow you to attach to any running process on the system and see all of the system calls that process is currently making.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

Mike
  • 45
  • 1
2

There are several tools all built around Xperf. It's rather complex but very powerful -- see the quick start guide. There are other useful resources on the Windows Performance Analysis page

the_mandrill
  • 29,792
  • 6
  • 64
  • 93
  • 4
    strace is unrelated to performance. It simply prints which system calls a process makes. The performance tools don't seem to do that. – Jan Hudec Jun 07 '12 at 09:04
1

strace is available from Cygwin in the cygwin package. You can download it from a Cygwin mirror, for example:

http://mirrors.sonic.net/cygwin/x86_64/release/cygwin/cygwin-2.0.2-1.tar.xz
#      |                      |                              |     |
#      +-----------+----------+                              +--+--+
#                  |                                            |
#               mirror                                       version

strace is one of the few Cygwin programs that does not rely on the Cygwin DLL, so you should be able to just copy strace.exe to where you want and use it.

Zombo
  • 1
  • 62
  • 391
  • 407
-2

strace supported By installation of Windwos Git,as Michael Fox Mention Maybe not useful for complex/windows software.

enter image description here

enter image description here

Zaman
  • 811
  • 7
  • 15