Is there something like the Linux ptrace syscall in Windows?

Question

Reading Monitoring certain system calls done by a process in Windows, I'm wondering about a Windows equivalent to the ptrace system call or a programmatical workaround.

score 4 · Accepted Answer · answered May 14 '09 at 19:08

4

You can use ETW to trace system calls. When starting the trace, in EVENT_TRACE_PROPERTIES, you can add EVENT_TRACE_FLAG_SYSTEMCALL flag to EnableFlags. This enables SysCallEnter and SysCallLeave events, as described here.

answered May 14 '09 at 19:08

Michael

54,279
5
125
144

2

But SysCallEnter require Vista or Windows Server 2008, unfortunately. – JesperE May 15 '09 at 10:10
1

Is it possible with ETW to find out the arguments to system calls? – David Roundy Apr 02 '15 at 01:07

Is there something like the Linux ptrace syscall in Windows?

1 Answers1

Linked