104

I'm looking for a Windows equivalent of Systrace or at least strace. I'm aware of StraceNT, but wondering if there are any more alternatives out there. Specifically, I'm looking for a specific way to programmatically enforce system call policies, though this can be after the fact rather than actively stopping them.

Is there a good way to do this currently?

1

9 Answers 9

46

A few options:

Process Monitor

Also, see this article about tools built into Windows 7:

Core OS Tools

4
  • 3
    I just used ProcessMonitor to find out why a process was hanging - turns out it was trying to access a file which it couldn't delete... would never have figured it out without ProcMon
    – Jamie Cook
    Commented May 21, 2013 at 7:54
  • 2
    I use strace quite a bit on Linux and came across this question while looking for similar tool on Windows for troubleshooting the issue I was having with NANT. I tried Process Monitor, set filter to include only Nant.exe and excluding everything else, also set filter for register access only where I was having problem, and quickly figure out the issue I was having. I highly recommend Process Monitor.
    – hshib
    Commented Sep 13, 2013 at 22:13
  • @djhaskin987 : In my case I have a program which load some files ; buffer them to ʀᴀᴍ (so there’s no handle left) and crash. As there’s no handle left process monitor is no help. Commented Mar 13, 2016 at 1:30
  • @hshib : the problem with process monitor is a process don’t need an handle to access a file. So in a case like mine (trying to see which config file cause a crash), it’s no help. Commented Mar 13, 2016 at 1:38
33

WinDbg's Logger.exe is the closest to strace: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer

EDIT: There's also windbg's wt: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-

3
  • 7
    However, it's more like ltrace than strace because it captures library calls rather than syscalls.
    – Michael
    Commented Feb 9, 2013 at 23:12
  • @BrunoMartinez : you don’t need to specify a memory address for using strace. Commented Mar 13, 2016 at 1:36
  • The only problem I met was windbg stopped at a certain software breakpoint, not at the startup where I was expected.So there were several syscalls I failed to capture.
    – linzuojian
    Commented Feb 17, 2023 at 1:55
20

The Dr. Memory (http://drmemory.org) tool comes with a system call tracing tool called drstrace that lists all system calls made by a target application along with their arguments: http://drmemory.org/strace_for_windows.html

For programmatically enforcing system call policies, you could use the same underlying engines as drstrace: the DynamoRIO tool platform (http://dynamorio.org) and the DrSyscall system call monitoring library (http://drmemory.org/docs/page_drsyscall.html). These use dynamic binary translation technology, which does incur some overhead (20%-30% in steady state, but much higher when running new code such as launching a big desktop app), which may or may not be suitable for your purposes.

15

API Monitor looks very useful for this purpose.

1
  • 2
    This is an excellent program, shows detailed function params/return values, allows you to breakpoint when certain conditions are met, many different hooking method so it can be used on a lot of processes that don't like to be inspected.
    – Hayley
    Commented Nov 21, 2017 at 14:28
8
+50

Here is a pretty intersting article, I don't know if it hits the target you are looking for but I think you may find it leading you in the direction you want.

http://jbremer.org/intercepting-system-calls-on-x86_64-windows/

1
  • 2
    Thanks, that's pretty good. I guess it means we're still a long way off a nice and functional strace on Windows... Commented Jul 29, 2013 at 9:32
2

There are several tools all built around Xperf. It's rather complex but very powerful -- see the quick start guide. There are other useful resources on the Windows Performance Analysis page

2
1

strace is available from Cygwin in the cygwin package. You can download it from a Cygwin mirror, for example:

http://mirrors.sonic.net/cygwin/x86_64/release/cygwin/cygwin-2.0.2-1.tar.xz
#      |                      |                              |     |
#      +-----------+----------+                              +--+--+
#                  |                                            |
#               mirror                                       version

strace is one of the few Cygwin programs that does not rely on the Cygwin DLL, so you should be able to just copy strace.exe to where you want and use it.

2
  • 12
    It's good, but only seems to work on other cygwin programs. You can't strace notepad. It launches notepad, but doesn't capture any system calls. Commented Dec 2, 2015 at 20:05
  • 5
    @MichaelFox : Yes, it only catch calls to cygwin1.dll. Commented Mar 13, 2016 at 1:32
1

You can use process monitor written by Mark Russinovich. This is a fantastic little application that will allow you to attach to any running process on the system and see all of the system calls that process is currently making.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

1
  • 6
    djhaskin987 already mentioned Process Monitor in his earlier answer. You should edit his answer and edit your description into it. Commented Mar 1, 2017 at 23:50
-1

strace supported By installation of Windwos Git,as Michael Fox Mention Maybe not useful for complex/windows software.

enter image description here

enter image description here

2
  • 8
    That is the Linux program. It only functions with Linus software/syscalls.
    – Henk Poley
    Commented Nov 19, 2020 at 16:45
  • @HenkPoley not sure what u meant?
    – Zaman
    Commented Sep 30, 2021 at 10:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.