blocks|key|1120837|text|WinDbg的Logger.exe最接近strace：https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1120838|编辑:还有windbg的wt：https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-|1120839|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer|1|https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-^0|R|2F|0|0|F|2K|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]]]

WinDbg's Logger.exe is the closest to strace: <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer</a>
EDIT: There's also windbg's wt: <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-</a>

blocks|key|1120818|text|以下是几个选项：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1120819|Process+Monitor|offset|length|1120820|此外，请参阅这篇文章，了解Windows+7内置的工具：|1120821|Core+OS+Tools|1120822|entityMap|0|LINK|mutability|MUTABLE|url|http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx|1|http://msdn.microsoft.com/en-us/magazine/ee412263.aspx^0|0|0|F|0|0|0|0|D|1|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@]|9|@$D|V|E|W|1|X]]|A|$]]|$1|F|3|G|5|6|7|Y|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|Z|8|@]|9|@$D|10|E|11|1|12]]|A|$]]|$1|J|3|-4|5|6|7|13|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]|R|$5|M|N|O|A|$P|S]]]]

A few options:

<a href="http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx" rel="noreferrer">Process Monitor</a>

Also, see this article about tools built into Windows 7:

<a href="http://msdn.microsoft.com/en-us/magazine/ee412263.aspx" rel="noreferrer">Core OS Tools</a>

blocks|key|1869555|text|Dr.Memory(+http://drmemory.org/strace_for_windows.html+)工具附带了一个名为drstrace的系统调用跟踪工具，它列出了目标应用程序进行的所有系统调用及其参数:drstrace|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1869556|对于以编程方式实施系统调用策略，您可以使用与drstrace相同的底层引擎:+DynamoRIO工具平台(http://dynamorio.org)和DrSyscall系统调用监控库(http://drmemory.org/docs/page_drsyscall.html)。它们使用动态二进制翻译技术，这确实会产生一些开销(在稳定状态下为20%25-30%25，但在运行新代码时会更高，例如启动一个大型桌面应用程序)，这可能适合也可能不适合您的目的。|1869557|entityMap|0|LINK|mutability|MUTABLE|url|http://drmemory.org/strace_for_windows.html|1|http://dynamorio.org/|2|http://drmemory.org/docs/page_drsyscall.html^0|B|17|0|0|1H|K|1|2K|18|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]|$A|Z|B|10|1|11]]|C|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]|P|$5|I|J|K|C|$L|Q]]]]

The Dr. Memory (<a href="http://drmemory.org" rel="noreferrer">http://drmemory.org</a>) tool comes with a system call tracing tool called drstrace that lists all system calls made by a target application along with their arguments: <a href="http://drmemory.org/strace_for_windows.html" rel="noreferrer">http://drmemory.org/strace_for_windows.html</a>

For programmatically enforcing system call policies, you could use the same underlying engines as drstrace: the DynamoRIO tool platform (<a href="http://dynamorio.org" rel="noreferrer">http://dynamorio.org</a>) and the DrSyscall system call monitoring library (<a href="http://drmemory.org/docs/page_drsyscall.html" rel="noreferrer">http://drmemory.org/docs/page_drsyscall.html</a>). These use dynamic binary translation technology, which does incur some overhead (20%-30% in steady state, but much higher when running new code such as launching a big desktop app), which may or may not be suitable for your purposes.

blocks|key|1866083|text|对于这个目的，API+Monitor看起来非常有用。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1866084|entityMap|0|LINK|mutability|MUTABLE|url|http://www.rohitab.com/apimonitor^0|7|B|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

<a href="http://www.rohitab.com/apimonitor" rel="noreferrer">API Monitor</a> looks very useful for this purpose.

blocks|key|1120856|text|这是一篇非常有趣的文章，我不知道它是否达到了你正在寻找的目标，但我想你可能会发现它会引导你朝着你想要的方向前进。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1120857|http://jbremer.org/intercepting-system-calls-on-x86_64-windows/|offset|length|1120858|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1R|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

Here is a pretty intersting article, I don't know if it hits the target you are looking for but I think you may find it leading you in the direction you want.

<a href="http://jbremer.org/intercepting-system-calls-on-x86_64-windows/" rel="noreferrer">http://jbremer.org/intercepting-system-calls-on-x86_64-windows/</a>

blocks|key|1866095|text|strace可从cygwin+package中的Cygwin获得。您可以从Cygwin+mirror下载它，例如：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1866096|http://mirrors.sonic.net/cygwin/x86_64/release/cygwin/cygwin-2.0.2-1.tar.xz
#++++++%7C++++++++++++++++++++++%7C++++++++++++++++++++++++++++++%7C+++++%7C
#++++++%2B-----------%2B----------%2B++++++++++++++++++++++++++++++%2B--%2B--%2B
#++++++++++++++++++%7C++++++++++++++++++++++++++++++++++++++++++++%7C
#+++++++++++++++mirror+++++++++++++++++++++++++++++++++++++++version|code-block|syntax|javascript|1866097|strace.exe是少数几个不依赖Cygwin+DLL的Cygwin程序之一，因此您应该能够将strace复制到您想要的位置并使用它。|style|CODE|1866098|entityMap|0|LINK|mutability|MUTABLE|url|http://cygwin.com/packages/x86_64/cygwin|1|http://sourceware.org/cygwin/mirrors.lst^0|8|E|0|11|D|1|0|0|0|A|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]|$A|10|B|11|1|12]]|C|$]]|$1|D|3|E|5|F|7|13|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|14|8|@$A|15|B|16|K|L]]|9|@]|C|$]]|$1|M|3|-4|5|6|7|17|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]]]

strace is available from Cygwin in the <a href="http://cygwin.com/packages/x86_64/cygwin" rel="nofollow">cygwin package</a>. You can download it
from a <a href="http://sourceware.org/cygwin/mirrors.lst" rel="nofollow">Cygwin mirror</a>, for example:

<pre class="lang-sh prettyprint-override"><code>http://mirrors.sonic.net/cygwin/x86_64/release/cygwin/cygwin-2.0.2-1.tar.xz
# | | | |
# +-----------+----------+ +--+--+
# | |
# mirror version
</code></pre>

strace is one of the few Cygwin programs that does not rely on the Cygwin DLL,
so you should be able to just copy <code>strace.exe</code> to where you want and use it.

blocks|key|1123463|text|有几个工具都是围绕Xperf构建的。它相当复杂，但功能非常强大--参见quick+start+guide。Windows+Performance+Analysis页面上还有其他有用的资源|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1123464|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/ff190983%2528VS.85%2529.aspx|1|http://msdn.microsoft.com/en-us/performance/default.aspx^0|Z|H|0|1H|S|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

There are several tools all built around Xperf. It's rather complex but very powerful -- see the <a href="http://msdn.microsoft.com/en-us/library/ff190983%28VS.85%29.aspx" rel="nofollow">quick start guide</a>. There are other useful resources on the <a href="http://msdn.microsoft.com/en-us/performance/default.aspx" rel="nofollow">Windows Performance Analysis</a> page

blocks|key|4617899|text|您可以使用Mark+Russinovich编写的进程监视器。这是一个很棒的小应用程序，它允许你附加到系统上任何正在运行的进程，并查看该进程当前正在进行的所有系统调用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4617900|https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx|offset|length|4617901|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1W|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

You can use process monitor written by Mark Russinovich. This is a fantastic little application that will allow you to attach to any running process on the system and see all of the system calls that process is currently making.

<a href="https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx" rel="nofollow noreferrer">https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx</a>

blocks|key|3207713|text|安装Windwos+Git支持的strace，正如Michael+Fox提到的，可能对复杂的/windows软件没有用处。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3207714|​|3207715|📷|atomic|3207716|3207717|3207718|3207719|3207720|entityMap|0|LINK|mutability|MUTABLE|url|https://git-scm.com/downloads|1|https://strace.io/|2|IMAGE|IMMUTABLE|imageUrl|https://i.stack.imgur.com/Wlu70.png|imageAlt|3|https://ask.qcloudimg.com/http-save/yehe-900000/b4abe470858966c62369d831eff7f561.png^0|A|3|0|G|6|1|0|0|0|1|2|0|0|0|0|1|3|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]|$A|18|B|19|1|1A]]|C|$]]|$1|D|3|E|5|6|7|1B|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1C|8|@]|9|@$A|1D|B|1E|1|1F]]|C|$]]|$1|I|3|E|5|6|7|1G|8|@]|9|@]|C|$]]|$1|J|3|E|5|6|7|1H|8|@]|9|@]|C|$]]|$1|K|3|G|5|H|7|1I|8|@]|9|@$A|1J|B|1K|1|1L]]|C|$]]|$1|L|3|E|5|6|7|1M|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|1N|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]|W|$5|X|Q|Y|C|$Z|10|11|-4]]|12|$5|X|Q|Y|C|$Z|13|11|-4]]]]

<a href="https://strace.io/" rel="nofollow noreferrer">strace</a> supported By installation of Windwos <a href="https://git-scm.com/downloads" rel="nofollow noreferrer">Git</a>,as Michael Fox Mention Maybe not useful for complex/windows software.
<a href="https://i.stack.imgur.com/Wlu70.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Wlu70.png" alt="enter image description here" /></a>
<a href="https://i.stack.imgur.com/ifc1P.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ifc1P.png" alt="enter image description here" /></a>

I'm looking for a Windows equivalent of <a href="http://www.citi.umich.edu/u/provos/systrace/" rel="noreferrer">Systrace</a> or at least <a href="http://linux.die.net/man/1/strace" rel="noreferrer">strace</a>. I'm aware of 
<a href="http://www.intellectualheaven.com/default.asp?BH=projects&amp;H=strace.htm" rel="noreferrer">StraceNT</a>, but wondering if there are any more alternatives out there. Specifically, I'm looking for a specific way to programmatically enforce system call policies, though this can be after the fact rather than actively stopping them.

Is there a good way to do this currently?

Systrace for Windows

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我正在寻找一款Windows版的，或者至少是。我知道，但我想知道是否有更多的替代品。具体地说，我正在寻找一种特定的方法来以编程方式强制执行系统调用策略，尽管这可以是事后的，而不是主动地阻止它们。目前有没有好的方法来做到这一点呢？

问Systrace for Windows
EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Systrace for WindowsEN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Systrace for Windows
EN