Tool

STrace

STrace reimplements the Windows DTrace syscall and ETW probes. The C++ driver is the feature-complete path and loads DLL plugins whose exports run on syscall entry and return. A Rust driver hosts a WebAssembly interpreter as a separate experiment. Example plugins log syscalls and monitor file deletes. The build uses Visual Studio 2022, a matching Windows SDK, and the Windows Driver Kit. install/install_as_admin.ps1 registers the driver. The README says the driver loads only when driver signature enforcement is off for that boot.

Targets: Binary
Category: Debugging and dynamic analysis
Relationship: Foundation tool
Sources reviewed: 2026-11-07

Stars: 378
Last commit: 2024-10-30
Language: C++
License (GitHub): MIT

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Visual Studio 2022, a matching Windows SDK, and the Windows Driver Kit. Run install/install_as_admin.ps1 as administrator.
The README does not name a license.

Cite

BibTeX

@misc{strace,
  title = {{STrace}},
  howpublished = {\url{https://github.com/mandiant/STrace}},
  url = {https://github.com/mandiant/STrace},
  urldate = {2026-11-07},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/strace/}}
}

Plain text

STrace. https://github.com/mandiant/STrace (accessed 2026-11-07). Awesome REA entry: https://awesomerea.org/resources/strace/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · mandiant/STrace · Revision 39d2cc4