{
  "added_at": "2026-11-09",
  "category": "dynamic-analysis",
  "description_en": "STrace reimplements the Windows DTrace syscall and ETW probes. The C++ driver is the feature-complete path and loads DLL plugins whose exports run on syscall entry and return. A Rust driver hosts a WebAssembly interpreter as a separate experiment. Example plugins log syscalls and monitor file deletes. The build uses Visual Studio 2022, a matching Windows SDK, and the Windows Driver Kit. install/install_as_admin.ps1 registers the driver. The README says the driver loads only when driver signature enforcement is off for that boot.",
  "description_zh": "STrace 重实现 Windows DTrace 的系统调用和 ETW 探针。功能完整的路径是 C++ 驱动，它加载 DLL 插件，插件的导出函数在系统调用进入和返回时运行。Rust 驱动把 WebAssembly 解释器作为另一项实验。示例插件记录系统调用并监视文件删除。构建使用 Visual Studio 2022、匹配的 Windows SDK 和 Windows 驱动程序工具包。install/install_as_admin.ps1 注册驱动。README 写明，只有当这次启动关闭了驱动程序签名强制时，驱动才会加载。",
  "entry_url": "https://awesomerea.org/resources/strace/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/strace/",
  "evidence_url": "https://github.com/mandiant/STrace/blob/39d2cc4a53ed6c45675bda950b1c6fabc825f6c6/README.md",
  "group": "tools",
  "id": "strace",
  "json_url": "https://awesomerea.org/resources/strace/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/strace/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/strace/index.md",
  "name": "STrace",
  "name_zh": "STrace",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Visual Studio 2022, a matching Windows SDK, and the Windows Driver Kit. Run install/install_as_admin.ps1 as administrator.",
    "The README does not name a license."
  ],
  "requirements_zh": [
    "需要 Visual Studio 2022、匹配的 Windows SDK 和 Windows 驱动程序工具包。以管理员身份运行 install/install_as_admin.ps1。",
    "README 没有写许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/STrace",
  "verification": "source-reviewed",
  "verified_at": "2026-11-07"
}