Building wstrace: A Zero-Driver Windows System & API Monitor in Rust

Description and use

wstrace is a lightweight Windows monitor that runs in user space without drivers, enabling quick inspection of Win32 APIs and syscalls from the terminal.

Problem

Need a quick way to inspect Win32 APIs and syscalls directly from the terminal without installing or managing kernel drivers.

Outcome

wstrace provides a safe, portable, terminal-first monitoring tool that eliminates the need for kernel drivers.

Workflow

• 1. Install wstrace as a single .exe
• 2. Run in Interactive TUI mode to navigate processes and filter events live
• 3. Or run in Headless stream mode with --headless to output JSON or text to stdout
• 4. Pipe output into scripts or other tools

Evidence

I built wstrace, a lightweight terminal-first Windows system and API monitor written in Rust.

Source

wstrace runs purely in user space by tapping into native Windows ETW (Event Tracing for Windows) and Win32 APIs.

Source

It supports two workflows: Interactive TUI and Headless stream.

Source