wstrace: Linux strace for Windows (in Rust, Zero Drivers)

Описание и применение

wstrace — это инструмент для Windows, позволяющий отслеживать системные вызовы и Win32 API без драйверов, аналогичный Linux strace, с поддержкой системного трассирования, модульных выходов и ARM64.

Задача

Debugging Windows applications often lacks a lightweight, driver‑free equivalent of Linux’s strace.

Результат

wstrace enables fast, driver‑free, system‑wide tracing on Windows, matching Linux strace functionality with additional output formats and ARM64 binaries.

Рабочий процесс

• Install wstrace from GitHub releases
• Run wstrace all to monitor all processes
• Choose output mode: -m stream, -m summary, or --json
• Optionally use the interactive TUI for filtering and export

Доказательства

I built wstrace: a standalone system call and Win32 API monitor in Rust. It runs entirely in user-space using native ETW—zero kernel drivers required.

Источник

System‑Wide Tracing (wstrace all): Monitor events across the entire system simultaneously, not just single processes.

Источник

Modular Output Modes: Live Stream (-m stream), Summary Report (-m summary), NDJSON Export (--json), Interactive TUI.

Источник

Windows on ARM64 Support: Pre‑compiled binaries available for both x64 and ARM64.

Источник