wstrace: Linux strace for Windows (in Rust, Zero Drivers)

说明与用途

wstrace 是一个 Windows 工具，能够在无驱动程序的情况下跟踪系统调用和 Win32 API，类似于 Linux 的 strace，支持系统级跟踪、模块化输出和 ARM64 二进制文件。

问题

Debugging Windows applications often lacks a lightweight, driver‑free equivalent of Linux’s strace.

结果

wstrace enables fast, driver‑free, system‑wide tracing on Windows, matching Linux strace functionality with additional output formats and ARM64 binaries.

工作流

• Install wstrace from GitHub releases
• Run wstrace all to monitor all processes
• Choose output mode: -m stream, -m summary, or --json
• Optionally use the interactive TUI for filtering and export

证据

I built wstrace: a standalone system call and Win32 API monitor in Rust. It runs entirely in user-space using native ETW—zero kernel drivers required.

来源

System‑Wide Tracing (wstrace all): Monitor events across the entire system simultaneously, not just single processes.

来源

Modular Output Modes: Live Stream (-m stream), Summary Report (-m summary), NDJSON Export (--json), Interactive TUI.

来源

Windows on ARM64 Support: Pre‑compiled binaries available for both x64 and ARM64.

来源