Ask HN: What do you use to monitor system calls on Windows and Mac?

10 pointsby sbmthakurvor 4 Jahren5 comments

4 comments

Something funny about Windows is that there are no documented system calls. That is, if you want to use some OS service you either call a function in a DLL or you make a COM call to a COM service.

If you click on the "show" button in this page

https://j00ru.vexillium.org/syscalls/nt/64/

you can see that the syscall numbers change from release to release!

I'm pretty sure that this tool

https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

works by trapping calls to the DLL, which are stable.

Jtsummersvor 4 Jahren

On macOS you have Instruments, dtrace (which is what Instruments uses under the hood, IIRC), and strace. I haven't had much need for any of these, but you should be able to use dtrace for anything you'd use strace for and it will (or used to, has strace been improved?) get you much better performance while doing the tracing.

frou_dhvor 4 Jahren

There's also the sc_usage TUI and fs_usage command. Maybe they're tapping into the same stuff, I dunno.

warpspinvor 4 Jahren

Use dtruss on Mac OS. The dtrace subsystem has become harder to use, though, with system protection active. Supposedly you can get it running again through these tricks https://apple.stackexchange.com/questions/208762/now-that-el... but haven't tried it out yet, as I had no need since my Yosemite upgrade to trace syscalls.

rtldgvor 4 Jahren

For Windows, I've used API Monitor a lot to track .dll and API calls.

http://www.rohitab.com/apimonitor