Ask HN: What do you use to monitor system calls on Windows and Mac?

https://news.ycombinator.com/item?id=31339670

by sbmthakur • 4 years ago

10 5 4 years ago

news.ycombinator.com

PaulHoule• 4 years ago

Something funny about Windows is that there are no documented system calls. That is, if you want to use some OS service you either call a function in a DLL or you make a COM call to a COM service.

If you click on the "show" button in this page

https://j00ru.vexillium.org/syscalls/nt/64/

you can see that the syscall numbers change from release to release!

I'm pretty sure that this tool

https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

works by trapping calls to the DLL, which are stable.

Jtsummers• 4 years ago

On macOS you have Instruments, dtrace (which is what Instruments uses under the hood, IIRC), and strace. I haven't had much need for any of these, but you should be able to use dtrace for anything you'd use strace for and it will (or used to, has strace been improved?) get you much better performance while doing the tracing.

frou_dh• 4 years ago

There's also the sc_usage TUI and fs_usage command. Maybe they're tapping into the same stuff, I dunno.

warpspin• 4 years ago

Use dtruss on Mac OS. The dtrace subsystem has become harder to use, though, with system protection active. Supposedly you can get it running again through these tricks https://apple.stackexchange.com/questions/208762/now-that-el... but haven't tried it out yet, as I had no need since my Yosemite upgrade to trace syscalls.

rtldg• 4 years ago

For Windows, I've used API Monitor a lot to track .dll and API calls.

http://www.rohitab.com/apimonitor

Ask HN: What do you use to monitor system calls on Windows and Mac?

Related Stories