Systrace for Windows

The Dr. Memory (http://drmemory.org) tool comes with a system call tracing tool called drstrace that lists all system calls made by a target application along with their arguments: http://drmemory.org/strace_for_windows.html

For programmatically enforcing system call policies, you could use the same underlying engines as drstrace: the DynamoRIO tool platform (http://dynamorio.org) and the DrSyscall system call monitoring library (http://drmemory.org/docs/page_drsyscall.html). These use dynamic binary translation technology, which does incur some overhead (20%-30% in steady state, but much higher when running new code such as launching a big desktop app), which may or may not be suitable for your purposes.


API Monitor looks very useful for this purpose.


WinDbg's Logger.exe is the closest to strace: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer

EDIT: There's also windbg's wt: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/wt--trace-and-watch-data-


A few options:

Process Monitor

Also, see this article about tools built into Windows 7:

Core OS Tools

Tags:

Windows

Strace