Ask HN: What do you use to monitor system calls on Windows and Mac?

5 comments

[ 7.7 ms ] story [ 123 ms ] thread

Something funny about Windows is that there are no documented system calls. That is, if you want to use some OS service you either call a function in a DLL or you make a COM call to a COM service.

If you click on the "show" button in this page

https://j00ru.vexillium.org/syscalls/nt/64/

you can see that the syscall numbers change from release to release!

I'm pretty sure that this tool

https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

works by trapping calls to the DLL, which are stable.

Jtsummers 4y ago ↗

On macOS you have Instruments, dtrace (which is what Instruments uses under the hood, IIRC), and strace. I haven't had much need for any of these, but you should be able to use dtrace for anything you'd use strace for and it will (or used to, has strace been improved?) get you much better performance while doing the tracing.

frou_dh 4y ago ↗

There's also the sc_usage TUI and fs_usage command. Maybe they're tapping into the same stuff, I dunno.

warpspin 4y ago ↗

Use dtruss on Mac OS. The dtrace subsystem has become harder to use, though, with system protection active. Supposedly you can get it running again through these tricks https://apple.stackexchange.com/questions/208762/now-that-el... but haven't tried it out yet, as I had no need since my Yosemite upgrade to trace syscalls.

rtldg 4y ago ↗

For Windows, I've used API Monitor a lot to track .dll and API calls.

http://www.rohitab.com/apimonitor