3 ms·
Ask HN: What do you use to monitor system calls on Windows and Mac?
- PaulHoule 4y agoSomething funny about Windows is that there are no documented system calls. That is, if you want to use some OS service you either call a function in a DLL or you make a COM call to a COM service. If you click on the "show" button in this page https://j00ru.vexillium.org/syscalls/nt/64/ https://j00ru.vexillium.org/syscalls/nt/64/ you can see that the syscall numbers change from release to release! I'm pretty sure that this tool https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/logger-and-logviewer https://docs.microsoft.com/en-us/windows-hardware/drivers/de... works by trapping calls to the DLL, which are stable.
- Jtsummers 4y agoOn macOS you have Instruments, dtrace (which is what Instruments uses under the hood, IIRC), and strace. I haven't had much need for any of these, but you should be able to use dtrace for anything you'd use strace for and it will (or used to, has strace been improved?) get you much better performance while doing the tracing.
- frou_dh 4y agoThere's also the sc_usage TUI and fs_usage command. Maybe they're tapping into the same stuff, I dunno.
- warpspin 4y agoUse dtruss on Mac OS. The dtrace subsystem has become harder to use, though, with system protection active. Supposedly you can get it running again through these tricks https://apple.stackexchange.com/questions/208762/now-that-el-capitan-is-rootless-is-there-any-way-to-get-dtrace-working https://apple.stackexchange.com/questions/208762/now-that-el... but haven't tried it out yet, as I had no need since my Yosemite upgrade to trace syscalls.
- rtldg 4y agoFor Windows, I've used API Monitor a lot to track .dll and API calls. http://www.rohitab.com/apimonitor http://www.rohitab.com/apimonitor