Awesome Strace

Important

Strace is a diagnostic, debugging and instructional userspace utility for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal deliveries, and changes of process state.

   

mindmap
  root((strace))

    Process Tracing
      New Process
      Attach Existing PID
      Follow Forks
      Trace Threads

    Syscall Monitoring
      File Operations
      Process Operations
      Memory Operations
      Network Operations
      IPC Operations
      Signals

    Output Analysis
      Arguments
      Return Values
      Error Codes
      Timing
      Statistics

    Reverse Engineering
      Program Behavior
      API Discovery
      Runtime Analysis

    Malware Analysis
      IOC Discovery
      C2 Activity
      Dropped Files
      Persistence Analysis

    Performance Analysis
      Slow Syscalls
      I/O Bottlenecks
      Failed Operations

    Security Monitoring
      File Access
      Privilege Escalation
      Process Injection
      Reconnaissance

    Ecosystem
      ptrace
      ltrace
      gdb
      Frida
      eBPF

Loading

📖 Contents

• My Other Awesome Lists
• Contributing
• Contributors

Tip

Most used commands

strace -f
strace -p PID
strace -o trace.log
strace -c
strace -tt
strace -T
strace -s 1024
strace -e trace=file
strace -e trace=network
strace -e trace=process

My Other Awesome Lists

You can access the my other awesome lists here

Contributing

Contributions of any kind welcome, just follow the guidelines!

Contributors

Thanks goes to these contributors!

License

🔼 Back to top