security enabled verified low v1.0.0

strace

System call tracer for monitoring syscalls made by a process, useful for debugging and reverse engineering.

📋 Live Preview

strace -c {binary}

🌍 binary →

strace -c {binary}

Sandbox: execFile · Timeout: 120s

Capabilities

trace.syscall

reverse.analysis

debug.tracing

Parameters

Name	Type	Required	Default	Description	Aliases
`count`	boolean	No	-	Count syscalls and print summary	`-c`
`follow`	boolean	No	-	Trace child processes (fork)	`-f`
`expr`	string	No	-	Filter syscalls by expression	`-e`
`output`	string	No	-	Write trace to file	`-o`
`pid`	integer	No	-	Attach to running process by PID	`-p`
`strsize`	integer	No	-	Max string size to print per string	`-s`
`timestamp`	boolean	No	-	Prefix each line with timestamp	`-t`
`timecalls`	boolean	No	-	Show time spent in syscalls	`-T`
`verbose`	boolean	No	-	Verbose mode (decode structures)	`-v`
`hex`	boolean	No	-	Print non-ascii strings in hex	`-x`
`relative`	boolean	No	-	Print relative timestamps	`-r`
`instrPointer`	boolean	No	-	Print instruction pointer	`-i`
`q`	boolean	No	-	quiet	`-q`
`tt`	boolean	No	-	prefix with full timestamp (usec)	`-tt`
`ttt`	boolean	No	-	prefix with epoch timestamp	`-ttt`
`xx`	boolean	No	-	print all strings in hex	`-xx`

Contract

Inputs

file.binary

Binary to trace system calls

system.pid

Process ID to attach to

Outputs

trace.syscall

System call trace log

trace.summary

Syscall count summary

Side effects: process_spawn

Workflow Edges

Produces

trace.syscalltrace.summary

Consumes

file.binarysystem.pid

Resource Profile

Resource	Value
CPU	low
Memory	32 MB
Network	low
Disk I/O	low

Examples

Count system calls with summary

strace -c /bin/ls

Filter specific syscalls

strace -e trace=open,read,write /bin/ls

Attach to running process

strace -p 1234

Follow child processes

strace -f -o trace.log ./server

Trace with timestamps

strace -t -T /bin/ls

Print instruction pointer with each syscall

strace -i /bin/ls

Documentation

strace — System Call Tracer

strace intercepts and records system calls made by a process. It is an indispensable tool for reverse engineering, debugging, and understanding program behavior at the kernel interface level.

Common Filters

Expression	Effect
`-e trace=file`	Only file-related syscalls
`-e trace=network`	Only network syscalls
`-e trace=process`	Only process-related syscalls
`-e trace=signal`	Only signal syscalls
`-e read=3`	Show data read from fd 3

Example Output (Count Mode)

% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 43.28    0.000211           5        40           write
 28.69    0.000140           5        28           read
 15.78    0.000077           3        28           openat
  6.97    0.000034           1        29           close

Related Tools

ltracegdbtrace-cmd