NtStrace

متتبع استدعاءات النظام (system call tracer) على ويندوز (x64) يعتمد على frida-stalker.

[483]NtWaitForWorkViaWorkerFactory
test.exe!0x7ff91fbaf262
[35]NtQueryVirtualMemory
test.exe!0x7ff91fbaf262
[35]NtQueryVirtualMemory
test.exe!0x7ff91fbaf262
[35]NtQueryVirtualMemory
test.exe!0x7ff91fbb06d2
[199]NtCreateThreadEx
[+] Following thread 17876
test.exe!0x7ff91fbb06d2
[7]NtDeviceIoControlFile
[+] Unfollowing thread 17876
test.exe!0x7ff91fbaeee2
[7]NtDeviceIoControlFile
test.exe!0x7ff91fbaeee2
[7]NtDeviceIoControlFile
[+] Unfollowing thread 6344
[+] Unfollowing thread 6124

يمكنه أيضًا تحديد الأنواع التي تُخفي استدعاءات النظام بدقة، مثل المشروع أدناه.
https://github.com/passthehashbrowns/hiding-your-syscalls

الاستخدام

frida -l tracer.js app.exe

الترخيص

iostrace

البرنامج الأصلي متاح على
https://github.com/sh1ma/iostrace.