Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

WUSSTrace is a user-space syscall tracer for Microsoft Windows developed for
fine grained syscall tracing: it supports the majority of Windows system calls
(except GUI system calls), the majority of argument types, and dumps faithfully
all the supported types. WUSSTrace produces easy-to-parse XML traces leveraging
the Boost serialization library. Tracing is performed by injecting a shared
library in the address space of the traced process and by hooking the stubs
KiFastSystemCall and KiIntSystemCall in ntdll.dll.

How to compile WUSSTrace

In order to compile WUSSTrace you need: the MinGW compiler and the Boost
serialization library. Once your development environment is ready simply run

How to use WUSSTrace

To trace the execution of a program you just have to run WUSSTrace and specify
on the command line the name of the program to trace. By default WUSSTrace does
not dump on disk the system calls intercepted. To do that you have to add the
options "-d PATH/PREFIX" to the command line to specify where to store the
traces. To find you other valid command line options run WUSSTrace with no

The system calls traces produced are XML documents. WUSSTrace comes with a
Python interface, called PyWUSS, that facilitates the analysis of XML traces. 


At the moment WUSSTrace only intercepts system calls invoked using
KiIntSystemCall. Support for hooking KiFastSystemCall has not been implemented
yet only because of time constraint. Consequently, if your machine supports
"sysenter" WUSSTrace will not work. To workaround this limitation you can
perform your analyses from within VirtualBox, which virtualizes a IA-32 CPU
without the support for "sysenter". 

WUSSTrace has been tested only on Microsoft Windows XP SP2. 


WUSSTrace is copyrighted (2010) by Lorenzo Martignoni and Roberto Paleari.

It is licensed under GPLv3+ (GNU GPL version 3 or later
<>). For further information about the license
please read the file COPYING included in the distribution.

Contact information

Bug reports, patch submissions, and any other useful contribution are very
welcome; just drop an email to:

* Lorenzo Martignoni <> 
* Roberto Paleari <>


Automatically exported from







No releases published


No packages published