Is there something like linux ptrace syscall in Windows?

Question

Reading http://stackoverflow.com/questions/864839/monitoring-certain-system-calls-done-by-a-process I'm wondering about a Windows equivalent to the ptrace syscall or a programatically workaround.

Answer 1

You can use ETW to trace system calls. When starting the trace, in EVENT_TRACE_PROPERTIES, you can add EVENT_TRACE_FLAG_SYSTEMCALL flag to EnableFlags. This enables SysCallEnter and SysCallLeave events, as described here.