strace

Runtime truth serum for Linux programs: if the kernel saw it, strace can usually tell you.

When to use strace

Use strace when you need to:

• see opened files, sockets, child processes, and exec chains
• debug missing libraries, bad paths, permission failures, or seccomp kills
• observe exact syscall arguments around exploit or malware activity
• confirm environment assumptions before touching the target in a debugger

Quick Start

# Trace a process and its syscalls
strace ./chall