🧰 strace

The items that name it 12

• morluto/awesome-reverse-engineering
  repo2026-10-09It is written here as strace: Linux system-call tracer.
• Malicious Model Detection with MLTracer Syscalls
  writeup2026-09-01It is written here as strace: syscall tracing.
• N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
  writeup2026-08-20

  Host tracing of QEMU, which set a nonzero TracerPid that the agent detected

• Awesome Malware Analysis
  repo2026-07-31

  Dynamic analysis for Linux executables

• JFrog: PixelSmash
  writeup2026-06-22

  Captured Jellyfin's exact ffprobe command-line arguments, which affect the heap layout needed for the exploit

• Missing system calls in the Linux kernel audit subsystem classes (CVE-2025-71239, CVE-2026-23241)
  writeup2026-03-08

  Used to trace system calls made by userland binaries (e.g. ls, getxattrat) to demonstrate which syscalls trigger audit classes

• Shell Script Compiler (shc)
  writeup2024-12-11

  System call tracer used by the analyst to attempt to trace the shc-compiled binary; blocked by shc's anti-debugging technique

• bedevil: Dynamic Linker Patching
  writeup2024-10-19

  trace system calls (e.g. of ls) to reveal the malicious LD_PRELOAD path being accessed instead of /etc/ld.so.preload

• The 'Invisibility Cloak' - Slash-Proc Magic
  writeup2024-05-16

  Used to trace ps's and netstat's syscalls to determine which /proc files they read

• Sysrv Infection (Linux Edition)
  writeup2024-04-14

  Dynamic analysis of the malware; used to observe execve calls, cronjob creation, and capture config.json contents written to disk (with -s strsize option to increase captured string length)

• AWS Ransomware
  writeup2024-02-21

  Used by the author to dynamically analyze the Linux 'recovery' binary's syscalls (clock_nanosleep, openat, mkdir, etc.) to prove it performed no real network/recovery actions

• [s|l]trace - Linux Malware Analysis
  writeup2024-02-01

  Linux utility used to trace and record system calls (syscalls) and signals of the BPFDoor binary and its child processes, used with -o and -ff options to log each process to a separate file