intentrace

intentrace [options] [command [args...]]

intentrace is a syscall tracer that goes beyond raw syscall logging by consulting an extensive backlog of deduction heuristics to explain what each syscall is actually trying to accomplish. Because Linux syscalls often have dual usage that is obfuscated by libraries, seeing the intent behind a syscall is immensely useful when debugging crashing binaries.Unlike traditional strace output which shows raw syscall numbers and arguments, intentrace provides human-readable explanations of what each system call is doing in context.

-p pid, --attach pid

Attach to a running process by PID.

Display only a summary table.

Show summary table in addition to normal output.

Trace child processes when traced programs create them.

Only show failed syscalls.

Redirect output to a file.

Suppress traced program's standard output.

Trace only specific syscalls.

Currently only supports x86-64 Linux. Covers approximately 166 of the 380+ Linux syscalls, focusing on the most commonly used ones. The project is in beta; multi-threaded programs may not trace reliably.

intentrace was created by sectordistrict and is written in Rust. It was designed as a more informative alternative to strace that provides context and meaning for each syscall rather than just raw data.

strace(1), ltrace(1), ptrace(2)