Windows strace output format: ---------------------------- A system-call trace is a list of system-call invocations, one per line. Each line contains the following fields in order: 1. ">" or "<" 2. unique id (integer, base 10) 3. "*" 4. process id (integer, base 10) 5. thread id (integer, base 10) 6. system call name (alpha-numeric string) 7. "[" 8. number of arguments (integer, base 10) 9. "]" 10. "(" 11. argument values, separated by commas 12. ")" 13. "==" 14. return value Field 1 is optional. Field 3 is optional. Fields 13 and 14 are optional (both are either present or absent). Explanation of (some) fields: -- Field 1, if present, can have one of two values (">" or "<") System calls in Windows can overlap because the kernel is multithreaded. The symbol ">" indicates that the current trace item represents the start of the system-call invocation. In such a case, syscall arguments that are set as a result of this syscall (i.e., out arguments) are marked by "???". The symbol "<" indicates that the current trace item represents the end of the system-call invocation. In such a case, syscall arguments that are given as input to this syscall (i.e., in arguments) are marked by "???". -- Field 3, if present, marks system-call invocations that were triggerred by the kernel itself, instead of being triggerred by user-space code. -- Fields 13 and 14 appear only on the return of a syscall invocation, i.e., when field 1 is set to "<" or is not present. -- An argument value can have one of the following forms: (a) ??? This represents a value (usually a pointer) whose type is not known, or an in (out) argument for a syscall end (start) (see explanation of field 1 above). (b) integer, base 10 or base 16 (c) unlabelled structure "{" argument values, separated by commas "}" (d) labelled structure "{" name "=" value, separated by commas "}" (e) string value, represented as a C-style string in quotes ( \ -> \\, newline -> \n, non-printable character -> \xNNN, ...) (f) an in-out value: "<" in argument value "|" out argument value ">" (g) symbolic identifier -- A return value can have one of the following forms: (a) integer, base 10 or base 16 (b) symbolic identifier