mandiant / mandiant/STrace

STrace Installation Problem

Open
#35 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
379
Forks
52
PR merge metrics
No merged PRs in 30d

Description

Hi, I have some issues when I install Strace on my Windows 10 Pro VM machine (Version 22H2 (OS BUILD 19045.5131))
What I did the installation is download and unzip the release zip file (v.1.3.6 and v.1.3.1), move the files to the same folder as the script, and then run the PowerShell script in the install folder as admin. Thanks for the help

```
PS C:\Users\test\Downloads\STrace\install> .\install_as_admin.ps1

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Users\test\Downloads\STrace\install\install_as_admin.ps1?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"): R
STrace Install: Root - C:\Users\test\Downloads\STrace\install
C:\Users\test\Downloads\STrace\install\STraceApiSet.reg C:\Users\test\Downloads\STrace\install\STraceDriver.reg
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
18 4 1540 2028 0.00 5148 1 cmd
```
After Reboot (with F8 and disable DSE)
```
C:\Users\test\Downloads\STrace\install>bcdedit

Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume1
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {default}
displayorder {default}
{current}
{610b9929-ae17-11ef-8e18-806e6f6e6963}
toolsdisplayorder {memdiag}
timeout 30
displaybootmenu Yes

Windows Boot Loader
-------------------
identifier {default}
device partition=C:
path \Windows\system32\winload.efi
description Windows 10
locale en-US
inherit {bootloadersettings}
displaymessageoverride Recovery
recoveryenabled Yes
nointegritychecks Yes
testsigning Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \Windows
resumeobject {610b9929-ae17-11ef-8e18-806e6f6e6963}
nx OptIn
bootmenupolicy Legacy
dtrace Yes

Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \Windows\system32\winload.efi
description STrace (Press F8 to disable DSE)
locale en-US
inherit {bootloadersettings}
displaymessageoverride Recovery
recoveryenabled Yes
nointegritychecks Yes
testsigning Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \Windows
resumeobject {610b9929-ae17-11ef-8e18-806e6f6e6963}
nx OptIn
bootmenupolicy Legacy
dtrace Yes

```
Use CMD as Administrator to open STraceCLI.exe with LogSyscallsPlugin.dll and FileDeleteRecordPlugin.dll
```
C:\Users\test\Downloads\STrace\install>.\STraceCLI.exe
[+] Opening driver
[+] Driver Opened Successfully
Input command: load, unload, exit
load
[+] Asking for plugin
Input command: load, unload, exit
unload
[+] Unloading plugin
Input command: load, unload, exit
```
STrace.txt
```
21:29:31.643 INF #0 7308 Log has been initialized.
21:29:31.643 INF #0 7308 Starting DLL load
21:29:31.643 INF #0 7308 [+] Executing DLLMain
21:29:31.643 INF #0 7308 [+] DLL Load Done
21:29:31.643 INF #0 7308 [+] Dll Mapped at FFFF948387302000
21:29:31.643 INF #0 7308 Plugin Initializing...
21:29:31.643 INF #0 7308 Plugin Initialized
```
Do you have any idea about this bug? Thanks a lot for the help.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing install/install_as_admin.ps1 and reproducing the reported Windows 10 setup with the release files. Run STraceCLI.exe with LogSyscallsPlugin.dll and FileDeleteRecordPlugin.dll, then inspect STrace.txt alongside the command output. Done means the installation and plugin load/unload behavior is understood and the reported failure is fixed or clearly diagnosed.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, powershell
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.