Whether you are a reverse engineer, or just curious about how software runs on your OS, nosco is a tool that allows you to easily capture and analyze an execution trace of a process.

# run a process and capture a full trace (can be very slow, so a maximum call depth is specified)
nosco run -c 'call-depth 3' -o echo.trace -- echo 'hello'

# run a process and capture a scoped trace (here, the function `main`)
nosco run -c 'trace "main" binary="echo"' -o echo.trace -- echo 'hello'

# dump all the created/exited threads in a trace session (also reveals the root call IDs of the trace)
nosco dump -i echo.trace thread-info

# dump a call trace of a particular call
nosco dump -i echo.trace call-trace --depth 2 <CALL_ID>

# dump the executed instructions of a particular call
nosco dump -i echo.trace exec-trace <CALL_ID>

# dump all the loaded/unloaded libraries/images in a trace session
nosco dump -i echo.trace binary-info

A proper documentation of nosco is not available yet.

If you have a Rust toolchain installed, you can install a development version:

cargo install --git https://github.com/jamesmth/nosco --locked

There are already a few mature tools out there that can do the same thing and more (think debuggers, profilers, fuzzers), so why another one? In a few words, nosco is:

• Straightforward to install (single binary, no external dependencies)
• Easy to use, easy to configure
• Not a debugger/profiler/fuzzer, just a control flow tracer
• Developer-friendly (e.g, adding a tracing backend is a matter of implementing a few Rust traits)

In the future, nosco aims to be:

• Multi-platform for tracing local processes (only Linux right now)
• Extensible at runtime via WASM-based plugins (e.g., customize the tracing behavior, interact with the traced process)

Here is an overview of the direction this project is heading.