strace and ltrace are the first tools malware analysts and incident responders run against an unknown sample in a sandboxed VM, since watching syscalls like openat, connect, and execve reveals behavior in seconds that static disassembly would take hours to uncover. perf's flame-graph workflow, popularized by Brendan Gregg at Netflix, is the same profiling technique production engineers use to find hot paths before ever opening a disassembler.