Created
March 24, 2011 14:11
-
-
Save MKo-xx/885122 to your computer and use it in GitHub Desktop.
trace.c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> // printf | |
#include <string.h> // strerror | |
#include <errno.h> // errno | |
#include <unistd.h> // execl | |
#include <sys/ptrace.h> // ptrace | |
#include <sys/user.h> // user_regs_struct | |
// get from strace sources | |
// cat strace-4.6/linux/x86_64/syscallent.h | sed -e 's/\(".*"\)/=\1/' | sed -e 's/^.*=//' | sed -e 's/"\(.*\)".*$/"\1",/' | |
// | |
char* syscalls[] = { | |
"read", | |
"write", | |
"open", | |
"close", | |
"stat", | |
"fstat", | |
"lstat", | |
"poll", | |
"lseek", | |
"mmap", | |
"mprotect", | |
"munmap", | |
"brk", | |
"rt_sigaction", | |
"rt_sigprocmask", | |
"rt_sigreturn", | |
"ioctl", | |
"pread", | |
"pwrite", | |
"readv", | |
"writev", | |
"access", | |
"pipe", | |
"select", | |
"sched_yield", | |
"mremap", | |
"msync", | |
"mincore", | |
"madvise", | |
"shmget", | |
"shmat", | |
"shmctl", | |
"dup", | |
"dup2", | |
"pause", | |
"nanosleep", | |
"getitimer", | |
"alarm", | |
"setitimer", | |
"getpid", | |
"sendfile", | |
"socket", | |
"connect", | |
"accept", | |
"sendto", | |
"recvfrom", | |
"sendmsg", | |
"recvmsg", | |
"shutdown", | |
"bind", | |
"listen", | |
"getsockname", | |
"getpeername", | |
"socketpair", | |
"setsockopt", | |
"getsockopt", | |
"clone", | |
"fork", | |
"vfork", | |
"execve", | |
"_exit", | |
"wait4", | |
"kill", | |
"uname", | |
"semget", | |
"semop", | |
"semctl", | |
"shmdt", | |
"msgget", | |
"msgsnd", | |
"msgrcv", | |
"msgctl", | |
"fcntl", | |
"flock", | |
"fsync", | |
"fdatasync", | |
"truncate", | |
"ftruncate", | |
"getdents", | |
"getcwd", | |
"chdir", | |
"fchdir", | |
"rename", | |
"mkdir", | |
"rmdir", | |
"creat", | |
"link", | |
"unlink", | |
"symlink", | |
"readlink", | |
"chmod", | |
"fchmod", | |
"chown", | |
"fchown", | |
"lchown", | |
"umask", | |
"gettimeofday", | |
"getrlimit", | |
"getrusage", | |
"sysinfo", | |
"times", | |
"ptrace", | |
"getuid", | |
"syslog", | |
"getgid", | |
"setuid", | |
"setgid", | |
"geteuid", | |
"getegid", | |
"setpgid", | |
"getppid", | |
"getpgrp", | |
"setsid", | |
"setreuid", | |
"setregid", | |
"getgroups", | |
"setgroups", | |
"setresuid", | |
"getresuid", | |
"setresgid", | |
"getresgid", | |
"getpgid", | |
"setfsuid", | |
"setfsgid", | |
"getsid", | |
"capget", | |
"capset", | |
"rt_sigpending", | |
"rt_sigtimedwait", | |
"rt_sigqueueinfo", | |
"rt_sigsuspend", | |
"sigaltstack", | |
"utime", | |
"mknod", | |
"uselib", | |
"personality", | |
"ustat", | |
"statfs", | |
"fstatfs", | |
"sysfs", | |
"getpriority", | |
"setpriority", | |
"sched_setparam", | |
"sched_getparam", | |
"sched_setscheduler", | |
"sched_getscheduler", | |
"sched_get_priority_max", | |
"sched_get_priority_min", | |
"sched_rr_get_interval", | |
"mlock", | |
"munlock", | |
"mlockall", | |
"munlockall", | |
"vhangup", | |
"modify_ldt", | |
"pivot_root", | |
"_sysctl", | |
"prctl", | |
"arch_prctl", | |
"adjtimex", | |
"setrlimit", | |
"chroot", | |
"sync", | |
"acct", | |
"settimeofday", | |
"mount", | |
"umount", | |
"swapon", | |
"swapoff", | |
"reboot", | |
"sethostname", | |
"setdomainname", | |
"iopl", | |
"ioperm", | |
"create_module", | |
"init_module", | |
"delete_module", | |
"get_kernel_syms", | |
"query_module", | |
"quotactl", | |
"nfsservctl", | |
"getpmsg", | |
"putpmsg", | |
"afs_syscall", | |
"tuxcall", | |
"security", | |
"gettid", | |
"readahead", | |
"setxattr", | |
"lsetxattr", | |
"fsetxattr", | |
"getxattr", | |
"lgetxattr", | |
"fgetxattr", | |
"listxattr", | |
"llistxattr", | |
"flistxattr", | |
"removexattr", | |
"lremovexattr", | |
"fremovexattr", | |
"tkill", | |
"time", | |
"futex", | |
"sched_setaffinity", | |
"sched_getaffinity", | |
"set_thread_area", | |
"io_setup", | |
"io_destroy", | |
"io_getevents", | |
"io_submit", | |
"io_cancel", | |
"get_thread_area", | |
"lookup_dcookie", | |
"epoll_create", | |
"epoll_ctl_old", | |
"epoll_wait_old", | |
"remap_file_pages", | |
"getdents64", | |
"set_tid_address", | |
"restart_syscall", | |
"semtimedop", | |
"fadvise64", | |
"timer_create", | |
"timer_settime", | |
"timer_gettime", | |
"timer_getoverrun", | |
"timer_delete", | |
"clock_settime", | |
"clock_gettime", | |
"clock_getres", | |
"clock_nanosleep", | |
"exit_group", | |
"epoll_wait", | |
"epoll_ctl", | |
"tgkill", | |
"utimes", | |
"vserver", | |
"mbind", | |
"set_mempolicy", | |
"get_mempolicy", | |
"mq_open", | |
"mq_unlink", | |
"mq_timedsend", | |
"mq_timedreceive", | |
"mq_notify", | |
"mq_getsetattr", | |
"kexec_load", | |
"waitid", | |
"add_key", | |
"request_key", | |
"keyctl", | |
"ioprio_set", | |
"ioprio_get", | |
"inotify_init", | |
"inotify_add_watch", | |
"inotify_rm_watch", | |
"migrate_pages", | |
"openat", | |
"mkdirat", | |
"mknodat", | |
"fchownat", | |
"futimesat", | |
"newfstatat", | |
"unlinkat", | |
"renameat", | |
"linkat", | |
"symlinkat", | |
"readlinkat", | |
"fchmodat", | |
"faccessat", | |
"pselect6", | |
"ppoll", | |
"unshare", | |
"set_robust_list", | |
"get_robust_list", | |
"splice", | |
"tee", | |
"sync_file_range", | |
"vmsplice", | |
"move_pages", | |
"utimensat", | |
"epoll_pwait", | |
"signalfd", | |
"timerfd_create", | |
"eventfd", | |
"fallocate", | |
"timerfd_settime", | |
"timerfd_gettime", | |
"accept4", | |
"signalfd4", | |
"eventfd2", | |
"epoll_create1", | |
"dup3", | |
"pipe2", | |
"inotify_init1", | |
"preadv", | |
"pwritev", | |
"rt_tgsigqueueinfo", | |
"perf_event_open", | |
"recvmmsg", | |
"fanotify_init", | |
"fanotify_mark", | |
"prlimit64" | |
}; | |
int | |
main() { | |
// create a child process | |
int pid = fork(); | |
// if error occurs | |
if (0 > pid) { | |
printf("Error during forking: %s\n", strerror(errno)); | |
return 1; | |
} | |
// child process | |
if (0 == pid) { | |
ptrace(PTRACE_TRACEME, 0, 0, 0); | |
execl("/bin/ls", "ls", NULL); | |
} | |
// parent process | |
int system_call_count = 0; | |
int status; | |
struct user_regs_struct regs; | |
wait(&status); | |
while(1407 == status) { | |
++system_call_count; | |
// get registers | |
if (0 != ptrace(PTRACE_GETREGS, pid, 0, ®s)) | |
printf("Error during ptrace: %s\n", strerror(errno)); | |
// syscall number is writen in rax register | |
printf("%s - syscall %lu\n", syscalls[regs.orig_rax], regs.orig_rax); | |
// lets the child to continue his work until next sys call or sys exit | |
if (0 != ptrace(PTRACE_SYSCALL, pid, 0, 0) != 0) | |
printf("Error during ptrace: %s\n", strerror(errno)); | |
wait(&status); | |
} | |
// This not 100% true. | |
system_call_count /= 2; | |
printf("System call count: %d\n", system_call_count); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment