-
-
Save beordle/f88c5d5871b305f49de23fdc4dc14977 to your computer and use it in GitHub Desktop.
trace.c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> // printf | |
#include <string.h> // strerror | |
#include <errno.h> // errno | |
#include <unistd.h> // execl | |
#include <sys/ptrace.h> // ptrace | |
#include <sys/user.h> // user_regs_struct | |
// get from strace sources | |
// cat strace-4.6/linux/x86_64/syscallent.h | sed -e 's/\(".*"\)/=\1/' | sed -e 's/^.*=//' | sed -e 's/"\(.*\)".*$/"\1",/' | |
// | |
char* syscalls[] = { | |
"read", | |
"write", | |
"open", | |
"close", | |
"stat", | |
"fstat", | |
"lstat", | |
"poll", | |
"lseek", | |
"mmap", | |
"mprotect", | |
"munmap", | |
"brk", | |
"rt_sigaction", | |
"rt_sigprocmask", | |
"rt_sigreturn", | |
"ioctl", | |
"pread", | |
"pwrite", | |
"readv", | |
"writev", | |
"access", | |
"pipe", | |
"select", | |
"sched_yield", | |
"mremap", | |
"msync", | |
"mincore", | |
"madvise", | |
"shmget", | |
"shmat", | |
"shmctl", | |
"dup", | |
"dup2", | |
"pause", | |
"nanosleep", | |
"getitimer", | |
"alarm", | |
"setitimer", | |
"getpid", | |
"sendfile", | |
"socket", | |
"connect", | |
"accept", | |
"sendto", | |
"recvfrom", | |
"sendmsg", | |
"recvmsg", | |
"shutdown", | |
"bind", | |
"listen", | |
"getsockname", | |
"getpeername", | |
"socketpair", | |
"setsockopt", | |
"getsockopt", | |
"clone", | |
"fork", | |
"vfork", | |
"execve", | |
"_exit", | |
"wait4", | |
"kill", | |
"uname", | |
"semget", | |
"semop", | |
"semctl", | |
"shmdt", | |
"msgget", | |
"msgsnd", | |
"msgrcv", | |
"msgctl", | |
"fcntl", | |
"flock", | |
"fsync", | |
"fdatasync", | |
"truncate", | |
"ftruncate", | |
"getdents", | |
"getcwd", | |
"chdir", | |
"fchdir", | |
"rename", | |
"mkdir", | |
"rmdir", | |
"creat", | |
"link", | |
"unlink", | |
"symlink", | |
"readlink", | |
"chmod", | |
"fchmod", | |
"chown", | |
"fchown", | |
"lchown", | |
"umask", | |
"gettimeofday", | |
"getrlimit", | |
"getrusage", | |
"sysinfo", | |
"times", | |
"ptrace", | |
"getuid", | |
"syslog", | |
"getgid", | |
"setuid", | |
"setgid", | |
"geteuid", | |
"getegid", | |
"setpgid", | |
"getppid", | |
"getpgrp", | |
"setsid", | |
"setreuid", | |
"setregid", | |
"getgroups", | |
"setgroups", | |
"setresuid", | |
"getresuid", | |
"setresgid", | |
"getresgid", | |
"getpgid", | |
"setfsuid", | |
"setfsgid", | |
"getsid", | |
"capget", | |
"capset", | |
"rt_sigpending", | |
"rt_sigtimedwait", | |
"rt_sigqueueinfo", | |
"rt_sigsuspend", | |
"sigaltstack", | |
"utime", | |
"mknod", | |
"uselib", | |
"personality", | |
"ustat", | |
"statfs", | |
"fstatfs", | |
"sysfs", | |
"getpriority", | |
"setpriority", | |
"sched_setparam", | |
"sched_getparam", | |
"sched_setscheduler", | |
"sched_getscheduler", | |
"sched_get_priority_max", | |
"sched_get_priority_min", | |
"sched_rr_get_interval", | |
"mlock", | |
"munlock", | |
"mlockall", | |
"munlockall", | |
"vhangup", | |
"modify_ldt", | |
"pivot_root", | |
"_sysctl", | |
"prctl", | |
"arch_prctl", | |
"adjtimex", | |
"setrlimit", | |
"chroot", | |
"sync", | |
"acct", | |
"settimeofday", | |
"mount", | |
"umount", | |
"swapon", | |
"swapoff", | |
"reboot", | |
"sethostname", | |
"setdomainname", | |
"iopl", | |
"ioperm", | |
"create_module", | |
"init_module", | |
"delete_module", | |
"get_kernel_syms", | |
"query_module", | |
"quotactl", | |
"nfsservctl", | |
"getpmsg", | |
"putpmsg", | |
"afs_syscall", | |
"tuxcall", | |
"security", | |
"gettid", | |
"readahead", | |
"setxattr", | |
"lsetxattr", | |
"fsetxattr", | |
"getxattr", | |
"lgetxattr", | |
"fgetxattr", | |
"listxattr", | |
"llistxattr", | |
"flistxattr", | |
"removexattr", | |
"lremovexattr", | |
"fremovexattr", | |
"tkill", | |
"time", | |
"futex", | |
"sched_setaffinity", | |
"sched_getaffinity", | |
"set_thread_area", | |
"io_setup", | |
"io_destroy", | |
"io_getevents", | |
"io_submit", | |
"io_cancel", | |
"get_thread_area", | |
"lookup_dcookie", | |
"epoll_create", | |
"epoll_ctl_old", | |
"epoll_wait_old", | |
"remap_file_pages", | |
"getdents64", | |
"set_tid_address", | |
"restart_syscall", | |
"semtimedop", | |
"fadvise64", | |
"timer_create", | |
"timer_settime", | |
"timer_gettime", | |
"timer_getoverrun", | |
"timer_delete", | |
"clock_settime", | |
"clock_gettime", | |
"clock_getres", | |
"clock_nanosleep", | |
"exit_group", | |
"epoll_wait", | |
"epoll_ctl", | |
"tgkill", | |
"utimes", | |
"vserver", | |
"mbind", | |
"set_mempolicy", | |
"get_mempolicy", | |
"mq_open", | |
"mq_unlink", | |
"mq_timedsend", | |
"mq_timedreceive", | |
"mq_notify", | |
"mq_getsetattr", | |
"kexec_load", | |
"waitid", | |
"add_key", | |
"request_key", | |
"keyctl", | |
"ioprio_set", | |
"ioprio_get", | |
"inotify_init", | |
"inotify_add_watch", | |
"inotify_rm_watch", | |
"migrate_pages", | |
"openat", | |
"mkdirat", | |
"mknodat", | |
"fchownat", | |
"futimesat", | |
"newfstatat", | |
"unlinkat", | |
"renameat", | |
"linkat", | |
"symlinkat", | |
"readlinkat", | |
"fchmodat", | |
"faccessat", | |
"pselect6", | |
"ppoll", | |
"unshare", | |
"set_robust_list", | |
"get_robust_list", | |
"splice", | |
"tee", | |
"sync_file_range", | |
"vmsplice", | |
"move_pages", | |
"utimensat", | |
"epoll_pwait", | |
"signalfd", | |
"timerfd_create", | |
"eventfd", | |
"fallocate", | |
"timerfd_settime", | |
"timerfd_gettime", | |
"accept4", | |
"signalfd4", | |
"eventfd2", | |
"epoll_create1", | |
"dup3", | |
"pipe2", | |
"inotify_init1", | |
"preadv", | |
"pwritev", | |
"rt_tgsigqueueinfo", | |
"perf_event_open", | |
"recvmmsg", | |
"fanotify_init", | |
"fanotify_mark", | |
"prlimit64" | |
}; | |
int | |
main() { | |
// create a child process | |
int pid = fork(); | |
// if error occurs | |
if (0 > pid) { | |
printf("Error during forking: %s\n", strerror(errno)); | |
return 1; | |
} | |
// child process | |
if (0 == pid) { | |
ptrace(PTRACE_TRACEME, 0, 0, 0); | |
execl("/bin/ls", "ls", NULL); | |
} | |
// parent process | |
int system_call_count = 0; | |
int status; | |
struct user_regs_struct regs; | |
wait(&status); | |
while(1407 == status) { | |
++system_call_count; | |
// get registers | |
if (0 != ptrace(PTRACE_GETREGS, pid, 0, ®s)) | |
printf("Error during ptrace: %s\n", strerror(errno)); | |
// syscall number is writen in rax register | |
printf("%s - syscall %lu\n", syscalls[regs.orig_rax], regs.orig_rax); | |
// lets the child to continue his work until next sys call or sys exit | |
if (0 != ptrace(PTRACE_SYSCALL, pid, 0, 0) != 0) | |
printf("Error during ptrace: %s\n", strerror(errno)); | |
wait(&status); | |
} | |
// This not 100% true. | |
system_call_count /= 2; | |
printf("System call count: %d\n", system_call_count); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment