Groups keyboard shortcuts have been updated
Dismiss
See shortcuts

Syscall tracer

13 views
Skip to first unread message

Ahmet Göker

unread,
Jan 2, 2025, 12:31:24 AMJan 2
to DynamoRIO Users

Hello everyone,

I am working on a small project to trace the syscalls of an application. I have created my own target file with critical syscalls, such as execv, to track them using my client DynamoRIO for educational purposes. I have also implemented a memory tracer that monitors read and write operations in the main function.

However, I am encountering some issues with the syscall tracer. My goal is simply to trace syscalls, and I understand that this involves working with the Procedure Linkage Table (PLT). For example, I sometimes get an undefined symbol or fail to trace open@plt properly. It seems I am unable to correctly trace the PLT.

I am seeking assistance to resolve this issue. While I am aware of tools like Dr. Memory, it didn’t work for me on Linux (Ubuntu x86_64). I will share a screenshot to illustrate the problem.

The purpose of this project is to trace specific syscalls, but I am not achieving the desired results. If anyone has references, resources, or experience with a similar project, I would greatly appreciate your help. This is a bit urgent.

dynamor.png

As I mentioned, this is the main goal. Any references, resources, or guidance on how to solve the issue would be greatly appreciated. I was able to find the entry point of the main function, and the objective is to trace the syscalls from the moment the code reaches the main entry point until the end of the main function. The traced syscalls should then be listed in a manner similar to strace.

Thank you!

Derek Bruening

unread,
Jan 2, 2025, 12:37:12 AMJan 2
to DynamoRIO Users
There is already a system call tracing library: https://drmemory.org/page_drsyscall.html

Generally you would look at the actual system call gateway into the kernel instead of a glibc library import, as library imports will miss direct system calls made through other means.

Reply all
Reply to author
Forward
0 new messages