How to trace system calls in FreeBSD from source code? -
how log system calls (the syscall number , return value, both int 0x80
, sysenter/syscall
) on freebsd 10.1 x86_64 source code?
i know truss
can work, need log other information buffer of copyout
during each system call.
i tried locate source code of truss
, failed. tried trace them in amd64_syscall()
, result seems incomplete compared result of truss
. idea functions should care in implementation?
you have not specified why need of this. in particular, if need security purposes, doing wrong.
what mean failed? sources here: http://bxr.su/freebsd/usr.bin/truss/
general mechanism used tools known ptrace (https://www.freebsd.org/cgi/man.cgi?query=ptrace), , amongst other things allows stopping traced threads execute syscalls.
however, 1 has note while such mechanisms allow copy arguments, other threads can change memory pointed aforementioned args after copy them, before syscall same. want use mac hooks if of concern you.
Comments
Post a Comment